sudo: respect --login regardless of the presence of --chdir

src/common/command.rs

@@ -63,10 +63,7 @@ impl CommandAndArguments {
                 arguments = vec!["-c".to_string(), escaped(arguments)]
             }
         } else {
-            command = arguments
-                .get(0)
-                .map(|s| s.into())
-                .unwrap_or_else(PathBuf::new);
+            command = arguments.get(0).map(|s| s.into()).unwrap_or_default();
             arguments.remove(0);
 
             // remember the original binary name before resolving symlinks; this is not

src/exec/mod.rs

@@ -64,20 +64,22 @@
     if let Some(arg0) = options.arg0() {
         command.arg0(arg0);
     }
+
+    if options.is_login() {
+        // signal to the operating system that the command is a login shell by prefixing "-"
+        let mut process_name = qualified_path
+            .file_name()
+            .map(|osstr| osstr.as_bytes().to_vec())
+            .unwrap_or_else(Vec::new);
+        process_name.insert(0, b'-');
+        command.arg0(OsStr::from_bytes(&process_name));
+    }
+
     // Decide if the pwd should be changed. `--chdir` takes precedence over `-i`.
-    let path = options.chdir().cloned().or_else(|| {
-        options.is_login().then(|| {
-            // signal to the operating system that the command is a login shell by prefixing "-"
-            let mut process_name = qualified_path
-                .file_name()
-                .map(|osstr| osstr.as_bytes().to_vec())
-                .unwrap_or_else(Vec::new);
-            process_name.insert(0, b'-');
-            command.arg0(OsStr::from_bytes(&process_name));
-
-            options.user().home.clone()
-        })
-    });
+    let path = options
+        .chdir()
+        .cloned()
+        .or_else(|| options.is_login().then(|| options.user().home.clone()));
 
     // set target user and groups
     set_target_user(

test-framework/sudo-compliance-tests/src/sudo/flag_chdir.rs

@@ -188,3 +188,19 @@ fn target_user_has_insufficient_perms() -> Result<()> {
 
     Ok(())
 }
+
+#[test]
+fn flag_login_is_respected() -> Result<()> {
+    let expected = "-bash";
+    let env = Env("ALL ALL=(ALL:ALL) CWD=* ALL").build()?;
+
+    let output = Command::new("sh")
+        .arg("-c")
+        .arg("sudo --login --chdir /tmp echo '$0'")
+        .output(&env)?
+        .stdout()?;
+
+    assert_eq!(expected, output);
+
+    Ok(())
+}