ubuntu: Add NOPASSWD sudoers rule for 25.10 and 26.04 - #1813
NewtonChutney wants to merge 1 commit into
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures passwordless sudo for the sudo group in Ubuntu 25.10 and 26.04 Containerfiles. The reviewer noted that files created in /etc/sudoers.d/ require strict permissions (such as 0440) to be recognized by sudo, and recommended explicitly setting these permissions to prevent the configuration from being ignored.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
debarshiray
left a comment
debarshiray
left a comment
There was a problem hiding this comment.
Thanks for catching this, @NewtonChutney ! I didn't have the time to test this, but the changes and what you have written about them look sane to me. Maybe @Jmennius (our Ubuntu maintainer) will get to testing them before me.
Could you please correct your Git authorship information with your full name and a real email address? For what it's worth, projects as diverse as GCC, GnuPG, Linux, Moby and Podman don't allow anonymous or pseudonymous contributions.
|
I ran into this bug today also :) |
|
I think some PR descriptions are incorrect.
Directly contradicts the README of
It's either I, personally, prefer temporarily rolling back to the original sudo until the bug is fixed from |
|
Thanks @foriequal0. I'm not aware enough of sudo internals and this analysis was by Claude.. Maybe I should caveat it more clearly.. |
|
@Jmennius would you like to proceed with NOPASSWD or with a switch to the old sudo impl as suggested by @foriequal0:
|
Ubuntu 25.10 switched from traditional C sudo to sudo-rs (Rust-based sudo). Unlike C sudo, sudo-rs does not use PAM for authentication and therefore does not honor the nullok option in /etc/pam.d/common-auth. Toolbox creates users with an empty password (useradd --password "") and relies on PAM's nullok to accept blank authentication. With sudo-rs, this no longer works and the user gets prompted for a password. Fix this by adding an explicit NOPASSWD sudoers drop-in for the sudo group, matching the approach already used in the Arch Containerfile. This works regardless of the sudo implementation. Assisted by: Claude Opus 4.6 <noreply@anthropic.com>
This branch has not been deployed
4 participants
Ubuntu 25.10 switched from traditional C sudo to sudo-rs (Rust-based sudo).
Unlike C sudo, sudo-rs does not use PAM for authentication and therefore does not honor the nullok option in /etc/pam.d/common-auth.Edit: this analysis is wrong, check comment by foriequal0 below.
Toolbox creates users with an empty password (useradd --password "") and relies on PAM's nullok to accept blank authentication. With sudo-rs, this no longer works and the user gets prompted for a password.
Fix this by adding an explicit NOPASSWD sudoers drop-in for the sudo group, matching the approach already used in the Arch Containerfile. This works regardless of the sudo implementation.
Assisted by: Claude Opus 4.6 noreply@anthropic.com
Fixes #1807