Problems using "sudo su -"

TrueNAS General
1

When I do a “sudo su -” on the command line from ssh, I get an error saying “sudo: argv[0] mismatch, expected “/bin/bash”, got “-bash””. I can still su to the root account, just not using the “-” option. Does anybody have any suggestions for how I can fix this?

I am runnig TruenasScale ElectricEel-24.10.1.

2

This is due to a sudo bug and how it interacts with sudo logging. It’s fixed upstream but debian hasn’t picked up the fix.

3

Thanks awalkerix, I can live with that but it does seem like a big flaw.

4

Maybe for a general-purpose OS it would be, but for an appliance where it’s generally discouraged to use shell it’s a somewhat different situation.

5

Is the bug the use of the sole dash, or does it exist even if the alternative flag -l is used?

6

Puzzled by the same - switched to sudo -s for the time being.

sudo su - has been my hardwired “get a root shell” command for literally decades regardless of the OS/distro/whatever.

1 Like
7

https://bugzilla.sudo.ws/show_bug.cgi?id=1050

For reference. It was fixed in Sudo 1.9.14. Debian stable is on 1.9.13.

8

@kentlink, what if you try with:
sudo su -l

9

I always use sudo -i when I need to root around.
Is that not recommended?

10

I get the same error “sudo: argv[0] mismatch, expected “/bin/bash”, got “-bash”
Killed”. As far as I can tell both “sudo su -” and “sudo su -1” do the same thing so this is not surprising.

11

That looks like a 1 and not a lowercase L

12

sudo su root also works

13

This does not invoke the signon scripts. “sudo su -i” or “sudo su -” does this. You can tell becuse the current directory changes. I have found that, “sudo -i” does most of the work of “sudo su -”; I will use that for now.

14

To save a few key strokes, so does just sudo su adding root isn’t needed.

Also, you shouldn’t need to specify - or -l the way TrueNAS is compiled anyway from what I’ve found. I’m not sure there’s any environmental variables of consequence. -l maybe generates an audit trail tho, it would show as a login of root.

1 Like
15

Thanks @awalkerix for the reference. How do you explain that the issue starts only with 24.10, as they have the exact same sudo version (just did a shasum).

I don’t see anybody reporting it to Debian and couldn’t reproduce it any other bookworm.

16

sudo -i?

2 Likes
17

Ok I found what it is.

Diffing the /etc/sudoers file from 24.04:

Defaults log_subcmds
Defaults log_format=json

was added. If removed everything works as before. If you don’t want to remove these lines you can add:

Defaults !intercept_verify

to fix the sudo su - bug

For me adding the !intercept_verify fixed my Ansible issues. And removing the 2 lines above fixed why I couldn’t run any command in lxc-attach anymore.

:relieved: 2 nights of fiddling to understand why my whole automation stopped working :sweat_smile: I didn’t know sudo could be configured to intercept commands. Interesting.