Re:Sudo: Remove “This incident will be reported.” from user ...
by stefncb on Saturday April 29, 2023 @01:12PM
(#35754856)
It's only removed if sudo doesn't send mail. It still warns if it's relevant.
Re:Sudo: Remove “This incident will be reported.” from user ...
by electroly on Saturday April 29, 2023 @01:23PM
(#35754975)
This is a pretty short diff and it clearly does NOT do that, unless you're saying they went back later in another commit to add this. They removed the message in all situations. The string "This incident will be reported" has been removed from the source code; it could not possibly print that message now.
Re:Sudo: Remove “This incident will be reported.” from user ...
by simse on Saturday April 29, 2023 @01:34PM
(#35755099)
The warning is added back here: https://github.com/sudo-project/sudo/commit/9757d29a24ac1872...
Re:Sudo: Remove “This incident will be reported.” from user ...
by bo0tzz on Saturday April 29, 2023 @01:35PM
(#35755119)
This is correct, and was added back a few weeks later in https://github.com/sudo-project/sudo/commit/9757d29a24ac1872...
Re:Sudo: Remove “This incident will be reported.” from user ...
by freedomben on Saturday April 29, 2023 @01:30PM
(#35755040)
Is there more to the change than the linked commit? Because if not, looking at the code change I don't see how you could possibly be correct. There is no additional logic/branching that could be checking whether sudo sends mail or not, just a string change.
Re:Sudo: Remove “This incident will be reported.” from user ...
by TaylorAlexander on Saturday April 29, 2023 @02:22PM
(#35755615)
It was added back in a later commit but only prints if the mail is configured.
Re:Sudo: Remove “This incident will be reported.” from user ...
by freedomben on Saturday April 29, 2023 @03:42PM
(#35756390)
Nice, thanks that's very useful info
Re:Sudo: Remove “This incident will be reported.” from user ...
by fafqg on Saturday April 29, 2023 @01:23PM
(#35754980)
This doesn't seem to be correct.
Re:Sudo: Remove “This incident will be reported.” from user ...
by can16358p on Saturday April 29, 2023 @03:35PM
(#35756319)
Isn't it leaking detail about internal policy about whether incorrect sudoing is getting reported or not though?
Re:Sudo: Remove “This incident will be reported.” from user ...
by asveikau on Saturday April 29, 2023 @01:23PM
(#35754977)
I feel like that warning comes right out of the era of multi-user machines with unprivileged shell accounts. That era is largely gone. Today, someone, possibly a less knowledgeable user, runs sudo on their single user laptop that they completely own outright, and may get confused who they're being "reported" to.
Re:Sudo: Remove “This incident will be reported.” from user ...
by jamal-kumar on Saturday April 29, 2023 @01:36PM
(#35755127)
Funny if you live in a free country
Potentially terrifying if you don't
Re:Sudo: Remove “This incident will be reported.” from user ...
by wkat4242 on Saturday April 29, 2023 @02:55PM
(#35755901)
To themselves of course. That's pretty clear.
But there is a renewed focus on corporate laptops to remove admin rights on windows. I'm sure this will come to Linux too at some point
Of course decent log collection/monitoring should also be able to catch authlog stuff and alert accordingly and I'm sure most organizations rely on solutions like that instead of letting things get lost in email