Sudoers snapd.conf will be ignored

[Frank Quinn]

There is a sudoers configuration file in an ubuntu 20.04 install of snapd:

root@locutus:/etc/sudoers.d# dpkg -S /etc/sudoers.d/99-snapd.conf
snapd: /etc/sudoers.d/99-snapd.conf

Which contains:

# Allow snap-provided applications to work with sudo

Defaults secure_path += /snap/bin

However I don't believe this file gets parsed. I tried to create my own similar file 01-xxxx.conf alongside it for entirely unrelated reasons assuming the file name was consistent and it didn't work. On closer inspection it looks like sudo ignores any included files containing a period.

https://stackoverflow.com/questions/21640770/file-in-etc-sudoers-d-file-not-being-read-by-sudo/21640893

I don't really use snap in my environment so don't know if there's any impact to the above, but thought I'd be a good citizen and report.

[Maciej Borzecki (maciek-borzecki)]

And on top of that, secure_path cannot be overwritten or appended to. We stopped shipping the file on Fedora and Arch. It should be dropped from the deb too.

[Maciej Borzecki (maciek-borzecki)]

I've proposed a PR removing the file from snapd https://github.com/snapcore/snapd/pull/8885

[Dimitri Papadopoulos (dimitri-papadopoulos)]

Yet I can still find the file in Ubuntu 20.04, although the current version of snapd is 2.49:

$ dpkg -S /etc/sudoers.d/99-snapd.conf
snapd: /etc/sudoers.d/99-snapd.conf
$
$ dpkg -l snapd
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-============-============-============================================
ii snapd 2.49.2+20.04 amd64 Daemon and tooling that enable snap packages
$

[Ian Johnson (anonymouse67)]

@Dimitri, is that a fresh installation of 20.04 or has it been around for a while? I don't think we remove the file on systems that got it before, but it shouldn't be installed on fresh, new images like 20.04.2 for example

[Dimitri Papadopoulos (dimitri-papadopoulos)]

Ah, it might be a left-over from a previous release. Yet, I seem to recall this machine runs a clean Ubuntu 20.04 installation.

$ sudo rm /etc/sudoers.d/99-snapd.conf
$
$ sudo apt reinstall snapd
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 10 not upgraded.
[...]
$
$ ls /etc/sudoers.d/99-snapd.conf
ls: cannot access '/etc/sudoers.d/99-snapd.conf': No such file or directory
$

[Dimitri Papadopoulos (dimitri-papadopoulos)]

I don't have much experience with DEB packaging, but perhaps /etc/sudoers.d/99-snapd.conf is not properly removed when updating the snapd package.

[Maciej Borzecki (maciek-borzecki)]

AFAIU existing conf files get special treatment even if the new version of the package does not ship them. The filas are still considered as owned by the package and do not get automatically removed.