sudo

No entries match these filters. Clear filters

1. v1.9.17 Jun 21, 2025 · release notes

   sudo v1.9.17 adds SUDO_TTY env var, hardens timing-attack resistance, and enables ignore_dot by default.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.17 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.17

   • Adds SUDO_TTY environment variable when the user has a terminal, enabling scripts to find the original tty device when sudo runs in its own pseudo-terminal.
   • Suggests using ssh's -t option when sudo is run via ssh without a terminal and a password is required.
   • The ignore_dot sudoers setting is now on by default, hardening PATH against current-directory injection; a new --disable-ignore-dot configure option allows opt-out.
   • Adds new Cantonese translation for sudo.
   • Uses TCSAFLUSH instead of TCSADRAIN when disabling echo, ensuring buffered password input is discarded and never echoed.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The ignore_dot sudoers setting is now on by default; existing setups that rely on . in PATH being honored will break unless --disable-ignore-dot is used at build time or ignore_dot is explicitly set to off in sudoers.
2. v1.9.16p2 Nov 25, 2024 · release notes

   sudo v1.9.16p2 improves chroot jail support by passing terminal device numbers and resolving paths via /proc/self/fd

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.16p2 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.16p2

   • On Linux, uses symbolic links in /proc/self/fd/{0,1,2} to map terminal device numbers to path names when /dev/pts is not mounted in a chroot jail.

   1 detail in Everything

3. v1.9.16p1 Nov 13, 2024 · release notes

   sudo 1.9.16p1 adds duplicate-alias location warnings, a new configure option, and quieter dry-run mail behavior.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.16p1 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.16p1

   └──▷ TRY IT
   Build sudo so the default sudoers ships with secure_path disabled — useful for distro packages that manage PATH policies separately.
   copy

   $ ./configure --with-secure-path-value=no

   • Duplicate alias warnings in sudoers now include the file and line number of the previous definition, making policy debugging faster.
   • New --with-secure-path-value=no configure option lets packagers ship the default sudoers file with the secure_path line commented out.
   • Suppresses mail triggered by mail_badpass or mail_always when running sudo -nv or sudo -nl, matching the existing no-log behavior for dry runs.

   3 details in Everything

4. v1.9.16 Sep 1, 2024 · release notes

   sudo 1.9.16 adds denial messages, compact JSON logging, PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. output control, and a new IBM Directory Server schema.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.16 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.16

   └──▷ TRY IT
   Show a custom denial message to users blocked by sudoers policy, e.g. to point them to a ticketing system.
   copy

   $ echo 'Defaults cmddenial_message="Access denied. Request access at https://helpdesk.example.com"' >> /etc/sudoers.d/denial_msg

   Switch sudo's file-based audit log to compact JSON to save space and ease machine parsing.
   copy

   $ echo 'Defaults log_format=json_compact' >> /etc/sudoers.d/logging

   Allow PAM module messages (e.g. password expiry warnings) to surface to the user during sudo authentication.
   copy

   $ echo 'Defaults !pam_silent' >> /etc/sudoers.d/pam_output

   • Adds cmddenial_message sudoers option to display custom text to users when a command is denied by the sudoers policy.
   • Adds json_compact value for the log_format sudoers option, enabling compact JSON output when logging to a file; existing json value aliased to json_pretty.
   • Adds pam_silent sudoers option, which can be negated (!pam_silent) to allow PAM authentication module output to reach the user.
   • Paths in Chdir_Spec and Chroot_Spec sudoers directives may now be double-quoted.
   • Sudo insults are now compiled in by default; enabled via --with-insults configure option or the insults sudoers option.

   +3 more show less

   • Default sudoers file now enables secure_path by default and preserves EDITOR, VISUAL, and SUDO_EDITOR when running visudo; new --with-secure-path-value configure option sets the default value.
   • Includes a new sudoers schema for IBM Directory Server (IBM Tivoli Directory Server / IBM Security Directory Server / IBM Security Verify Directory).
   • Sudo now warns the user when the terminal device path cannot be determined, and uses the terminal device number directly in time stamp files.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The existing json value for the log_format sudoers option is now aliased to json_pretty; in a future release json will alias to json_compact, changing default JSON log formatting for setups using log_format=json.
5. v1.9.15 Nov 6, 2023 · release notes

   sudo v1.9.15 adds JSON logging of source files/roles and new environment keys; fixes CVEs and bugs

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.15 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.15

   • Adds submitenv key to JSON logs to record the invoking user's environment; removed runenv for rejected commands.
   • Enables _intercept_ and _log_subcmds_ support for both 32-bit and 64-bit binaries in AIX and Solaris packages.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The runenv key is no longer logged for rejected commands; submitenv replaces it for the invoking user's context.
6. 1.9.15 Nov 6, 2023 · release notes

   Sudo 1.9.15 adds iolog_file path escape handling and logs sudoers source in JSON events

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.9.15 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout 1.9.15

   • Logs the sudoers source in the JSON event log to identify which rule matched.
   • Replaces path separator characters ('/') in user, group, or host names with underscores when expanding escapes in @include and @includedir directives as well as the iolog_file and iolog_dir sudoers Default settings
   • Logs the invoking user's environment as submitenv in JSON logs instead of logging the command's environment (runenv) for rejected commands

   3 details in Everything

7. v1.9.14 Jun 27, 2023 · release notes

   sudo v1.9.14 adds --enable-adminconf, NETGROUP_QUERY support, and colon-separated conf paths

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.14 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.14

   • Adds --enable-adminconf configure option to specify a preferred configuration directory separate from sysconfdir
   • Enables use of the NETGROUP_QUERY parameter in ldap.conf to disable netgroup Triple queries for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. servers that do not support them while still allowing direct netgroup membership lookups
   • Converts sudo configuration file paths to colon-separated lists, allowing configuration files on read-only filesystems with local modifications in writable directories

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Sudo now requires a C99 compiler due to the use of flexible array members
   • !The use_pty sudoers option is now enabled by default; add Defaults !use_pty to restore the historic behavior where a command is run in the user's terminal
8. 1.9.14 Jun 27, 2023 · release notes

   Sudo 1.9.14 adds NETGROUP_BASE support, pseudo-terminal initialization for background jobs, and colon-separated config paths via --enable-adminconf

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.9.14 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout 1.9.14

   └──▷ USE IT
   Specify an alternate admin configuration directory during build to override the default sysconfdir search path.
   shell copy

   ./configure --enable-adminconf=/opt/sudo/conf

   • When NETGROUP_BASE is set in the ldap.conf file, sudo will now perform its own netgroup lookups of the host name instead of using the system innetgr(3) function.
   • The visudo utility now displays a warning when it ignores a file in an include dir such as /etc/sudoers.d.
   • When running a command in a pseudo-terminal, sudo will initialize the terminal settings even if it is the background process.
   • Sudo's -b option now works when the command is run in a pseudo-terminal.
   • Sudo configuration file paths have been converted to colon-separated lists of paths.

   +1 more show less

   • The new --enable-adminconf configure option can be used to specify a directory that is searched for configuration files in preference to the sysconfdir.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Defaults use_pty is now enabled by default; run sudo with Defaults !use_pty in /etc/sudoers to restore historic behavior.
9. v1.9.13 Feb 14, 2023 · release notes

   Adds __list__ pseudo-command in sudoers; control char escaping for JSON/logs; drops developer_mode setting

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.13 https://github.com/sudo-project/sudo.git
   # already have the repo? check out this version:
   $ git checkout v1.9.13

   • Adds a new __list__ pseudo-command in sudoers to allow non-root users to list another user's privileges via -U.
   • JSON logging now escapes control characters that appear in the command or environment.
   • Control characters in sudo log messages and sudoreplay -l output are now escaped in octal format, with improved argument quoting.
   • Sudo no longer checks ownership/mode of loaded plugins; developer_mode setting is removed.
   • Default library build style changes to AIX-style shared libraries (.a containing .so) on AIX for better compatibility.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The developer_mode setting in sudo.conf is no longer recognized and should be removed from configuration files.
10. v1.9.12 Oct 23, 2022 · release notes

    Adds -N flag to check credential validity and new sudoers I/O logging settings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.12 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.12

    └──▷ USE IT
    Check if a user's cached credentials are valid without updating them, useful for shell prompt indicators
    shell copy

    sudo -Nnv && echo 'Credentials valid' || echo 'Credentials expired'

    Enable verification of command integrity in intercept mode to ensure authorized parameters haven't been tampered with
    text copy

    # In /etc/sudoers:
    Defaults intercept_verify

    Log specific streams in sudoers for detailed auditing of command execution
    text copy

    # In /etc/sudoers:
    Defaults log_stdin, log_stdout

    • Adds -N (no-update) CLI option to prevent credential cache updates, enabling sudo -Nnv to verify if a user's credentials are currently valid
    • Adds intercept_verify sudoers setting to verify command path, arguments and environment have not changed since authorization in ptrace-based intercept mode
    • Adds log_stdin, log_stdout, log_stderr, log_ttyin, and log_ttyout sudoers settings for fine-grained I/O logging support

    3 details in Everything

11. v1.9.11 Jun 6, 2022 · release notes

    Adds AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code. profile confinement via APPARMOR_PROFILE sudoers option, new intercept_type setting for ptrace-based interception, and detailed email error reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.11 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.11

    └──▷ TRY IT
    Run a command confined by a specific AppArmor profile via sudoers.
    copy

    $ myuser ALL=(ALL) APPARMOR_PROFILE=\"usr.sbin.my_service\" /usr/bin/my_service

    Force sudo to use ptrace-based interception for subcommand logging on supported Linux architectures.
    copy

    $ Defaults intercept_type=\"ptrace\"
    myuser ALL=(ALL) _log_subcmds_ /bin/ls

    • Adds APPARMOR_PROFILE sudoers option to confine commands by a named AppArmor profile
    • Adds intercept_type sudoers setting to control ptrace(2) usage for _intercept_ and _log_subcmds_ on Linux with seccomp support
    • Error messages sent via email now include the file name, line number, and column of the error, and aggregate multiple errors in a single message

    3 details in Everything

12. v1.9.10 Mar 3, 2022 · release notes

    Adds log_passwords/passprompt_regex sudoers settings and new regex support in rules for v1.9.10

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.10 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.10

    • Added log_passwords and passprompt_regex sudoers options to control password logging behavior.
    • Added log_passwords and passprompt_regex settings to sudo_logsrvd configuration.
    • Added support for POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. extended regular expressions in sudoers commands/arguments using ^...$ syntax.
    • Added noninteractive_auth sudoers option to enable PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. authentication when -n is used.

    4 details in Everything

13. v1.9.9 Jan 28, 2022 · release notes

    v1.9.9 adds resource limits to sudoers, cvtsudoers CSV output and -O/-P flags for visudo

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.9 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.9

    └──▷ USE IT
    Check sudoers file ownership and permissions during a syntax check run.
    shell copy

    visudo -c -O root -P 0440 /etc/sudoers

    Export sudoers rules to CSV for entitlement reporting.
    shell copy

    cvtsudoers -f /etc/sudoers -t csv > output.csv

    • Adds -O and -P options to visudo to check or set file ownership and permissions.
    • Allows setting resource limits directly in the sudoers file via new config keys.
    • cvtsudoers now supports output in CSV format via a new flag.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The core dump size limit is now set to 0 by default unless overridden by the sudoers file.
14. v1.9.8 Sep 13, 2021 · release notes

    sudo v1.9.8 adds intercept mode and log_subcmds for monitoring/controlling sub-commands in privileged shells.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.8 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.8

    • Adds intercept Defaults setting and INTERCEPT command tag to restrict or monitor sub-commands in privileged shells
    • Adds intercept_authenticate sudoers setting to control password prompting for intercepted sub-commands
    • Adds intercept_allow_setid sudoers setting to permit set-user-ID/set-group-ID programs in intercept mode
    • Adds log_subcmds sudoers setting to log additional commands run within a privileged shell via interception

    4 details in Everything

15. v1.9.7 May 12, 2021 · release notes

    sudo_logsrvd relay mode and sudo_sendlog time limit

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.7 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.7

    • sudo_logsrvd gains a relay mode for creating log server hierarchies, with the store_first setting to buffer I/O locally before relaying.
    • The sudo_sendlog utility now supports the -s flag to stop sending I/O records after a specified elapsed time.

    2 details in Everything

16. v1.9.6 Mar 13, 2021 · release notes

    v1.9.6 adds --disable-leaks and --enable-fuzzer configure options for dev/fuzzing workflows.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.6 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.6

    └──▷ USE IT
    Compile sudo with fuzzing support enabled for development testing.
    shell copy

    ./configure --enable-fuzzer --enable-sanitizer && make

    Configure sudoers to allow control over the ~/.sudo_as_admin_successful file behavior.
    config copy

    admin_flag

    • Adds --disable-leaks configure option to suppress memory leaks on exit for use with development tools that measure memory leaks.
    • Adds --enable-fuzzer configure option to integrate oss-fuzz and LLVM's libFuzzer, allowing sudo to be built with fuzzing support when combined with --enable-sanitizer.
    • Adds admin_flag sudoers option to make the use of the ~/.sudo_as_admin_successful file configurable on systems built with --enable-admin-flag.

    3 details in Everything

17. v1.9.5 Jan 11, 2021 · release notes

    sudo v1.9.5 adds selinux sudoers option and fixes argv[0] program name manipulation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.5 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.5

    • Adds the selinux sudoers option to disable SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. support in sudoedit
    • sudo now falls back to the __sudo__ program name if executed via a different binary name, preventing argv[0] manipulation
    • lecture_file must now point to a regular file or symlink to one; non-regular files are rejected

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !lecture_file no longer accepts arbitrary file types; it must refer to a regular file or symbolic link to a regular file
18. v1.9.4p1 Dec 17, 2020 · release notes

    macOS sudo no longer requires group_source dynamic for users with >16 groups

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.4p1 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.4p1

19. v1.9.4 Nov 30, 2020 · release notes

    sudo v1.9.4 adds JSON logging for sudoers, extends logsrv protocol, and improves visudo/PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. behavior

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.4 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.4

    └──▷ USE IT
    Enable JSON logging for sudo commands to facilitate structured log parsing by external SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. tools.
    config copy

    # In /etc/sudoers or drop-in file
    Defaults log_format=json

    Configure sudo_logsrvd to disable PID file creation by setting pid_file to an empty string.
    config copy

    # In /etc/sudo_logsrvd.conf
    pid_file = ""

    • sudoers plugin now supports JSON-formatted logs via the log_format option (values: sudo, json). Default remains sudo.
    • visudo utility now correctly handles EDITOR environment variables containing single or double quotes in command arguments.
    • PAM session modules are now executed when sudo is set-user-ID root, allowing modules to determine the original user-ID.
    • sudo_logsrvd sends accept, reject, and alert events even if I/O logging is disabled but log_servers is configured.
    • The sudo logsrv protocol (AlertMessage) now supports an optional array of InfoMessage payloads.

    +2 more show less

    • An empty value for the pid_file setting in sudo_logsrvd.conf disables the process ID file generation.
    • visudo syntax error messages now include the column number in addition to the line number.

    7 details in Everything

20. v1.9.3 Sep 21, 2020 · release notes

    Sudo v1.9.3 adds per-command CWD/CHROOT options and error recovery mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.3 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.3

    • Adds CWD and CHROOT sudoers options to set the working directory or root directory on a per-command basis
    • Adds runchroot and runcwd Defaults settings for global working directory or root directory configuration
    • Adds -D (--chdir) and -R (--chroot) command-line flags to invoke CWD/CHROOT functionality when sudoers allows it

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Sudoers rules must now end in either a newline or the end-of-file; multiple rules on a single line separated by white space are no longer permitted
    • !The historic behavior of refusing to run upon sudoers syntax error is restored if error_recovery=false is not added to the sudoers plugin's optional arguments in sudo.conf; the new default is recovery
21. v1.9.1 Jun 19, 2020 · release notes

    sudo v1.9.1 adds -F follow to sudoreplay and new sudoers include directives

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.1 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.1

    └──▷ TRY IT
    Watch live I/O logs for an active sudo session
    copy

    $ sudoreplay -F <session_id>

    Include a sudoers snippet from a path containing spaces
    text copy

    @include "/etc/sudoers.d/custom rules" # or @includedir /etc/sudoers\.d

    • Adds the -F (follow) flag to sudoreplay to replay sessions still in progress
    • Supports @include and @includedir sudoers directives with embedded white space support

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The sudoHost attribute is no longer treated as a wildcard in LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./SSSD back-ends; missing attributes are now ignored
22. v1.9.0 May 12, 2020 · release notes

    sudo v1.9.0 adds centralized I/O logging daemon, Python 3 plugin support, approval plugins, and JSON log files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    • sudo_logsrvd logging daemon enables centralized I/O logs over TLS when built with --enable-openssl
    • log_servers sudoers setting configures central log server endpoints
    • sudo_sendlog utility sends existing sudo I/O logs to a centralized server
    • Python 3 plugin support enabled via --enable-python configure option
    • _audit_ plugin type receives accept, reject, exit and error messages for custom logging

    +11 more show less

    • Multiple audit plugins may be specified in the sudo.conf file
    • _approval_ plugin type performs additional checks after security policy acceptance
    • Multiple approval plugins may be specified in the sudo.conf file
    • pam_ruser sudoers setting enables or disables setting the PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. remote user value during PAM session setup
    • pam_rhost sudoers setting enables or disables setting the PAM remote host value during PAM session setup
    • sudo -i warns but runs in current directory if target user's home directory does not exist (previously a fatal error)
    • -S command line option causes the sudo conversation function to write to standard output or standard error instead of the terminal device
    • Cmd_Alias can be used as an alternative to Cmnd_Alias for defining command aliases
    • Multiple SHA-2 digests may now be specified for a single command, separated by a comma
    • SHA-2 digest can be specified in conjunction with the ALL reserved word in a command specification
    • sudo_logsrvd and sudo create an extended I/O log info file in JSON format for additional information like host name

    16 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !SUDO_COMMAND environment variable is now truncated at 4096 characters.
23. v1.8.30 Dec 31, 2019 · release notes

    Adds _allow_unknown_runas_id_ and runas_check_shell sudoers settings to control unknown IDs and shell validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.30 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.30

    • Adds the _allow_unknown_runas_id_ sudoers setting to enable or disable support for unknown user or group IDs, which is now disabled by default
    • Adds the _runas_check_shell_ sudoers setting to require that the runas user has a shell listed in /etc/shells, preventing commands from running as users like bin without a valid shell

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default behavior for unknown user or group IDs has changed; previously allowed via ALL alias, it now requires the _allow_unknown_runas_id_ sudoers setting to be explicitly enabled
    • !Visudo will treat a fully-qualified path to sudoedit as an error
24. v1.8.29 Oct 28, 2019 · release notes

    Adds _log_allowed_ and _log_denied_ sudoers settings to control logging granularity; improves cvtsudoers input validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.29 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.29

    • Adds _log_allowed_ and _log_denied_ sudoers settings to disable logging of allowed/denied commands
    • Implements conditional umask handling in PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded./login.conf when sudoers does not explicitly set a value

    2 details in Everything

25. v1.8.28 Oct 14, 2019 · release notes

    Adds -B flag to ring terminal bell on password prompt; improves env_editor default and sudoedit umask handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.28 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.28

    └──▷ USE IT
    Trigger an audible alert when waiting for a password prompt to avoid missing the input request.
    shell copy

    sudo -B ls

    • Adds the -B command line option that rings the terminal bell when prompting for a password
    • Changes the default value of the env_editor sudoers flag to enabled (on by default)
    • Makes sudoedit honor the umask and umask_override settings from sudoers

    3 details in Everything

26. v1.8.25 Sep 17, 2019 · release notes

    sudo v1.8.25 adds monotonic timer I/O logs, LDIF policy support for testsudoers, and LOGIN env var on AIX

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.25 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.25

    • I/O log timing file entries now use a monotonic timer with nanosecond precision.
    • The testsudoers utility now supports querying an LDIF-format policy.
    • Sudo sets the LOGIN environment variable to match LOGNAME on AIX systems.

    3 details in Everything

27. v1.8.26 Sep 17, 2019 · release notes

    Adds sudoreplay -S flag, OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. TLS_REQCERT support, and negated LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. sudoers entries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.26 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.26

    └──▷ TRY IT
    Replay a sudo session including the time it was suspended.
    copy

    $ sudoreplay -S <session_id>

    Configure TLS certificate verification for the LDAP backend using OpenLDAP's standard setting.
    copy

    $ # In ldap.conf:
    TLS_REQCERT allow

    • sudoreplay gains the -S flag to include suspended time in session replays rather than skipping it.
    • Supports OpenLDAP's TLS_REQCERT setting in ldap.conf for configuring TLS certificate verification.
    • The sudoers LDAP back-end now supports negated sudoRunAsUser and sudoRunAsGroup entries.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Sudo no longer sets the USERNAME environment variable when running commands.
28. v1.8.27 Sep 17, 2019 · release notes

    New visudo path syntax, HP-UX nanosecond timestamps, and PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. silent session logic

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.27 https://github.com/sudo-project/sudo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.27

    └──▷ USE IT
    Edit a sudoers file located in a non-standard directory using visudo.
    shell copy

    visudo /etc/sudoers.local

    • visudo now accepts a sudoers file path as a positional argument without requiring the -f flag.
    • Added nanosecond precision support for file time stamps on HP-UX.
    • On HP-UX, sudo now updates the utmps file when running a command in a pseudo-tty (previously only updated utmp and utmpx).
    • sudo no longer forces a command into a pseudo-tty if an I/O logging plugin is configured but fails to actually log any I/O.
    • PAM sessions opened by sudo now set the silent flag, except when running sudo -s or sudo -i, preventing pam_lastlog output for each command.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default AIX hard resource limit for the maximum number of files a user may have open is changed to unlimited when no hard limit for nofiles is explicitly set in /etc/security/limits (previously 8196).