https://cybertoolchain.io/tools/sudo New releases and features in sudo, tracked by The Cyber Toolchain. en Sat, 21 Jun 2025 15:18:17 GMT https://github.com/sudo-project/sudo/releases/tag/v1.9.17 https://github.com/sudo-project/sudo/releases/tag/v1.9.17 Sat, 21 Jun 2025 15:18:17 GMT sudo v1.9.17 adds SUDO_TTY env var, hardens timing-attack resistance, and enables ignore_dot by default. • Adds `SUDO_TTY` environment variable when the user has a terminal, enabling scripts to find the original tty device when sudo runs in its own pseudo-terminal. • Suggests using ssh's `-t` option when sudo is run via ssh without a terminal and a password is required. • The `ignore_dot` sudoers setting is now on by default, hardening PATH against current-directory injection; a new `--disable-ignore-dot` configure option allows opt-out. • Adds new Cantonese translation for sudo. • Uses `TCSAFLUSH` instead of `TCSADRAIN` when disabling echo, ensuring buffered password input is discarded and never echoed. Breaking changes: • The `ignore_dot` sudoers setting is now on by default; existing setups that rely on `.` in PATH being honored will break unless `--disable-ignore-dot` is used at build time or `ignore_dot` is explicitly set to off in sudoers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.16p2 https://github.com/sudo-project/sudo/releases/tag/v1.9.16p2 Mon, 25 Nov 2024 19:07:53 GMT sudo v1.9.16p2 improves chroot jail support by passing terminal device numbers and resolving paths via /proc/self/fd • On Linux, uses symbolic links in `/proc/self/fd/{0,1,2}` to map terminal device numbers to path names when `/dev/pts` is not mounted in a chroot jail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.16p1 https://github.com/sudo-project/sudo/releases/tag/v1.9.16p1 Wed, 13 Nov 2024 02:19:47 GMT sudo 1.9.16p1 adds duplicate-alias location warnings, a new configure option, and quieter dry-run mail behavior. • Duplicate alias warnings in sudoers now include the file and line number of the previous definition, making policy debugging faster. • New `--with-secure-path-value=no` configure option lets packagers ship the default sudoers file with the secure_path line commented out. • Suppresses mail triggered by `mail_badpass` or `mail_always` when running `sudo -nv` or `sudo -nl`, matching the existing no-log behavior for dry runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.16 https://github.com/sudo-project/sudo/releases/tag/v1.9.16 Sun, 01 Sep 2024 22:11:39 GMT sudo 1.9.16 adds denial messages, compact JSON logging, PAM output control, and a new IBM Directory Server schema. • Adds `cmddenial_message` sudoers option to display custom text to users when a command is denied by the sudoers policy. • Adds `json_compact` value for the `log_format` sudoers option, enabling compact JSON output when logging to a file; existing `json` value aliased to `json_pretty`. • Adds `pam_silent` sudoers option, which can be negated (`!pam_silent`) to allow PAM authentication module output to reach the user. • Paths in `Chdir_Spec` and `Chroot_Spec` sudoers directives may now be double-quoted. • Sudo insults are now compiled in by default; enabled via `--with-insults` configure option or the `insults` sudoers option. • Default sudoers file now enables `secure_path` by default and preserves `EDITOR`, `VISUAL`, and `SUDO_EDITOR` when running visudo; new `--with-secure-path-value` configure option sets the default value. • Includes a new sudoers schema for IBM Directory Server (IBM Tivoli Directory Server / IBM Security Directory Server / IBM Security Verify Directory). • Sudo now warns the user when the terminal device path cannot be determined, and uses the terminal device number directly in time stamp files. Breaking changes: • The existing `json` value for the `log_format` sudoers option is now aliased to `json_pretty`; in a future release `json` will alias to `json_compact`, changing default JSON log formatting for setups using `log_format=json`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.15 https://github.com/sudo-project/sudo/releases/tag/v1.9.15 Mon, 06 Nov 2023 17:52:37 GMT sudo v1.9.15 adds JSON logging of source files/roles and new environment keys; fixes CVEs and bugs • Adds `submitenv` key to JSON logs to record the invoking user's environment; removed `runenv` for rejected commands. • Enables _intercept_ and _log_subcmds_ support for both 32-bit and 64-bit binaries in AIX and Solaris packages. Breaking changes: • The `runenv` key is no longer logged for rejected commands; `submitenv` replaces it for the invoking user's context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/blob/HEAD/NEWS https://github.com/sudo-project/sudo/blob/HEAD/NEWS Mon, 06 Nov 2023 17:52:37 GMT Sudo 1.9.15 adds `iolog_file` path escape handling and logs sudoers source in JSON events • Logs the sudoers source in the JSON event log to identify which rule matched. • Replaces path separator characters ('/') in user, group, or host names with underscores when expanding escapes in `@include` and `@includedir` directives as well as the `iolog_file` and `iolog_dir` sudoers Default settings • Logs the invoking user's environment as `submitenv` in JSON logs instead of logging the command's environment (`runenv`) for rejected commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.14 https://github.com/sudo-project/sudo/releases/tag/v1.9.14 Tue, 27 Jun 2023 22:31:48 GMT sudo v1.9.14 adds --enable-adminconf, NETGROUP_QUERY support, and colon-separated conf paths • Adds `--enable-adminconf` configure option to specify a preferred configuration directory separate from `sysconfdir` • Enables use of the `NETGROUP_QUERY` parameter in `ldap.conf` to disable netgroup Triple queries for LDAP servers that do not support them while still allowing direct netgroup membership lookups • Converts sudo configuration file paths to colon-separated lists, allowing configuration files on read-only filesystems with local modifications in writable directories Breaking changes: • Sudo now requires a C99 compiler due to the use of flexible array members • The `use_pty` sudoers option is now enabled by default; add `Defaults !use_pty` to restore the historic behavior where a command is run in the user's terminal Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/blob/HEAD/NEWS https://github.com/sudo-project/sudo/blob/HEAD/NEWS Tue, 27 Jun 2023 22:31:48 GMT Sudo 1.9.14 adds NETGROUP_BASE support, pseudo-terminal initialization for background jobs, and colon-separated config paths via --enable-adminconf • When NETGROUP_BASE is set in the ldap.conf file, sudo will now perform its own netgroup lookups of the host name instead of using the system innetgr(3) function. • The visudo utility now displays a warning when it ignores a file in an include dir such as /etc/sudoers.d. • When running a command in a pseudo-terminal, sudo will initialize the terminal settings even if it is the background process. • Sudo's `-b` option now works when the command is run in a pseudo-terminal. • Sudo configuration file paths have been converted to colon-separated lists of paths. • The new `--enable-adminconf` configure option can be used to specify a directory that is searched for configuration files in preference to the sysconfdir. Breaking changes: • Defaults use_pty is now enabled by default; run sudo with `Defaults !use_pty` in /etc/sudoers to restore historic behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.13 https://github.com/sudo-project/sudo/releases/tag/v1.9.13 Tue, 14 Feb 2023 18:13:18 GMT Adds __list__ pseudo-command in sudoers; control char escaping for JSON/logs; drops developer_mode setting • Adds a new `__list__` pseudo-command in sudoers to allow non-root users to list another user's privileges via `-U`. • JSON logging now escapes control characters that appear in the command or environment. • Control characters in sudo log messages and `sudoreplay -l` output are now escaped in octal format, with improved argument quoting. • Sudo no longer checks ownership/mode of loaded plugins; `developer_mode` setting is removed. • Default library build style changes to AIX-style shared libraries (`.a` containing `.so`) on AIX for better compatibility. Breaking changes: • The `developer_mode` setting in sudo.conf is no longer recognized and should be removed from configuration files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.12 https://github.com/sudo-project/sudo/releases/tag/v1.9.12 Sun, 23 Oct 2022 14:34:15 GMT Adds -N flag to check credential validity and new sudoers I/O logging settings • Adds `-N` (no-update) CLI option to prevent credential cache updates, enabling `sudo -Nnv` to verify if a user's credentials are currently valid • Adds `intercept_verify` sudoers setting to verify command path, arguments and environment have not changed since authorization in ptrace-based intercept mode • Adds `log_stdin`, `log_stdout`, `log_stderr`, `log_ttyin`, and `log_ttyout` sudoers settings for fine-grained I/O logging support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.11 https://github.com/sudo-project/sudo/releases/tag/v1.9.11 Mon, 06 Jun 2022 17:39:54 GMT Adds AppArmor profile confinement via APPARMOR_PROFILE sudoers option, new intercept_type setting for ptrace-based interception, and detailed email error reporting. • Adds `APPARMOR_PROFILE` sudoers option to confine commands by a named AppArmor profile • Adds `intercept_type` sudoers setting to control ptrace(2) usage for `_intercept_` and `_log_subcmds_` on Linux with seccomp support • Error messages sent via email now include the file name, line number, and column of the error, and aggregate multiple errors in a single message Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.10 https://github.com/sudo-project/sudo/releases/tag/v1.9.10 Thu, 03 Mar 2022 22:58:09 GMT Adds `log_passwords`/`passprompt_regex` sudoers settings and new regex support in rules for v1.9.10 • Added `log_passwords` and `passprompt_regex` sudoers options to control password logging behavior. • Added `log_passwords` and `passprompt_regex` settings to `sudo_logsrvd` configuration. • Added support for POSIX extended regular expressions in sudoers commands/arguments using `^...$` syntax. • Added `noninteractive_auth` sudoers option to enable PAM authentication when `-n` is used. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo https://github.com/sudo-project/sudo/releases/tag/v1.9.9 https://github.com/sudo-project/sudo/releases/tag/v1.9.9 Fri, 28 Jan 2022 02:46:05 GMT v1.9.9 adds resource limits to sudoers, `cvtsudoers` CSV output and `-O/-P` flags for `visudo` • Adds `-O` and `-P` options to `visudo` to check or set file ownership and permissions. • Allows setting resource limits directly in the sudoers file via new config keys. • `cvtsudoers` now supports output in CSV format via a new flag. Breaking changes: • The core dump size limit is now set to 0 by default unless overridden by the sudoers file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sudo