mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-01 05:50:30 +08:00
0a7251aa83
Teleport validates the contents of sudoers files by using visudo to check the contents. The binary is invoked from disk using arguments -c -f - which indicate to validate the content passed via stdin. Ubuntu 25 and newer uses sudo-rs by default. This causes problems because the version shipped in Ubuntu 25 does not contain the fix for https://github.com/trifectatechfoundation/sudo-rs/issues/1358. This causes visudo to attempt to read a file with the literal name `-` instead of from stdin. As a result all Teleport sessions which try to write a sudoers file entry get a file does not exist error from visudo. The sanest way to work around this issue without added burden to end users is to stop using stdin with visudo. All sudoers entries are first written to a temporary file on disk and that file is provided to visudo.