archive of https://utcc.utoronto.ca/~cks/space/blog/linux/Ubuntu2604RustSudoNotCompatible


The Ubuntu 26.04 Rust sudo is not compatible with standard sudo
November 2, 2026

Today I made an unhappy discovery:

    Ah, charming, the Rust sudo on Ubuntu 26.04 is ignoring our /etc/sudoers.d files and their instructions, with no logging about it. That's a yeet, thanks for trying, now go away.

I didn't attempt any particular analysis of the problem before doing 'update-alternatives --set sudo /usr/bin/sudo.ws' and I haven't filed a bug because we aren't Canonical's free debugging resource (and it turns out it wouldn't do any good). In our installer framework, disabling the Rust Sudo now goes along with disabling the Rust coreutils (which we have a custom build-essentials package to enable us to do), and the change has been done on all of our Ubuntu 26.04 machines. To spoil the ending, it turns out that the Rust Sudo is actively incompatible with standard Sudo in a way that matters.

(I'm extremely not interested in helping Canonical's project of replacing perfectly good C programs of long standing, many of them GPL'd, with non-GPL'd Rust reimplementations. After various Canonical actions, I no longer trust that Canonical has good intentions here.)

The failure I actively noticed was sudo-rs's failure to allow me no-password access to something when one of our long standing /etc/sudoers.d file allows it. Specifically, our file has

    %corestaff ALL=NOPASSWD: /usr/bin/mailq "", \
                             /usr/sbin/exim -bp, \
                             /usr/sbin/exim -bp[acru]

In normal, standard sudo this allows core staff to run any of 'exim -bpa', 'exim -bpc', 'exim -bpr', or 'exim -bpu'. In sudo-rs, this instead allows you to run literally 'exim "-bp[acru]"', which of course is incorrect usage for Exim:

    $ sudo-rs /usr/sbin/exim "-bp[acru]"
    exim: unknown, malformed, or incomplete option -bp[acru]

The sudo-rs 'sudoers' manual page suggests that this is a deliberate decision, which makes the Rust version of sudo very definitely not a compatible implementation. The manual page has a nice full section and description of 'Wildcards', and then at the end casually says:

    Wildcards in command line arguments are not supported—using these in original versions of sudo was usually a sign of mis-configuration and consequently sudo-rs simply forbids using them. The only supported use is ‘*’ as the final argument to indicate “zero or more subsequent arguments as noted above.

I do not really have words for this. The Rust sudo has apparently opted to keep the single most dangerous wildcard while disallowing all of the wildcards that allow one to be narrow and specific about what you're allowing, and it buries this at the end of a section that devotes a bunch of words to describing functionality it doesn't have and doesn't support, with absolutely nothing else in that section to say this (either up front or in the descriptions of how all the wildcards would work if sudo-rs supported them, which it doesn't).

Also, this is documentation calculated to mislead busy system administrators who are skimming it to see if there is some big difference between the Rust sudo that Canonical has stuck them with and the real version of sudo. This is extremely egregious given that many, many system administrators who are dealing with Rust Sudo have already read (or skimmed) the standard sudoers manual page in the past, and are therefor looking for ways where Rust Sudo is different. Rust Sudo demands that you read every single word of a voluminous, boring, opaque manual page to find the bear traps. This is not the behavior of friendly documentation. Friendly documentation would have a prominent section (at the start) on how and where Rust Sudo differs in sudoers from standard Sudo. I consider Rust Sudo's lack of such a section to be a giant middle finger extended in the direction of me and other system administrators.

I would remove sudo-rs from our systems entirely except, well, Canonical:

    # apt-get remove sudo-rs
    [...]
    The following packages will be REMOVED:
      sudo-rs ubuntu-minimal

I don't want to find out what happens in the long term if I remove 'ubuntu-minimal'.

(Well, what happens in the long term is that we move to Debian, quite possibly in 2028 when we have to start replacing 24.04 LTS machines.)