[sudo-users] aix sudo 1.8.11-2 with defaults of mail_always in /etc/sudoers also mails sudo -l access; older version did not

Sharon Hawthorne Sharon.Hawthorne at sharp.com
Tue Jan 20 15:26:06 MST 2015

There has been a change in the way sudo processes the "mail_always" default.  I am not sure in what version this behavior changed, but will be trying back versions & the newest development version.

Our environment:

AIX version 6.1
# ls -l sudo*.rpm
-rw-rw-r--    1 root     system      1726265 Oct 24 14:37 sudo-1.8.11-2.aix53.lam.rpm

Previously, with the setup in /etc/sudoers including:

User_Alias      LOGGERS = user1, user2,...
Defaults:LOGGERS timestamp_timeout=0, mail_always, \
                           mailto="<mail-address>", \
                           mailsub="[I][SECURITY][AIX/%h] SUDO access by user: %u"

Defaults!/usr/bin/grep  !mail_always

A user in the "LOGGERS" list would cause an email to be sent for all sudo commands except grep. But a simple sudo -l command would NOT send this email in prior versions.

Now an email with a body  looking like:

<hostname> : Jan 20 12:19:03 : slkh : TTY=pts/2 ; PWD=/home/slkh ; USER=root ; COMMAND=list

is received every time the user issues the sudo -l (sudo -list) command.

Since "list" is not a command with a path, there is no way I have found, similar to the way email was shut off for /usr/bin/grep in the above snippet, to turn off mail_always for the "list" command.

We have - unfortunately - vendor scripts, which issue a sudo -l command thousands of times a day, so turning off this behavior is essential. We cannot modify these scripts.

I tried using a command alias of LIST, which had the command "/opt/freeware/bin/sudo -l"  and "/opt/freeware/bin/sudo -list" and Defaults!LIST !mail_always, but as expected, this did not work, since the command logged is "list" not "sudo list".

Any advice is appreciated. I will in the meanwhile test other versions of sudo to determine when the change may have occurred, can't find in the changelog.

A method to turn off mail_always for list would be the preferred solution. Otherwise I think I may file a bug report for this behavior. Feature request?

Thank you.

More information about the sudo-users mailing list