sudo: no sticky bit on high sierra

[danchr (Dan Villiom Podlaski Christiansen)]

I just upgraded my Mac to High Sierra, and during the rebuild afterwards sudo was built to a non-functioning state. Specifically, everthing built, but /opt/local/bin/sudo had no setuid bit, leaving functionality somewhat reduced.

I run MacPorts from the master branch, so that might also be the cause.

Anyway, the fix is rather trivial:

sysutils/sudo/Portfile

@@ -47 +47 @@
 }
 
 post-destroot {
+    file attributes ${destroot}${prefix}/bin/sudo -permissions +s
     file delete ${destroot}${prefix}/etc/sudoers
     xinstall -d -m 0755 ${destroot}${prefix}/var/run/sudo
 }

[Schamschula (Marius Schamschula)]

Yes. Under High Sierra Beta I was manually setting the setuid bit, but now that the release version is out, might as well add this to the Portfile.

[Schamschula (Marius Schamschula)]

In 1d45c0e3e3d1f6d692b66a853b545352eb962d24/macports-ports:

sudo 1.8.21p2: fix sticky bit on high sierra

Closes: #54958

[ryandesign (Ryan Carsten Schmidt)]

Any explanation for why this did not get set by the build system as on previous macOS versions? Is it a bug in sudo or MacPorts or High Sierra or APFS?

[danchr (Dan Villiom Podlaski Christiansen)]

Replying to ryandesign:

Any explanation for why this did not get set by the build system as on previous macOS versions? Is it a bug in sudo or MacPorts or High Sierra or APFS?

I believe the bug is somewhere in the MacPorts infrastructure; I ran a manual sudo make install DESTDIR=/tmp and that resulted in a binary the proper mode. Without having investigated further, I'd be inclined to blame trace mode; it just feels like something it could break… Alternatively, overly aggressive privilege escalation might be the cause.

[danchr (Dan Villiom Podlaski Christiansen)]

Replying to danchr:

Replying to ryandesign:

Any explanation for why this did not get set by the build system as on previous macOS versions? Is it a bug in sudo or MacPorts or High Sierra or APFS?

I believe the bug is somewhere in the MacPorts infrastructure…

Confirmed with a simple test case and reported as bug #54963.