Your message dated Thu, 17 Sep 2026 17:44:08 +0200
with message-id <[email protected]>
and subject line Re: debci: improve security of sudoers file
has caused the Debian Bug report #1011509,
regarding debci: improve security of sudoers file
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1011509: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011509
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: debci
Version: 3.5.1
Severity: normal
The sudoers file included in this package (/etc/sudoers.d/debci)
allows the debci group to run /usr/bin/timeout without any password or
restrictions; this effectively gives anyone in the debci group
unrestricted access to root.
I would recommend replacing:
%debci ALL = NOPASSWD:SETENV: /usr/bin/lxc-*, /usr/bin/timeout
by the following:
%debci ALL = NOPASSWD:SETENV: /usr/bin/lxc-*, /usr/bin/timeout ^[0-9]+ lxc-.*$
so that timeout can only be used to run lxc-* commands; this is all
that is needed in autopkgtest-virt-lxc.
Best wishes,
Julian
--- End Message ---
--- Begin Message ---
Version: 5.30
--- End Message ---
