{"action":"created","issue":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/4015","repository_url":"https://api.github.com/repos/QubesOS/qubes-issues","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/4015/labels{/name}","comments_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/4015/comments","events_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/4015/events","html_url":"https://github.com/QubesOS/qubes-issues/issues/4015","id":333445497,"node_id":"MDU6SXNzdWUzMzM0NDU0OTc=","number":4015,"title":"sudo allows root access after uninstalling auth package","user":{"login":"tasket","id":14337937,"node_id":"MDQ6VXNlcjE0MzM3OTM3","avatar_url":"https://avatars3.githubusercontent.com/u/14337937?v=4","gravatar_id":"","url":"https://api.github.com/users/tasket","html_url":"https://github.com/tasket","followers_url":"https://api.github.com/users/tasket/followers","following_url":"https://api.github.com/users/tasket/following{/other_user}","gists_url":"https://api.github.com/users/tasket/gists{/gist_id}","starred_url":"https://api.github.com/users/tasket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tasket/subscriptions","organizations_url":"https://api.github.com/users/tasket/orgs","repos_url":"https://api.github.com/users/tasket/repos","events_url":"https://api.github.com/users/tasket/events{/privacy}","received_events_url":"https://api.github.com/users/tasket/received_events","type":"User","site_admin":false},"labels":[{"id":401292621,"node_id":"MDU6TGFiZWw0MDEyOTI2MjE=","url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/C:%20Debian","name":"C: Debian","color":"cccccc","default":false},{"id":183969431,"node_id":"MDU6TGFiZWwxODM5Njk0MzE=","url":"https://api.github.com/repos/QubesOS/qubes-issues/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/milestones/25","html_url":"https://github.com/QubesOS/qubes-issues/milestone/25","labels_url":"https://api.github.com/repos/QubesOS/qubes-issues/milestones/25/labels","id":3158501,"node_id":"MDk6TWlsZXN0b25lMzE1ODUwMQ==","number":25,"title":"Release 4.0 updates","description":"","creator":{"login":"marmarek","id":726704,"node_id":"MDQ6VXNlcjcyNjcwNA==","avatar_url":"https://avatars1.githubusercontent.com/u/726704?v=4","gravatar_id":"","url":"https://api.github.com/users/marmarek","html_url":"https://github.com/marmarek","followers_url":"https://api.github.com/users/marmarek/followers","following_url":"https://api.github.com/users/marmarek/following{/other_user}","gists_url":"https://api.github.com/users/marmarek/gists{/gist_id}","starred_url":"https://api.github.com/users/marmarek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marmarek/subscriptions","organizations_url":"https://api.github.com/users/marmarek/orgs","repos_url":"https://api.github.com/users/marmarek/repos","events_url":"https://api.github.com/users/marmarek/events{/privacy}","received_events_url":"https://api.github.com/users/marmarek/received_events","type":"User","site_admin":false},"open_issues":272,"closed_issues":145,"state":"open","created_at":"2018-03-03T19:22:44Z","updated_at":"2018-08-31T05:18:48Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2018-06-18T21:42:15Z","updated_at":"2018-08-31T09:44:19Z","closed_at":null,"author_association":"NONE","body":"### Qubes OS version:\r\n<!-- (e.g., `R3.2`)\r\n     You can get it from the dom0 terminal with the command\r\n         `cat /etc/qubes-release`\r\n     Type below this line. -->\r\nR4.0\r\n\r\n\r\n\r\n\r\n<!-- Type above this line. -->\r\n### Affected component(s): \r\n<!-- Type below this line. -->\r\nDebian 9 template\r\n\r\n\r\n\r\n\r\n<!-- Type above this line. -->\r\n---\r\n<!--------------------------->\r\n### Steps to reproduce the behavior:\r\n<!-- Use single backticks (`) for in-line code snippets and\r\n     triple backticks (```) for code blocks.\r\n     Type below this line. -->\r\n```\r\nsudo apt-get remove qubes-core-agent-passwordless-root\r\n```\r\nreboot...\r\n```\r\nsudo touch /TEST\r\n```\r\n\r\n<!-- Type above this line. -->\r\n### Expected behavior:\r\n<!-- Type below this line. -->\r\nError stating command is not authorized.\r\n\r\n\r\n\r\n\r\n<!-- Type above this line. -->\r\n### Actual behavior:\r\n<!-- Type below this line. -->\r\nCommand runs with root privs.\r\n\r\n\r\n\r\n\r\n<!-- Type above this line. -->\r\n### General notes:\r\n<!-- Type below this line. -->\r\n\r\n\r\n\r\n\r\n\r\n<!-- Type above this line. -->\r\n---\r\n<!--------------------------->\r\n### Related issues:\r\n<!-- Type below this line. -->\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/comments/417612405","html_url":"https://github.com/QubesOS/qubes-issues/issues/4015#issuecomment-417612405","issue_url":"https://api.github.com/repos/QubesOS/qubes-issues/issues/4015","id":417612405,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzYxMjQwNQ==","user":{"login":"unman","id":13558340,"node_id":"MDQ6VXNlcjEzNTU4MzQw","avatar_url":"https://avatars3.githubusercontent.com/u/13558340?v=4","gravatar_id":"","url":"https://api.github.com/users/unman","html_url":"https://github.com/unman","followers_url":"https://api.github.com/users/unman/followers","following_url":"https://api.github.com/users/unman/following{/other_user}","gists_url":"https://api.github.com/users/unman/gists{/gist_id}","starred_url":"https://api.github.com/users/unman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/unman/subscriptions","organizations_url":"https://api.github.com/users/unman/orgs","repos_url":"https://api.github.com/users/unman/repos","events_url":"https://api.github.com/users/unman/events{/privacy}","received_events_url":"https://api.github.com/users/unman/received_events","type":"User","site_admin":false},"created_at":"2018-08-31T09:44:19Z","updated_at":"2018-08-31T09:44:19Z","author_association":"MEMBER","body":"> This looks to specific to Debian only, as on other templates only sudo configuration file is added (which is removed when you remove the package, so the change is reverted). Maybe the whole \"add to sudo group\" thing could be reverted on Debian?\r\n\r\nThere's a PR to do exactly this. QubesOS/qubes-core-agent-linux/pull/134\r\nAnother issue is that most of the work in `qubes-core-agent-passwordless-root` is done by config files, and \"remove\" wont clear them. You really need to do a purge. (We could remove those files as part of post-rm - I'm thinking about this)\r\n\r\nForgot about #2572 - I'll look at that again"}}
{"actor":{"display_login":"unman"}}