Description:

If a PAM configuration, in my case /etc/pam.d/system-auth, contains a pam_exec invocation then sudo fails to execute the given command after entering the password. It does, however, authorize the session so that repeating the sudo command executes the command without a further password prompt.

This occurs with package versions 1.8.21.p1-1 to 1.8.21.p1-3.

The following config is sufficient to reproduce:


#%PAM-1.0

auth required pam_unix.so try_first_pass nullok
# Addition of the following line.
auth [success=ignore default=1] pam_exec.so quiet /usr/bin/true
auth optional pam_permit.so
auth required pam_env.so

account required pam_unix.so
account optional pam_permit.so
account required pam_time.so

password required pam_unix.so try_first_pass nullok sha512 shadow
password optional pam_permit.so

session required pam_limits.so
session required pam_unix.so
session optional pam_permit.so