Sudo on ubuntu-22.04 does not allow running binaries from build dir with "sudo -u"

[daztucker]

Description

sudo on ubuntu-22.04 prompts for a password for "sudo -u nobody" for a binary in the build directory. On previous iterations of ubuntu images as well as Mac OS work fine. Running a system binary such as /usr/bin/id works fine.

Sample repo and test run demonstrating issue: https://github.com/daztucker/runner-test/runs/7891375280?check_suite_focus=true

Platforms affected

• Azure DevOps
• GitHub Actions

Virtual environments affected

• Ubuntu 18.04
• Ubuntu 20.04
• Ubuntu 22.04
• macOS 10.15
• macOS 11
• macOS 12
• Windows Server 2019
• Windows Server 2022

Image version and build link

Environment: ubuntu-22.04
Version: 20220815.3
Demo test run: https://github.com/daztucker/runner-test/runs/7891297501?check_suite_focus=true

Is it regression?

Environment: ubuntu-20.04, Version: 20220814.1 works ok.

Expected behavior

sudo should run the specified binary in the build dir as the specified user w/out prompting for a password

Actual behavior

sudo prompts for a password. Because there's no user to provide one, the command fails.

Repro steps

run "sudo -u nobody" on a binary in the build directory. See https://github.com/daztucker/runner-test/blob/main/.github/workflows/c-cpp.yml fro example.

[al-cheb]

Hello @daztucker.
I can't reproduce the issue using command sudo -u nobody id:

[daztucker]

Copy it onto /home and try again.

…

On Thu, 18 Aug 2022, 16:54 Aleksandr Chebotov, ***@***.***> wrote: Hello @daztucker <https://github.com/daztucker>. I can't reproduce the issue using command sudo -u nobody id: [image: image] <https://user-images.githubusercontent.com/47745270/185320743-e16fc934-4056-42e6-9105-7ccbf045b17f.png> — Reply to this email directly, view it on GitHub <#6106 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABEPJWVH25PDTHLVEGOWAMTVZXM2TANCNFSM563UG5CA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[al-cheb]

@daztucker, it's a new security feature in Ubuntu 22.04 (Private home directories) - https://ubuntu.com/blog/whats-new-in-security-for-ubuntu-22-04-lts

- run: |
          sudo chmod o+rx ~
          cp $(which id) ~/id
          sudo -u nobody ~/id

[daztucker]

Thanks, with that information I was able to add your workaround.