Patch /etc/sudoers on Archlinux

fixes: QubesOS/qubes-issues#9395
QubesOS · Aug 17, 2024 · a9d5886 · a9d5886
1 parent 5b860df
commit a9d5886
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/archlinux/PKGBUILD.in b/archlinux/PKGBUILD.in
@@ -119,6 +119,10 @@ package_qubes-vm-core() {
     install -m 0755 "package-managers/upgrades-installed-check" "${pkgdir}/usr/lib/qubes/"
     install -m 0755 "package-managers/upgrades-status-notify" "${pkgdir}/usr/lib/qubes/"
 
+    # Patch for /etc/sudoers default secure_path
+    install -d -m 0750 "${pkgdir}/etc/sudoers.d"
+    install -m 0440 "archlinux/PKGBUILD.qubes-secure-path.sudo" "${pkgdir}/etc/sudoers.d/qubes_secure_path"
+
     # Archlinux specific: enable autologin on tty1
     mkdir -p "$pkgdir/etc/systemd/system/[email protected]/"
     cat <<EOF > "$pkgdir/etc/systemd/system/[email protected]/autologin.conf"

diff --git a/archlinux/PKGBUILD.qubes-secure-path.sudo b/archlinux/PKGBUILD.qubes-secure-path.sudo
@@ -0,0 +1,3 @@
+Defaults secure_path="/run/qubes/bin:/usr/local/sbin:/usr/local/bin:/usr/bin"
+
+# vim: ft=sudoers
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Defaults secure_path="/run/qubes/bin:/usr/local/sbin:/usr/local/bin:/usr/bin"

		# vim: ft=sudoers