We recently upgraded our aws linux server instance type. It is still an SLES 12 SP1. However I am noticing some differences some of which are confounding$ sudo -u xyz cmd ...<it asks for password, causing old scripts to break>$ sudo -u xyz /path/to/cmd ...<works>$ sudo --versionSudo version 1.8.10p3Sudoers policy plugin version 1.8.10p3Sudoers file grammar version 43Sudoers I/O plugin version 1.8.10p3$ uname -aLinux ovcp6hana1 3.12.69-60.64.32-default #1 SMP Wed Feb 15 08:57:04 UTC 2017 (76392c8) x86_64 x86_64 x86_64 GNU/Linux(The sudoers config has a Cmnd_Alias and authorization for /path/to/cmd)The former version used to work but it does not, as if the path was being automatically expanded earlier but not any more.Is there some way to get the old form to work? Thanks.--EDITI verified that it is the exact same command, ie which xyz expands to /path/to/xyz.--EDIT 2I think I found the issue, but still don't have a way to stay compatible with my application. It appears the difference is between sudo versions 1.7.6 and 1.8.10. But I failed to find such a mention in the sudo release notesI created another user with similar privileges on an older server running sudo 1.7. The specific privilege is as below. The config files in the two match in options#added in /etc/sudoers#userA ALL=(userABC) NOPASSWD: /bin/bash, /usr/local/bin/aws#with both sudo versionsuserA$ sudo -u userABC bash -c echo \$PATH/usr/bin:/bin:/usr/sbin:/sbinuserA$ sudo -u userABC bash -c which aws/usr/bin/aws <<<< but this is not reached in either of the two casesuserA$ which aws/usr/local/bin/aws <<<<<< this is the right binary#with sudo version 1.7.6userA$ sudo -u userABC aws..the right binary runs, so path must have been set between check and run#with sudo version 1.8.10userA$ sudo -u userABC awsfailure! sudo asks for password of userABCThe program /usr/bin/aws does some kind of wrapping. Until now I was blissfully unaware (!) of its existence but even when I momentarily removed this program, there was no impact on anything.So I have a slightly better understanding of the problem but still don't know if there is an option other than changing the app.
why sudo -u xxx cmd fails but sudo -u xxx /path/to/cmd succeeds?
sudo