TL;DR
Get backup power and energy gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A November 2 report says Ubuntu 26.04’s Rust-based sudo, sudo-rs, does not interpret a command-argument wildcard in an existing sudoers rule the same way as standard sudo. The author switched affected machines back to the standard implementation and says sudo-rs documentation describes the difference; the report does not establish how widely the issue affects Ubuntu users.
A system administrator says they have disabled Ubuntu 26.04’s Rust-based sudo-rs on their machines after finding it did not interpret an existing sudoers command-argument pattern as standard sudo does. The reported difference prevented a rule from granting the intended no-password access to specific Exim commands, highlighting a compatibility issue for administrators who carry existing sudo policies into Ubuntu 26.04.
In a post dated November 2, 2026, the administrator described a rule in an /etc/sudoers.d file that allows members of the corestaff group to run certain commands without a password. For Exim, the rule includes the argument pattern -bp[acru]. According to the author, standard sudo interprets that pattern to permit four specific arguments: -bpa, -bpc, -bpr and -bpu.
The author says sudo-rs instead treated the bracketed pattern as a literal argument. Running the command with -bp[acru] produced an Exim error reporting an “unknown, malformed, or incomplete option,” rather than matching one of the four intended options. The post also says the administrator’s initial observation was that sudo-rs ignored the relevant sudoers instructions, with no logging about the failure; the command example identifies the specific argument-matching difference they investigated.
The administrator says they switched the machines back to standard sudo using update-alternatives --set sudo /usr/bin/sudo.ws. They also report that their installer framework now disables Rust sudo along with Rust coreutils. These are the author’s actions on their own systems, not a report of a change made by Ubuntu or Canonical.
Existing Sudo Rules May Behave Differently
The report matters because sudoers rules govern privileged access, including which commands users can run and whether they need to enter a password. An administrator expecting standard sudo’s matching behavior could find that a rule permits a different command pattern—or fails to authorize the intended one—when used with sudo-rs. The specific example is a failure to match four intended Exim options, not evidence that the rule allowed broader access in this case.
For organizations upgrading systems or moving existing policy files to Ubuntu 26.04, the episode is a reason to test command-argument rules against the sudo implementation actually installed. The report does not show that all sudo-rs installations or all sudoers configurations are affected. It does show that differences in policy syntax can have practical consequences, and that administrators should not assume identical behavior solely because both programs provide sudo functionality.
Products Worth Considering
eufy Security Essential 7-Piece Alarm System with HomeBase Mini
Ring Alarm 14-Piece Wireless Security System
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Black
As an affiliate, we earn on qualifying purchases.
The Documented Wildcard Difference
The author’s account points to the sudo-rs sudoers manual as describing this behavior. As quoted in the report, it says that wildcards in command-line arguments are unsupported because their use in original sudo was “usually a sign of mis-configuration,” and that sudo-rs permits a final * to represent zero or more subsequent arguments. The post argues that this documented restriction makes sudo-rs incompatible with standard sudo for the pattern at issue.
The report also criticizes the manual’s presentation, saying the restriction appears after a broader discussion of wildcards rather than in a prominent opening comparison with standard sudo. That criticism is the administrator’s assessment. The reported technical difference, by contrast, is tied to the behavior described in the manual and the Exim command test they provided. The author says they did not file a bug, and the post does not describe a response from Canonical or the sudo-rs maintainers.
The administrator says removing the sudo-rs package through the package manager would also remove ubuntu-minimal. They did not want to test the longer-term consequences of removing that package, so they chose to change the active sudo alternative instead. The post links the issue to the wider question of Canonical’s use of Rust replacements for established system utilities, but that broader criticism is the author’s view rather than a finding about this particular compatibility difference.
“Wildcards in command line arguments are not supported—using these in original versions of sudo was usually a sign of mis-configuration and consequently sudo-rs simply forbids using them.”
— sudo-rs sudoers manual, as quoted in the report
Scope and Maintainer Response
The report is an account of one administrator’s configuration and test. It does not establish how many Ubuntu 26.04 systems use comparable rules, whether other command patterns behave differently, or whether the effect varies by sudo-rs version or configuration. The post includes no independent test results and does not say that the author filed a bug.
It is also unclear whether Canonical or the sudo-rs project has issued guidance or plans to change the implementation or documentation. The quoted manual text presents the argument-wildcard restriction as a deliberate design choice, but the report does not establish whether the project considers the behavior a defect or an acceptable incompatibility. No broader security consequence is demonstrated by the example.
Test Rules Before Upgrading
The administrator says their affected machines have been switched to standard sudo through the alternatives system, while their installer framework now disables sudo-rs. Other administrators using Ubuntu 26.04 can compare their existing command-argument rules with the sudo-rs documentation and test the exact permitted commands before relying on those rules in production. Changes to privileged-access policy should be validated carefully, with the intended commands and password requirements checked directly.
No further action from Ubuntu or the sudo-rs maintainers is confirmed in the source report. A project response, clarification of compatibility expectations, or revised documentation would help establish whether the behavior is expected and how administrators should manage existing policies. The report’s author says they may consider moving from Ubuntu to Debian later, potentially when replacing Ubuntu 24.04 LTS systems in 2028; that is a stated possibility, not an announced migration plan.
Key Questions
What compatibility issue did the administrator report?
The report says sudo-rs treated the sudoers argument pattern -bp[acru] literally instead of matching the four intended Exim options that standard sudo permits.
Did the rule allow broader access under sudo-rs?
The example does not show broader access. It shows the literal argument reaching Exim and triggering an error, rather than allowing one of the intended options.
What did the administrator do about it?
The author says they selected standard sudo with update-alternatives --set sudo /usr/bin/sudo.ws and disabled sudo-rs on their Ubuntu 26.04 machines.
Is this confirmed to affect all Ubuntu 26.04 users?
No. The source is one administrator’s report and does not establish how widespread the issue is or whether other sudoers patterns are affected.
Has Canonical responded or announced a fix?
The report does not include a Canonical response or a fix announcement. The author says they did not file a bug, and no project response is provided.
Source: utcc.utoronto.ca
