[Q] Is sudoers option "runcwd" implemented?

[sokai]

Hey!

I can't get sudo -u caddy -s -D /var/lib/caddy working (w/ sudo-rs v0.2.11 and a wheel user).
I only get the error/hint sudo: you are not allowed to use '--chdir /var/lib/caddy' with […].

Trying to us Defaults:root,%wheel runcwd=* (like explained by the sudoers man page) in /etc/sudoers (I'm not using as separate /etc/sudoers-rs) to fix the issue, I end up getting unknown setting: 'runcwd' …

I don't know where the real cause is, but I venture the guess that sudo-rs hasn't implemented the sudoers option runcwd, ATM. So IMHO using -D or --chdir seems not possible, right?
(If I'm wrong here, how can I use -D?)

Thanks in advance (for answering my maybe dumb question) and KR

[bjorn3]

runcwd is a Defaults option. For individual rules you have to use the CWD tag instead.

[squell]

Several tags have a Defaults equivalent; e.g. Defaults setenv and SETENV: (which sudo-rs supports), Defaults noexec and NOEXEC: (same), and Defaults authenticate and NOPASSWD: (and in this case, sudo-rs does not support the authenticate setting since using Defaults !authenticate has a bit of a footgun feel to it).

The fact that CWD=dir has a Defaults runcwd equivalent actually escaped our attention, so you've stumbled upon an unimplemented feature.

You can probably craft your configuration so that instead of Defaults:root,%wheel runcwd=*, you can apply the CWD=* tag to the actual command specification, e.g. add a line like:

root,%wheel ALL=(ALL:ALL) CWD=* ALL

Personally, I think tags are a more precise way to configure sudo, but in this case I can see the case for adding support for runcwd since it's not very complex to add, so let's treat this like a feature request. :-)