[PATCH] Update sed usage by 'pam-wheel' for sudoers

[PATCH] Update sed usage by 'pam-wheel' for sudoers

[Nate Kent]

Fixes Yocto Bug #16321

In version 1.9.17p2, the line that the recipe uses to add the 'wheel'
group to the sudoers file does not exist. This updates the sed usage to
the actual line in question.

Upstream-Status: Innappropriate [oe specific]
Signed-off-by: Nate Kent <nathan@otiv.ai>
---
 meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
index 7dfa0cef6c..489c0db09d 100644
--- a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
+++ b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
@@ -37,7 +37,7 @@ do_install:append () {
 		install -D -m 644 ${UNPACKDIR}/sudo.pam ${D}/${sysconfdir}/pam.d/sudo
 		if ${@bb.utils.contains('PACKAGECONFIG', 'pam-wheel', 'true', 'false', d)} ; then
 			echo 'auth       required     pam_wheel.so use_uid' >>${D}${sysconfdir}/pam.d/sudo
-			sed -i 's/# \(%wheel ALL=(ALL) ALL\)/\1/' ${D}${sysconfdir}/sudoers
+			sed -i 's/# \(%wheel ALL=(ALL:ALL) ALL\)/\1/' ${D}${sysconfdir}/sudoers
 		fi
 	fi
 

[PATCH] Update sed usage by 'pam-wheel' for sudoers

[Nate Kent]

Fixes Yocto Bug #16321

In version 1.9.17p2, the line that the recipe uses to add the 'wheel'
group to the sudoers file does not exist. This updates the sed usage to
the actual line in question.

Upstream-Status: Innappropriate [oe specific]
Signed-off-by: Nate Kent <nathan@otiv.ai>
---
 meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
index 7dfa0cef6c..489c0db09d 100644
--- a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
+++ b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
@@ -37,7 +37,7 @@ do_install:append () {
 		install -D -m 644 ${UNPACKDIR}/sudo.pam ${D}/${sysconfdir}/pam.d/sudo
 		if ${@bb.utils.contains('PACKAGECONFIG', 'pam-wheel', 'true', 'false', d)} ; then
 			echo 'auth       required     pam_wheel.so use_uid' >>${D}${sysconfdir}/pam.d/sudo
-			sed -i 's/# \(%wheel ALL=(ALL) ALL\)/\1/' ${D}${sysconfdir}/sudoers
+			sed -i 's/# \(%wheel ALL=(ALL:ALL) ALL\)/\1/' ${D}${sysconfdir}/sudoers
 		fi
 	fi
 

Patchtest results for [PATCH] Update sed usage by 'pam-wheel' for sudoers

[patchtest]

[-- Attachment #1: Type: text/plain, Size: 2219 bytes --]

Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:

---
Testing patch /home/patchtest/share/mboxes/Update-sed-usage-by-pam-wheel-for-sudoers.patch

FAIL: test shortlog format: Commit shortlog (first line of commit message) should follow the format "<target>: <summary>" (test_mbox.TestMbox.test_shortlog_format)

PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)

SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: test CVE tag format: No new CVE patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new CVE patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new CVE patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)

---

Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!

Re: [PATCH] Update sed usage by 'pam-wheel' for sudoers

[Siva Balasubramanian]

The code change here is identical to one I independently posted:
https://patchwork.yoctoproject.org/project/oe-core/patch/20260618110111.3484982-1-sivakumar.bs@gmail.com/

I built sudo with DISTRO_FEATURES += "pam" and PACKAGECONFIG:pn-sudo +=
"pam-wheel" and confirmed /etc/sudoers ends up with

    %wheel ALL=(ALL:ALL) ALL

uncommented, while the separate "# %wheel ALL=(ALL:ALL) NOPASSWD: ALL"
line is correctly left commented.

Tested-by: Siva Balasubramanian <sivakumar.bs@gmail.com>

One note: patchtest flagged the shortlog (it should be prefixed
"sudo: ..."), and the bug reference is best written as "[YOCTO #16321]"
so it auto-links. A v2 would be needed for those. Happy for either
patch to land.

Re: [PATCH] Update sed usage by 'pam-wheel' for sudoers

[Nate Kent]

On Thu, Jun 18, 2026 at 04:44:58PM +0530, Siva Balasubramanian wrote:
> The code change here is identical to one I independently posted:
> https://patchwork.yoctoproject.org/project/oe-core/patch/20260618110111.3484982-1-sivakumar.bs@gmail.com/
> 
> One note: patchtest flagged the shortlog (it should be prefixed
> "sudo: ..."), and the bug reference is best written as "[YOCTO #16321]"
> so it auto-links. A v2 would be needed for those. Happy for either
> patch to land.

I am also happy for either patch to land - I just want it working. That being
said, if it's all the same to you I'd like to use this as a learning
opportunity so I am better prepared for the next patch I submit.

Assuming you're fine with me fixing this: is the proper course of action to
fix the patch and then repeat the `git send-email` I originally did or should
it be a reply to this thread with the fixed patch?

- Nate

Re: [PATCH] Update sed usage by 'pam-wheel' for sudoers

[Siva Kumar Balasubramanian]

[-- Attachment #1: Type: text/plain, Size: 2319 bytes --]

Absolutely, please go ahead - it's your bug and your patch, glad to
leave it with you.

For the resend, the convention is a "v2" of the same patch, not a
brand-new submission:

1. Amend the commit to address the feedback:

   - Shortlog needs a "<target>: " prefix, e.g.
       sudo: fix pam-wheel sed for 1.9.17p2 sudoers format
     That clears the patchtest shortlog failure (and it's well under
     the length limit).

   - Use the bug tag in the form "[YOCTO #16321]" on its own line
     instead of "Fixes Yocto Bug #16321". That is the form that
     auto-links the bug and that patchtest's bugzilla-entry test looks
     for - your v1 was reported as "No bug ID found" because of the
     free-text wording.

   - Drop the "Upstream-Status:" line. That header belongs in actual
     patch files (recipes-*/.../files/*.patch that modify upstream
     source), not in the commit message of a recipe (.bb) change, so it
     does not apply here.

   So the message body would look roughly like:

       sudo: fix pam-wheel sed for 1.9.17p2 sudoers format

       <your explanation of the root cause>

       [YOCTO #16321]

       Signed-off-by: Nate Kent <nathan@otiv.ai>
       Tested-by: Siva Balasubramanian <sivakumar.bs@gmail.com>

   Feel free to carry over the Tested-by above into v2 - the code is
   byte-identical, only the commit message changes.

2. Regenerate with the version bump:

       git format-patch -v2 -1

   That labels it [PATCH v2]. format-patch won't add the changelog for
   you; edit the generated .patch and insert a short "what changed"
   note right after the "---" tear line (above the diffstat), so it
   stays out of the committed message, e.g.:

       ---
       v2: add "sudo:" shortlog prefix, switch to [YOCTO #16321] tag,
           drop Upstream-Status (n/a for a recipe change)
        meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 +-

   (You can also use "git send-email --annotate" and add those lines
   there before sending.)

3. Send it with the same git send-email to
   openembedded-core@lists.openembedded.org. Either a fresh send or a
   reply works; sending top-level with
   --in-reply-to=<20260618102839.363123-1-nathan@otiv.ai> (your v1)
   keeps the thread linked. v1 can then be marked Superseded on
   patchwork.

Happy to look over v2 when it's up.

[-- Attachment #2: Type: text/html, Size: 3129 bytes --]

[PATCH v2] sudo: fix pam-wheel sed for sudo 1.9.17p2 sudoers

[Nate Kent]

[YOCTO #16321]

In version 1.9.17p2, the line that the recipe uses to add the 'wheel'
group to the sudoers file does not exist. This updates the sed usage to
the actual line in question.

Signed-off-by: Nate Kent <nathan@otiv.ai>
Tested-by: Siva Balasubramanian <sivakumar.bs@gmail.com>
---
v2: add "sudo" shortlog prefix, fix Bugzilla tag, removed Upstream-Status
 meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
index 7dfa0cef6c..489c0db09d 100644
--- a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
+++ b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
@@ -37,7 +37,7 @@ do_install:append () {
 		install -D -m 644 ${UNPACKDIR}/sudo.pam ${D}/${sysconfdir}/pam.d/sudo
 		if ${@bb.utils.contains('PACKAGECONFIG', 'pam-wheel', 'true', 'false', d)} ; then
 			echo 'auth       required     pam_wheel.so use_uid' >>${D}${sysconfdir}/pam.d/sudo
-			sed -i 's/# \(%wheel ALL=(ALL) ALL\)/\1/' ${D}${sysconfdir}/sudoers
+			sed -i 's/# \(%wheel ALL=(ALL:ALL) ALL\)/\1/' ${D}${sysconfdir}/sudoers
 		fi
 	fi