Ubuntu 26.06 sudoers file error

[MartinPaulo]

With prey installed after an upgrade to Ubuntu 26.06, the following error is reported:

/etc/sudoers.d/51_prey_switcher:1:81: syntax error: wildcards are not allowed in command arguments
prey ALL=(ALL) NOPASSWD: /usr/sbin/iwlist, /usr/sbin/dmidecode, /usr/bin/nmcli, /usr/bin/su [A-Za-z]*, !/usr/bin/su root*, !/usr/bin/su -*
                                                                                ^~~~~~~~~~~~~~~~~~~~~

This is possibly because Ubuntu have switched to sudo-rs:

$ sudo -V | head -1
sudo-rs 0.2.13-0ubuntu1

And sudo-rs has a rule that wildcards are only supported in argument positions for a command as the final argument.

My work around was to change the line the file to read:

prey ALL=(ALL) NOPASSWD: /usr/sbin/iwlist, /usr/sbin/dmidecode, /usr/bin/nmcli

I'm reasonably certain this change stops prey running effectively…

[MartinPaulo]

Ok. After some spellunking, I've changed 51_prey_switcher to read:

Defaults:prey env_keep += "DISPLAY XAUTHORITY"
prey ALL = (!root) ALL
prey ALL = (root) NOPASSWD: ALL, !/bin/bash, !/bin/sh

My logic is:

• env_keep += "DISPLAY XAUTHORITY": Keeps the visual tunnel open so alerts, dialogues, and full-screen locks can map to the monitor;
• (root) NOPASSWD: ALL: Gives the Prey daemon the full root operational access it expects to capture hardware snapshots, fire alarms, and drop locks;
• !/bin/bash, !/bin/sh: Prevents an attacker from abusing the prey user to pop open a root terminal shell.
  If I have this wrong - please let me know!

[SoraKenji]

Hi, thank you so much for taking the time to report this and for digging into the root cause — that's incredibly helpful!

You're right: Ubuntu 26.06's switch to sudo-rs introduces stricter wildcard handling in sudoers rules, which breaks our current 51_prey_switcher configuration.

We'll investigate the proper fix on our end — the goal is to update the sudoers entry so it works correctly under sudo-rs without requiring manual workarounds. We'll aim to include this in the next release.

In the meantime, your workaround of removing the wildcard-based su rules is a reasonable mitigation. Regarding your alternative sudoers config — we appreciate the thought you put into it, but we'd caution against using (root) NOPASSWD: ALL in production, as it grants broader access than Prey actually needs and may introduce unintended exposure even with the shell denials. We'll make sure the official fix is properly scoped.

Thanks again for the detailed write-up and for sticking with Prey through the upgrade!