sudo returns exit code 0 if child is killed with SIGTERM

This may have security implications in edge cases. E.g. if an application is checking the status code of `sudo` and using `0` as "good to go", this may allow for access to a resource to be permitted when it should not be.

If the Security Team does not want to handle this themselves I will happily provide the SRUs.

Artful will get the fix by merge in LP: #1697587.

Updating the bug; let's keep this assigned to Balint; I uploaded the sudo update to artful as well as the SRUs (and subscribed ~ubuntu-sru)

Hello Vinson, or anyone else affected,

Accepted sudo into zesty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sudo/1.8.19p1-1ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-zesty to verification-done-zesty. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-zesty. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Holding this update in yakkety because the security update it is based on seems to have dropped a change from tjaalton for bug: #1686803.

Hello Vinson, or anyone else affected,

Accepted sudo into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sudo/1.8.16-0ubuntu3.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-yakkety to verification-done-yakkety. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-yakkety. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Vinson, or anyone else affected,

Accepted sudo into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sudo/1.8.16-0ubuntu1.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

It works well on Xenial with sudo 1.8.16-0ubuntu1.5, thanks.

Thank you for the verification, Simon!

15:13 <infinity> rbasak: My general rule of thumb is that cosmetic/"polish" changes only need to go to devel and the stable series' you care to fix, but real behavioural bug fixes can't skip supported releases.

15:13 <infinity> Because someone upgrading from xenial to yakkety shouldn't be subject to a functional regression.

I think this applies to this case. I'll wait for Yakkety and Zesty to be verified before releasing Xenial.

The verification is simple and I did verify the patches but I don't count since I prepared the fix. :-)
I've removed myself as assignee to encourage others to to perform the verification.

Verified sudo_1.8.19p1-1ubuntu1.2_amd64.deb fixes the bug on zesty.

Verified sudo_1.8.16-0ubuntu3.3_amd64.deb fixes the bug on yakkety.

This bug was fixed in the package sudo - 1.8.19p1-1ubuntu1.2

---------------
sudo (1.8.19p1-1ubuntu1.2) zesty; urgency=medium

  * Terminate with the same signal as the command (LP: #1686803)
    This fixes a regression introduced in sudo 1.8.15 changeset
    10229:153f016db8f1.

 -- Balint Reczey <email address hidden> Tue, 13 Jun 2017 10:00:00 +0200

The verification of the Stable Release Update for sudo has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package sudo - 1.8.16-0ubuntu1.5

---------------
sudo (1.8.16-0ubuntu1.5) xenial; urgency=medium

  * Terminate with the same signal as the command (LP: #1686803)
    This fixes a regression introduced in sudo 1.8.15 changeset
    10229:153f016db8f1.

 -- Balint Reczey <email address hidden> Tue, 13 Jun 2017 11:10:50 +0200

Hey, I'm not sure this was ever fixed in Xenial. Seems to still be bad.

`pwoodman@iad4c-ra16-40b:~$ sudo sleep 300; echo $?
0
pwoodman@iad4c-ra16-40b:~$ sleep 300; echo $?
Terminated
143
pwoodman@iad4c-ra16-40b:~$ apt-cache policy sudo
sudo:
  Installed: 1.8.16-0ubuntu1.6
  Candidate: 1.8.16-0ubuntu1.6
  Version table:
 *** 1.8.16-0ubuntu1.6 500
        500 http://apt-u16-iad.vip.dbxnw.net/annex-apt-xenial/apt/xenial xenial-security/main amd64 Packages
        500 http://apt-u16-iad.vip.dbxnw.net/annex-apt-xenial/apt/xenial xenial-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     1.8.16-0ubuntu1.3dbx11 500
        500 http://apt-u16-iad.vip.dbxnw.net/annex-apt-dbx-xenial/apt/dbx-xenial dbx-xenial/main amd64 Packages
     1.8.16-0ubuntu1 500
        500 http://apt-u16-iad.vip.dbxnw.net/annex-apt-xenial/apt/xenial xenial/main amd64 Packages
pwoodman@iad4c-ra16-40b:~$ sudo apt install sudo=1.8.16-0ubuntu1.3dbx11
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libwireshark6 libwiretap5 libwsutil6 linux-headers-4.4.0-133 linux-headers-4.4.0-133-generic
Use 'sudo apt autoremove' to remove them.
The following packages will be DOWNGRADED:
  sudo
0 upgraded, 0 newly installed, 1 downgraded, 0 to remove and 193 not upgraded.
Need to get 1,003 kB of archives.
After this operation, 1,268 kB of additional disk space will be used.
Get:1 http://apt-u16-iad.vip.dbxnw.net/annex-apt-dbx-xenial/apt/dbx-xenial dbx-xenial/main amd64 sudo amd64 1.8.16-0ubuntu1.3dbx11 [1,003 kB]
Fetched 1,003 kB in 0s (14.7 MB/s)
dpkg: warning: downgrading sudo from 1.8.16-0ubuntu1.6 to 1.8.16-0ubuntu1.3dbx11
(Reading database ... 327971 files and directories currently installed.)
Preparing to unpack .../sudo_1.8.16-0ubuntu1.3dbx11_amd64.deb ...
Unpacking sudo (1.8.16-0ubuntu1.3dbx11) over (1.8.16-0ubuntu1.6) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up sudo (1.8.16-0ubuntu1.3dbx11) ...
pwoodman@iad4c-ra16-40b:~$ sleep 300; echo $?
Terminated
143
pwoodman@iad4c-ra16-40b:~$ sudo sleep 300; echo $?
Terminated
143```

that other package is our own local fix.

scratch that, this was a regression in -ubuntu16, will open another ticket

@peter-shortbus OK, please follow the procedure in the SRU regression policy: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures#Regressions