RPM package built with ./mkpkg --platform=rpm on Amazon Linux 2 fails to function after installation

[pzsewer]

I need update sudo-1.9.17p1 to fix security problems like CVE-2025-32462 and CVE-2025-32463.
but aws dont have this rpm package now.

Description:
When building an RPM package using the ./mkpkg --platform=rpm script on Amazon Linux 2, the resulting .rpm file installs successfully but the installed software does not function as expected.

Steps to Reproduce:
Clone the repository on an Amazon Linux 2 instance.
Run ./mkpkg --platform=rpm to build the RPM package.
Install the generated .rpm file using sudo rpm -ivh .rpm.
Attempt to run the installed software.

Expected Behavior:
The software should install and run correctly without errors.

Actual Behavior:
The installation completes without errors, but the software fails to start or function properly. (Please specify the exact error or behavior observed.)

Environment:
OS: Amazon Linux 2
Architecture: (e.g., x86_64)
Build tool: ./mkpkg
Package type: RPM

Additional Context:
Please attach or paste any relevant logs or error messages.
If possible, include the output of rpm -qlp .rpm to verify the installed files.
Mention any dependencies or system configurations that might be relevant.

[pzsewer]

sudo rpm -ivh sudo-1.9.17-2.x86_64.rpm
Preparing...                          ################################# [100%]
        file /etc/sudo.conf from install of sudo-1.9.17-2.x86_64 conflicts with file from package sudo-1.8.23-10.amzn2.3.7.x86_64
        file /etc/sudoers from install of sudo-1.9.17-2.x86_64 conflicts with file from package sudo-1.8.23-10.amzn2.3.7.x86_64
        file /var/db/sudo from install of sudo-1.9.17-2.x86_64 conflicts with file from package sudo-1.8.23-10.amzn2.3.7.x86_64

[millert]

It looks like you already have sudo installed so you need to do an update with rpm -U rather than an install. However, I would be sure to have a root shell open when you do this so you can recover in case the sudo package doesn't work properly.

[pzsewer]

It looks like you already have sudo installed so you need to do an update with rpm -U rather than an install. However, I would be sure to have a root shell open when you do this so you can recover in case the sudo package doesn't work properly.

yes , I have try it before this issue post.

[root@ip ~]# rpm -Uvh sudo-1.9.17-2.x86_64.rpm
Preparing...                          ################################# [100%]
Updating / installing...
   1:sudo-1.9.17-2                    ################################# [ 50%]
Cleaning up / removing...
   2:sudo-1.8.23-10.amzn2.3.7         ################################# [100%]
[root@ip ~]# sudo
usage: sudo -h | -K | -k | -V
usage: sudo -v [-ABkNnS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-ABkNnS] [-g group] [-h host] [-p prompt] [-U user]
            [-u user] [command [arg ...]]
usage: sudo [-ABbEHkNnPS] [-C num] [-D directory]
            [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
            [-u user] [VAR=value] [-i | -s] [command [arg ...]]
usage: sudo -e [-ABkNnS] [-C num] [-D directory]
            [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
            [-u user] file ...
[root@ip ~]# sudo id
sudo: account validation failure, is your account locked?
sudo: a password is required
[root@ip ~]# 

[ec2-user@ip ~]$ sudo id
sudo: account validation failure, is your account locked?
sudo: a password is required

[pzsewer]

@millert
Hi Millert，
I'm currently working on upgrading sudo from version 1.8.23 to 1.9.17p1, and I noticed that there seem to be significant changes between these two versions. I would like to understand:

• Were there many files changed or refactored between sudo 1.8.23 and 1.9.17p1?
• Are there any specific areas or modules that underwent major refactoring or redesign?
  I ask because I'm encountering some unexpected behavior after upgrading, and I suspect it might be related to these changes. Any guidance or pointers to relevant documentation or changelogs would be greatly appreciated.
  Thank you for your time and assistance!

Additional Context:

I have reviewed the official sudo release notes and changelog, but I would appreciate more detailed insights from the maintainers or community members who are familiar with the codebase evolution.

[pzsewer]

-rw-r--r--  1 root root  3346764 Jul 10 11:42 sudo-1.9.17-2.x86_64.rpm
-rw-r--r--  1 root root   449832 Jul 10 11:42 sudo-logsrvd-1.9.17-2.x86_64.rpm

[root@ip  scripts]# su test
[test@ip  scripts]$ sudo
usage: sudo -h | -K | -k | -V
usage: sudo -v [-ABkNnS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-ABkNnS] [-g group] [-h host] [-p prompt] [-U user]
            [-u user] [command [arg ...]]
usage: sudo [-ABbEHkNnPS] [-C num] [-D directory]
            [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
            [-u user] [VAR=value] [-i | -s] [command [arg ...]]
usage: sudo -e [-ABkNnS] [-C num] [-D directory]
            [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
            [-u user] file ...
[test@ip scripts]$ sudo su
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts
[test@ip scripts]$ sudo id
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts
[test@ip scripts]$ exit
exit
[root@ip scripts]# sudo
usage: sudo -h | -K | -k | -V
usage: sudo -v [-ABkNnS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-ABkNnS] [-g group] [-h host] [-p prompt] [-U user]
            [-u user] [command [arg ...]]
usage: sudo [-ABbEHkNnPS] [-C num] [-D directory]
            [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
            [-u user] [VAR=value] [-i | -s] [command [arg ...]]
usage: sudo -e [-ABkNnS] [-C num] [-D directory]
            [-g group] [-h host] [-p prompt] [-R directory] [-T timeout]
            [-u user] file ...
[root@ip scripts]# rpm -qa | grep sudo
sudo-1.9.17-2.x86_64
[root@ip scripts]#


--ec2-user-----------------

[ec2-user@ip ~]$ sudo id
sudo: account validation failure, is your account locked?
sudo: a password is required
[ec2-user@ip ~]$ sudo -V
Sudo version 1.9.17p1
Sudoers policy plugin version 1.9.17p1
Sudoers file grammar version 50
Sudoers I/O plugin version 1.9.17p1
Sudoers audit plugin version 1.9.17p1
[ec2-user@ip ~]$ sudo su
sudo: account validation failure, is your account locked?
sudo: a password is required
[ec2-user@ip ~]$ sudo whoami
sudo: account validation failure, is your account locked?
sudo: a password is required

[millert]

Please understand that sudo 1.8.23 is 7 years old. There have been many changes since then, A diff of the two versions is over 570,000 lines. 1255 files changed, 350129 insertions(+), 112352 deletions(-).

That message indicates that the pam_acct_mgmt() function failed. As a workaround you could disable its use with a line like the following in /etc/sudoers:

Defaults !pam_acct_mgmt

The underlying problem is likely due to sudo's PAM configuration. There's no way for sudo to include a PAM configuration that works for all Linux distros. Your best bet is to try to use the sudo PAM configuration from Amazon's sudo package.

[millert]

It's worth noting that sudo 1.8.23 is not affected by https://github.com/advisories/GHSA-695j-c63m-mvx and GHSA-c5x2-97hm-x895 only applies if you have rules that reference a different host, which is unlikely in your case.