sudo user flag: `-U` uppercase flag reserved for usage with `-l` flag / fails where `-u` works.

[BriocheBerlin]

-U and -u flags are different. The manual states:

-U user, --other-user=user
Used in conjunction with the -l option to list the privileges for user instead of for the invoking user. The security policy may restrict listing other users' privileges. When using the sudoers policy, the -U option is restricted to the root user and users with either the “list” privilege for the specified user or the ability to run any command as root or user on the current host.

When the -U option is used instead of -u lowercase, it should fail.

relevant test:

sudo-rs/test-framework/sudo-compliance-tests/src/flag_user.rs

Lines 43 to 56 in 2f5d3b7

 fn uppercase_u_flag_fails() -> Result<()> { 
     let env = Env(SUDOERS_ROOT_ALL_NOPASSWD).user(USERNAME).build()?; 
  
     let output = Command::new("sudo") 
         .args(["-U", USERNAME, "id"]) 
         .output(&env)?; 
     assert!(!output.status().success()); 
     assert_eq!(Some(1), output.status().code()); 
  
     let stderr = output.stderr(); 
     assert_contains!(stderr, "sudo: the -U option may only be used with the -l option"); 
  
     Ok(()) 
 } 

sudo stderr
sudo: the -U option may only be used with the -l option

sudo-rs does not fail:
sudo-rs stdout
uid=0(root) gid=0(root) groups=0(root)

As of now, --list is not yet implemented. When it is, this is the test for -U -l flag passed together:

sudo-rs/test-framework/sudo-compliance-tests/src/flag_list.rs

Lines 52 to 72 in 2f5d3b7

 fn works_with_uppercase_u_flag() -> Result<()> { 
     let hostname = "container"; 
     let env = Env(SUDOERS_ALL_ALL_NOPASSWD) 
         .user(USERNAME) 
         .hostname(hostname) 
         .build()?; 
  
     let output = Command::new("sudo") 
         .args(["-U", USERNAME, "-l"]) 
         .output(&env)?; 
  
     assert!(output.status().success()); 
     assert!(output.stderr().is_empty()); 
  
     let expected = format!("User {USERNAME} may run the following commands on {hostname}:\n    (ALL : ALL) NOPASSWD: ALL"); 
     let actual = output.stdout()?; 
     assert_eq!(actual, expected); 
  
     Ok(()) 
 }