Ubuntu 26.04's sudo-rs 0.2.13 Ignores sudo -E and Rejects Wildcards in Command Arguments, Two Bug Reports Show

Ubuntu 26.04 ships sudo-rs, a Rust rewrite of sudo, as the default sudo, and two open GitHub issues show where scripts written for the old one break. One is a CI failure filed on November 4. The other is a sudoers file that sudo-rs refuses to parse.

The CI break: sudo -E

The maintainers of the reliaburger project pinned their Linux runners to ubuntu-24.04 because ubuntu-latest became 26.04 on November 4. Issue 1559, opened by the user seeker89, records the second failure they hit on the new image: the default sudo ignores -E, the flag that preserves the caller's environment.

The message reads: "preserving the entire environment is not supported, '-E' is ignored". Each sudo -E env PATH=... step then ran as root without CARGO_HOME and RUSTUP_HOME, and the build died with "workflow contract evidence refused: actual Rust sysroot query failed". That is the awkward part: the flag is dropped with a warning, and the real failure surfaces a step later.

The proposed fix is to list variables explicitly with sudo env, or to use --preserve-env=LIST, which sudo-rs supports.

The sudoers break: wildcards in arguments

The second report, issue 1 in adult-content-blocker, was filed on October 21 against sudo-rs 0.2.13 on Ubuntu 26.04. The file /etc/sudoers.d/99-blocker contains this line 4 entry: /usr/bin/chattr [-+]i /etc/hosts.*, \.

sudo-rs answers: "/etc/sudoers.d/99-blocker:4:5: wildcards are not allowed in command arguments". Lines 5 through 38 each add a "garbage at end of line" error. According to the reporter, the commands still work, but the warnings print on every sudo call, including routine apt runs. The reporter says sudo-rs rejects both * and character classes such as [-+] in command aliases.

What the two reports have in common

Symptom	Version	Where it was reported	Workaround
-E ignored with a warning	Default sudo on 26.04	reliaburger issue 1559, Nov 4	--preserve-env=LIST
Wildcards rejected in arguments	sudo-rs 0.2.13	adult-content-blocker issue 1, Oct 21	Spell out every path

Both are one user's environment, not a survey. Neither issue is closed, and the sudo-rs project had not answered on either page when I read them.

What a Zenn hands-on found

A hands-on write-up on Zenn, published June 26, 2026 by a freelance engineer posting as Penbit Lab, ran sudo --version on Ubuntu 26.04 LTS Desktop and got sudo-rs 0.2.13-0ubuntu1. Its update-alternatives --list sudo output showed two entries: /usr/bin/sudo.ws and /usr/lib/cargo/bin/sudo.

The author also reports that SUDO_TTY and MAIL are absent from the environment sudo-rs passes to commands. Classic sudo's output was not captured side by side in that article, so the comparison rests on the author's memory of the old behaviour.

The way back

Classic sudo stays installed as sudo.ws. The Zenn article lists the switch command, and other write-ups give the same one:sudo update-alternatives --set sudo /usr/bin/sudo.ws. One of those write-ups says Canonical plans to test sudo-rs as the only sudo in 26.10. I could not find that in an official Canonical page, so treat it as unconfirmed.

For anyone with a fleet: grep scripts for sudo -E, and run visudo -c on every file in /etc/sudoers.d before moving a machine from 24.04. The same kind of silent default change hit Postman users in 12.33, where a tool altered an agent config nobody told it to touch. Linux behaviour that differs from what the vendor's headline implies also turned up in our look at RTX Spark on Linux.

The next date to watch is 26.10, when Canonical's reported test of sudo-rs without the fallback would begin.