"I'm afraid I can't do that" error message is unclear

[Maltz42]

When a user is not in the sudoers group, the error message displayed is:

sudo: I'm sorry [user]. I'm afraid I can't do that.

Now, I appreciate a HAL 9000 reference as much as anyone, but an error message isn't really the place for that - it should tell the user as much as possible about what is wrong and why. The normal sudo error message is much more helpful:

[user] is not in the sudoers file.

[adil192]

Yep, here's a real user getting confused by this vague and frustrating message: https://www.reddit.com/r/flatpak/comments/1v75539/hello_im_having_trouble_installing_flatpack_on/

[squell]

When a user tries to perform a certain action, sudo-rs checks that against the policy; the "afraid I can't do that" means, .. well literally, you can't do that. So a more dry error message could be: "Sorry, I can't do that" or "Sorry, you are not allowed to do that.". But that is semantically equivalent to what it is right now. For this purpose, it's not necessary to distinguish between "user has some commands they can execute" and "user would never be able to use sudo".

That literal text of the error message can be traced way back to the very early days of sudo-rs development and probably the only tongue-in-cheek bit that's still in it. So of course we can consider making it more boring.

I can't see the original post in that Reddit thread, but I do see various non-confused responses which indicate to me the error message is doing something right.

For improvement, obviously, sudo-rs can't explain in detail to an unprivileged user exactly why a certain action wasn't allowed. But we could proceed to show the output of a sudo --list command (although that requires authentication, so we may need to think about that change)

But, I am not for switching to "{user} is not in the sudoers file". I wouldn't be surprised if it is kept in ogsudo for historical reasons. It is technically incorrect, since the user can be in the sudoers file and still get this error. And it is confusing since the typical remedy in default setups would be to add the user to the sudo or sudoers group.

[Maltz42]

That's fair. If sudo-rs permissions are more nuanced than just being in the sudoers group, then the exact wording could be tweaked. Perhaps something like "[user] does not have permission to use sudo.", to which the user can respond by looking up how to grant a user account access to use sudo. (Assuming they are an admin on another account.)

The main problem with this HAL error message is that it gives the user no information about why the action was not performed, so they have no such clear path forward, other than just googling the error text itself. And its informality, and presumed familiarity of a cultural reference, makes it easily mistaken for a prank or hack - as several people in that Reddit post believed it to be.

[bjorn3]

Perhaps something like "[user] does not have permission to use sudo."

That is also not entirely correct. The user could have permission to run some commands with sudo, but not the one that the user actually tried to run. Or they could only have permission to run the command under a different user than they tried.

[adil192]

If having different messages is possible, my proposals are:

• User has no sudo permissions:

  [user] does not have permission to use sudo. Please contact your administrator for more information.
  

• User can sudo some commands, but not this particular command:

  [user] cannot run this command with sudo. Please contact your administrator for more information.
  

[squell]

If having different messages is possible, my proposals are:

• User has no sudo permissions:

  [user] does not have permission to use sudo. Please contact your administrator for more information.
  

• User can sudo some commands, but not this particular command:

  [user] cannot run this command with sudo. Please contact your administrator for more information.
  

That would reveal information about /etc/sudoers to unauthenticated users.

[adil192]

Then how about always using the latter message?

[user] cannot run this command with sudo. Please contact your administrator for more information.

[squell]

And its informality, and presumed familiarity of a cultural reference, makes it easily mistaken for a prank or hack - as several people in that Reddit post believed it to be.

II personally think this should not be consideration. Cultural references and informality are and should be acceptable in free/open source software. Just a few examples:

• ogsudo has the insults feature (which we rejected on technical grounds in Adding insults #823, and alternatives exist).

• When I open my favourite editor I am often presented by Bram Moolenaar's plea to help poor children in Uganda.

• The FreeBSD boat loader probably looks very unprofessional or even jarring to some people.

[adil192]

Informality and cultural references are fine, but consider the user experience of someone not familiar with this random book quote(?).
Plus the "I can't do that" message tells me nothing about what happened or how to fix it.
If you want to keep the reference, perhaps add another sentence with more information e.g.

I'm sorry [user]. I'm afraid I can't do that.
You don't have permission to run this command with sudo.