Piped commands run with sudo prefix result in indented output

Question

I have an interesting issue on most of my servers, where commands prefixed with sudo and piped | to another program end up with indented output.

Note that I'm going to use lsb_release command for the example, however this issue occurs any any command (e.g. reading log/config files).

Here's normal output both with and without sudo:

$ sudo lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:    18.04
Codename:   bionic

$ lsb_release -a | cat
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:    18.04
Codename:   bionic

And here's output after combining sudo and a pipe:

$ sudo lsb_release -a | cat
No LSB modules are available.
Distributor ID: Ubuntu
                      Description:  Ubuntu 18.04.4 LTS
                                                          Release:  18.04
                                                                             Codename:  bionic

Interestingly, this does not occur when we simply run the command as the root user.

$ sudo su
# lsb_release -a | cat
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:    18.04
Codename:   bionic

There are multiple users on these servers, and we all experience this issue.

Any ideas?

Updated examples:

No tab/space characters displayed by cat --show-all:

$ sudo lsb_release -a | cat --show-all
No LSB modules are available.
Distributor ID:^IUbuntu$
                        Description:^IUbuntu 18.04.5 LTS$
                                                         Release:^I18.04$
                                                                         Codename:^Ibionic$

same issue with od -bc output:

$ sudo lsb_release -a | od -bc
No LSB modules are available.
0000000 104 151 163 164 162 151 142 165 164 157 162 040 111 104 072 011
                                                                                 D   i   s   t   r   i   b   u   t   o   r       I   D   :  \t
       0000020 125 142 165 156 164 165 012 104 145 163 143 162 151 160 164 151
                                                                                        U   b   u   n   t   u  \n   D   e   s   c   r   i   p   t   i
              0000040 157 156 072 011 125 142 165 156 164 165 040 061 070 056 060 064
                                                                                               o   n   :  \t   U   b   u   n   t   u       1   8   .   0   4
                     0000060 056 065 040 114 124 123 012 122 145 154 145 141 163 145 072 011
                                                                                                      .   5       L   T   S  \n   R   e   l   e   a   s   e   :  \t
                            0000100 061 070 056 060 064 012 103 157 144 145 156 141 155 145 072 011
                                                                                                             1   8   .   0   4  \n   C   o   d   e   n   a   m   e   :  \t
                                   0000120 142 151 157 156 151 143 012
          b   i   o   n   i   c  \n
0000127

and $TERM value:

$ echo $TERM
xterm-256color

Pipe your output to cat --show-all or od -bc. What's your $TERM? — waltinator, Oct 30 '20 at 16:03
I've updated the description with those examples @waltinator — n7s, Nov 02 '20 at 23:16

n7s · Answer 1 · 2020-11-03T19:30:31.950

It looks like the issue is related to setting Defaults use_pty in /etc/sudoers, which was added for CIS hardening. Upon commenting out that line the server no longer has the indentation issue.

$ sudo lsb_release -a | cat
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.5 LTS
Release:    18.04
Codename:   bionic

Reading through https://www.sudo.ws/legacy.html, I suspect updating sudo to a newer release will fix the issue.

e.g. this change looks promising

Major changes between version 1.8.27 and 1.8.26:

[...]

If an I/O logging plugin is configured but the plugin does not actually log any I/O, sudo will no longer force the command to be run in a pseudo-tty.

Thank you very much for coming back to your question to give a detailed reply. This was quite helpful to me and at least I know what the issue is now. Note that the issue still exists on Ubuntu 23.04 daily. — scottkosty, Mar 13 '23 at 02:35

Piped commands run with sudo prefix result in indented output

1 Answers1