Incorrect `PYTHONPATH` in the output of `sshuttle --sudoers-no-modify`
Author: jphalipCreated Nov 3, 2025Updated Nov 3, 2025
I've noticed an issue in the output of sshuttle --sudoers-no-modify:
Cmnd_Alias SSHUTTLEA67 = /usr/bin/env PYTHONPATH=/opt/homebrew/Cellar/sshuttle/1.3.2/libexec/lib/python3.14/site-packages/sshuttle /opt/homebrew/bin/sshuttle *
jphalip ALL=NOPASSWD: SSHUTTLEA67If I set up that config and then run sshuttle, it still asks for my password. So I've looked at the logs (sudo log show --predicate 'eventMessage contains "sudo"' --last 5m --info) to see exactly what command is used:
2025-11-02 19:52:50.769595-0800 localhost sudo[22852]: jphalip : TTY=ttys000 ; PWD=/Users/jphalip ; USER=root ; COMMAND=/usr/bin/env PYTHONPATH=/opt/homebrew/Cellar/sshuttle/1.3.2/libexec/lib/python3.14/site-packages /opt/homebrew/bin/sshuttle --method auto --firewallSee how the actual PYTHONPATH ends with /site-packages, whereas the one supplied by sshuttle --sudoers-no-modify ends with /site-packages/sshuttle.
If I remove the /sshuttle postfix in the sudoers config file, then sshuttle stops asking for my password.
So this seems like a but in the output of sshuttle --sudoers-no-modify. What do you think?
Source: sshuttle/sshuttle