#1096·sshuttle

Incorrect `PYTHONPATH` in the output of `sshuttle --sudoers-no-modify`

Author: jphalipCreated Nov 3, 2025Updated Nov 3, 2025

I've noticed an issue in the output of sshuttle --sudoers-no-modify:

Cmnd_Alias SSHUTTLEA67 = /usr/bin/env PYTHONPATH=/opt/homebrew/Cellar/sshuttle/1.3.2/libexec/lib/python3.14/site-packages/sshuttle /opt/homebrew/bin/sshuttle *

jphalip ALL=NOPASSWD: SSHUTTLEA67

If I set up that config and then run sshuttle, it still asks for my password. So I've looked at the logs (sudo log show --predicate 'eventMessage contains "sudo"' --last 5m --info) to see exactly what command is used:

2025-11-02 19:52:50.769595-0800  localhost sudo[22852]:  jphalip : TTY=ttys000 ; PWD=/Users/jphalip ; USER=root ; COMMAND=/usr/bin/env PYTHONPATH=/opt/homebrew/Cellar/sshuttle/1.3.2/libexec/lib/python3.14/site-packages /opt/homebrew/bin/sshuttle --method auto --firewall

See how the actual PYTHONPATH ends with /site-packages, whereas the one supplied by sshuttle --sudoers-no-modify ends with /site-packages/sshuttle.

If I remove the /sshuttle postfix in the sudoers config file, then sshuttle stops asking for my password.

So this seems like a but in the output of sshuttle --sudoers-no-modify. What do you think?