Who a user can 'runas' with sudo is defined in the /etc/sudoers config file. This utility is extremely configurable so I might over simplify a bit. The sudoers manpage covers it exhaustively.
When called, sudo checks the rules for the calling user. In your example that means the rules for user borea are evaluated first, not those, if there any, for user marvin.
The error message from the call definitely doesn't help clarify that point.
A typical 'full sudo privilege' entry in sudoers looks like this:
borea ALL = (ALL) ALL
This is that same statement with context on what each item means:
Who: borea
On hosts: ALL
Can run as users: (ALL)
The commands: ALL
The key entry in context of your question is the third. If that isn't set to ALL it if it is set to a user list that doesn't include marvin, the call will fail.
Here is a more involved example from the man page:
alan ALL = (root, bin : operator, system) ALL
This setting translates to:
user alan may run any command as either user root or bin, optionally
setting the group to operator or system.
So the difference between the behavior on the two systems is not tied to the marvin account but instead to your account. My best guess on the cause is the 'run as' setting, but there are other settings that could prevent it in the same config file, both globally and in other subtle ways (eg group membership).
Other things to look at:
Based on your feedback, the issue isn't with the sudoers file as directly configured for user borea. Here is a laundry list of data points to collect and things to try. Update your question with the results (specifically any differences seen between the two machines).
1. This command will summarize your 'sudo' related privileges and limitations, check if there is a difference reported between the two machines:
sudo -l -U borea
2. Repeat the same for user marvin. Its definitely not required that marvin be in sudoers for sudo -u to work, but its a good data point. It's possible that marvin inherited some settings by group membership, etc.
sudo -l -U marvin
3. On both machines, check the status of the marvin account for any differences. finger may not be installed by default; use sudo apt-get install finger first in that case.
sudo finger -l marvin
sudo passwd --status marvin
id marvin
4. Try to open a shell using the marvin account. su uses a different method to escalate privilege:
sudo su marvin
5. Assuming the root account is enabled for shell access (I think by default Ubuntu still disables that), try this:
sudo -s
sudo -u marvin scriptname
6. Confirm the permissions on /etc/sudoers:
ls -alt /etc/sudoers
The result should start with
-r--r----- 1 root root ...
If it doesn't, fix it with:
sudo chmod 440 /etc/sudoers
sudo chown root:root /etc/sudoers
7. Try copying the sudoers file from the machine were things are working correctly to the machine where they are not. Be very careful doing this - backup the originals to a safe spot. It would be easy to lose track of which file is which...
8. Last thing - check to see if you have a file /etc/sudo.conf on one or both machines. Create a copy of both files if so, and move them to a single machine. run
diff sudo.conf.machine1 sudo.conf.machine2
to look for configuration differences. Do the same with the /etc/sudoers file (using diff) to find all deltas.
