Hi, on Ubuntu 24.04 with box 10.1.x,
visudo -c reports /etc/sudoers.d/cloudron
: bad permissions, should be mode 0440.
Cause: setup/start.sh copies the file with plain cp and no chmod, so it lands as 0644. Since start.sh runs at every update, a manual chmod 440 gets reverted each time.
Not a privilege escalation (sudo only refuses group/world-writable files), but it trips visudo -c, which hardening/security audits run routinely.
Suggestion: add chmod 0440 right after the cp in setup/start.sh (and mark the source file 0440 in the tarball).