Hi there! Cc:ing all the people involved with this bug, sorry for the spam.
On Thu, 29 Sep 2011 21:12:57 +0200, David Paleino wrote:
> I'm attaching a patch that adds a snippet to /etc/sudoers.d/, so that sudo
> preserves $HOME during its actions.
>
> This seems the cleanest approach to me, but it needs a
> "#includedir /etc/sudoers.d/" line in /etc/sudoers. This isn't the case
> everywhere.
FYI that line is available since sudo_1.7.2p1-1:
--8<---------------cut here---------------start------------->8---
sudo (1.7.2p1-1) unstable; urgency=low
* new upstream version
* add support for /etc/sudoers.d using #includedir in default sudoers,
which I think is also a good solution to the request for a crontab-like
API requested in March of 2001, closes: #539994, #271813, #89743
* move init.d script from using rcS.d to rc[0-6].d, closes: #542924
-- Bdale Garbee <[email protected]> Mon, 31 Aug 2009 14:09:32 -0600
--8<---------------cut here---------------end--------------->8---
However, please note that your patch is IMHO plainly wrong, because
first you are overriding the Defaults declaration in /etc/sudoers
without notifying anyone and, second, your snippet does not apply to
cowbuilder only, but for every sudo call.
Please note that this bug is nothing more than a duplicate of #563728
which was itself linked to #361362. The workaround Neil Willimas
(Cc:ed) proposed on his blog post has the same implication of your
patch:
<http://www.linux.codehelp.co.uk/serendipity/index.php?/archives/213-pbuilder-not-finding-HOME.pbuilderrc-anymore.html>
A better solution would be to notify users that what you need is to add
the SETENV tag to the *builder lines in their sudoers file, from `man 5
sudoers`:
SETENV and NOSETENV
These tags override the value of the setenv option on a
per-command basis. Note that if SETENV has been set for a
command, the user may disable the env_reset option from the
command line via the -E option. Additionally, environment
variables set on the command line are not subject to the
restrictions imposed by env_check, env_delete, or env_keep.
As such, only trusted users should be allowed to set
variables in this manner. If the command matched is ALL,
the SETENV tag is implied for that command; this default may
be overridden by use of the NOSETENV tag.
Given that pdebuild already calls sudo with the -E option, everything
should be OK:
<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=361362#54>
<https://launchpad.net/bugs/175776>
Here is the example:
=====
root@gismo:/home/luca# grep -R HOME /etc/sudoers*
root@gismo:/home/luca# grep -R SETENV /etc/sudoers*
/etc/sudoers.d/luca:luca ALL = SETENV: /usr/sbin/*builder
/etc/sudoers.d/luca:luca ALL = SETENV: /usr/bin/env
luca@gismo:~$ sudo env | grep HOME
HOME=/root
luca@gismo:~$ sudo -E env | grep HOME
HOME=/home/luca
luca@gismo:~$
=====
Thx, bye,
Gismo / Luca
pgprIwQTSNHfw.pgp
Description: PGP signature
