On Tue, Jun 12, 2018 at 08:43:06AM -0400, Matthew Miller wrote: > On Tue, Jun 12, 2018 at 07:50:29AM -0400, Nico Kadel-Garcia wrote: > > The simple fact is that "sudo" inherits $HOME and $PATH by default. > > Not in Fedora's default configuration. And, this proposal increases my > support for keeping that as it is (with secure_path set).
I did not see a convincing argument or explanation why there is a critical security issue with sudo and this change, even when sudo would inherit $HOME and $PATH. Who is the attacker that can drop files only in $HOME/.local/bin or $HOME/bin not not in other directories, cannot append existing files and does not yet have elevated access on the system. Kind regards Till _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/LJEJ3WYUA7UTU2HBRLG5MMDNNOPY5KKN/
