On Tue, 17 Jun 2025 at 20:00:59 +0000, Qualys Security Advisory wrote:
On Debian 12 and Ubuntu 24.04, when an unprivileged user logs in via
sshd, PAM's pam_env module (from Linux-PAM 1.5.x) also reads this user's
~/.pam_environment file, because pam_env's "user_readenv" is explicitly
set to 1 in /etc/pam.d/sshd (it is 0 by default, since Linux-PAM 1.4.0).
The upcoming Debian 13 release no longer does this by default
(https://bugs.debian.org/1018260) and presumably neither do newer Ubuntu
releases.
I think the underlying problem here is that PAM has historically made it
ambiguous whether environment variables are trusted (trustable) or not.
The result is that some components (like pam_systemd's use of
XDG_SESSION_ID) behave as though the PAM environment is a trusted
channel through which the system can communicate information about a
session - indeed, there might not be any other way to get that
information - while other components (like pam_env with user_readenv)
behave as though the PAM environment is a piece of per-user
configuration that can be arbitrarily configured by the user for maximum
flexibility, but therefore can't be trusted by higher-privileged
components. It could reasonably be either of those, but it can't be
both.
The conflation of the "PAM environment" (ambiguously trusted) with
the environ(7) that will be inherited by the final program (untrusted
user configuration where maximum flexibility is an expected feature)
doesn't help this.
smcv
