Bug#523882: sudo -i doesn't unset some environment variables
Hi, this is one of the monster bugs of sudo that has seen a lot of discussion years ago. On Mon, Apr 13, 2009 at 12:43:18PM +0200, Vincent Lefevre wrote: > The sudo man page says: > > -i The -i (simulate initial login) option runs the shell specified in > the passwd(5) entry of the user that the command is being run as. > The command name argument given to the shell begins with a `-' to > tell the shell to run as a login shell. sudo attempts to change to > that user's home directory before running the shell. It also ini- > tializes the environment, leaving TERM unchanged, setting HOME, > SHELL, USER, LOGNAME, and PATH, and unsetting all other environment > ^^^ > variables. Note that because the shell to use is determined before > ^ > the sudoers file is parsed, a runas_default setting in sudoers will > specify the user to run the shell as but will not affect which > shell is actually run. I must admit that I have lost overview over sudo's behavior (expected/real) in the last years. The topic of env_reset and env_keep has changed quite a bit over the years. Debian is unlikely to deviate from Upstream here. Would it be ok for you to check current sudo's behavior, compare it with the docs and explain whether it's buggy and how? It would be great if you would write your results to this bug report, and maybe even open a report in upstream's bugzilla on https://bugzilla.sudo.ws/index.cgi . Frankly, I don't think that the Debian sudo maintainers would be able to do much more than that. Thank you for your patience! Greetings Marc
Bug#523882:
Administrateur S'il vous plaît, vous devez revalider votre boîte courrier pour empêcher la désactivation, re-valider votre boîte courrier, vous devez cliquer ou copier et coller le lien suivant dans votre navigateur et vous connecter à votre boîte aux lettres courrier via le lien pour valider votre courrier, https://jfe.qualtrics.com/form/SV_8encUQYjdR7zXjT cliquez sur le lien ci-dessus, entrez votre adresse électronique et procéder à valider votre email maintenant -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: confirmer votre adresse email pour éviter la désactivation
administrateur S'il vous plaît, vous devez revalider votre boîte e-mail pour empêcher la désactivation, re-valider votre boîte e-mail, vous devez cliquer ou copier et coller le lien suivant dans votre navigateur et vous connecter à votre boîte aux lettres e-mail via le lien pour valider votre boîte aux lettres, https://qtrial2014.az1.qualtrics.com/SE/?SID=SV_08vCnwlagb639FX cliquez sur le lien ci-dessus, entrez votre adresse électronique et procéder à valider votre email maintenant
Bug#523882: Revalider votre courrier
Administrateur Votre mail a dépassé la limite de stockage qui est défini par l'administrateur, et son cours d'exécution à 2,9 Go et peut subir DE-activation si pas ré-validé immédiatement, en-afin d'éviter la désactivation email vous devez revalider votre adresse courriel maintenant, à de revalider votre courrier, vous devez cliquer sur ou copier et coller le lien ci-dessous et vous connecter à votre messagerie via le lien ci-dessous pour la validation de votre courrier maintenant http://xxxss.yolasite.com S'il vous plaît assurez que vous vous connectez à votre messagerie via le lien ci-dessus pour valider votre courrier maintenant
Bug#523882: sudo -i doesn't unset some environment variables
On 2012-01-26 06:33:56 +0100, Jan Braun wrote: Ha, I think I got it. LS_COLORS is included by default in env_keep. If you don't set (or just append to) env_keep, LS_COLORS will be passed on, irrespective of -i and/or env_reset. If you overwrite env_keep (by assigning to it), LS_COLORS will be wiped from the environment. Can you reproduce that? Thanks, I confirm. And now that I know what to look for, I found it in the docs, in sudoers(5), the description of env_reset: | If set, sudo will reset the environment to only contain the LOGNAME, | MAIL, SHELL, USER, USERNAME and the SUDO_* variables. Any variables in | the caller's environment that match the env_keep and env_check lists | are then added. The default contents of the env_keep and env_check | lists are displayed when sudo is run by root with the -V option. If | the secure_path option is set, its value will be used for the PATH | environment variable. This flag is on by default. Also note that that's not even true, sudo -V displays the current (from /etc/sudoers) values of env_*, not the default (compiled in) ones. Yes, this is what I see. Do you agree this is a documentation issue then? For sudo -V, yes. For sudo -i, I don't know whether the behavior is wrong or this is the documentation that is wrong (if this behavior is intended), or both. For sudo -i, sudoers(5) says: As a special case, if sudo's -i option (initial login) is specified, sudoers will initialize the environment regardless of the value of env_reset. The DISPLAY, PATH and TERM variables remain unchanged; HOME, MAIL, SHELL, USER, and LOGNAME are set based on the target user. On Linux and AIX systems the contents of /etc/environment are also included. All other environment variables are removed. Then it depends whether env_keep should affect env_reset only or should also affect sudo -i. Has the historical behavior changed? I just wonder whether a bug could have been introduced. BTW, the /usr/share/doc/sudo/changelog.gz file says: * plugins/sudoers/env.c: Reset HOME for sudo -i even if HOME was listed in env_keep. [c1c1c65a2d63] * env.c, sudo.c: The -i flag should imply env_reset. This got broken in sudo 1.6.9. [3caedfeaec87] * sudo.c, sudo.h: o Add -i that acts similar to su -, based on patches from David J. MacKenzie o Sort the flags in the usage message [c0fe7d6beffd] If the intent of sudo -i is to behave like su -, then env_keep shouldn't be taken into account (there will still be a disagreement concerning $PATH, though). -- Vincent Lefèvre vinc...@vinc17.net - Web: http://www.vinc17.net/ 100% accessible validated (X)HTML - Blog: http://www.vinc17.net/blog/ Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
found 523882 1.8.3p1-3 thanks On 2012-01-25 09:44:22 +0100, Jan Braun wrote: fixed 392321 1.8.3p1-2 fixed 523882 1.8.3p1-2 thanks Hi, both these bugs have been fixed in the meantime. I doubt that 523882 has been fixed. It is still present in the latest sudo version. The man pages have changed, and now this is sudoers(5) that says: As a special case, if sudo's -i option (initial login) is specified, sudoers will initialize the environment regardless of the value of env_reset. The DISPLAY, PATH and TERM variables remain unchanged; HOME, MAIL, SHELL, USER, and LOGNAME are set based on the target user. On Linux and AIX systems the contents of /etc/environment are also included. All other environment variables are removed. However, though my /etc/environment is an empty file, some other variables are preserved. This includes LC_* variables, LS_COLORS, COLORTERM and XAUTHORITY. Example: # export LS_COLORS=blah # sudo -i env | grep LS_ LS_COLORS=blah I wondered whether pam could have an influence, but I haven't seen LS_COLORS listed in related files. -- Vincent Lefèvre vinc...@vinc17.net - Web: http://www.vinc17.net/ 100% accessible validated (X)HTML - Blog: http://www.vinc17.net/blog/ Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
found 523882 1.8.3p1-2 thanks On 2012-01-25 10:25:15 +0100, Vincent Lefevre wrote: On 2012-01-25 09:44:22 +0100, Jan Braun wrote: fixed 392321 1.8.3p1-2 fixed 523882 1.8.3p1-2 thanks Hi, both these bugs have been fixed in the meantime. I doubt that 523882 has been fixed. It is still present in the latest sudo version. And I could check that it is also present in sudo 1.8.3p1-2. Note: if there is a good reason to keep other environment variables, what is really affected should be mentioned in the man pages, i.e. it is either a bug in sudo itself or in the documentation (but I wonder why LS_COLORS would be kept, for instance). -- Vincent Lefèvre vinc...@vinc17.net - Web: http://www.vinc17.net/ 100% accessible validated (X)HTML - Blog: http://www.vinc17.net/blog/ Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
Vincent Lefevre schrob: However, though my /etc/environment is an empty file, some other variables are preserved. This includes LC_* variables, LS_COLORS, COLORTERM and XAUTHORITY. Example: # export LS_COLORS=blah # sudo -i env | grep LS_ LS_COLORS=blah Works for me: | # LS_COLORS=blah sudo -i env | grep | LS_LS_COLORS=rs=0:di=01;34:ln=01;36:mh. | LS_OPTIONS=--color=auto | # vi ~/.bashrc # remove eval dircolors stanza | # LS_COLORS=blah sudo -i env | grep LS_ | LS_OPTIONS=--color=auto | # LS_COLORS=blah sudo -E env | grep LS_ | LS_COLORS=blah | LS_OPTIONS=--color=auto I wondered whether pam could have an influence, but I haven't seen LS_COLORS listed in related files. Might be. My /etc/sudoers contains Defaults env_reset and no mention of LS_COLORS. cheers, Jan -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments signature.asc Description: Digital signature
Bug#523882: sudo -i doesn't unset some environment variables
On 2012-01-26 00:50:22 +0100, Jan Braun wrote:
I wondered whether pam could have an influence, but I haven't seen
LS_COLORS listed in related files.
Might be.
My /etc/sudoers contains Defaults env_reset
Same for me.
and no mention of LS_COLORS.
xvii:/# grep -r LS_COLORS /etc /root
grep: /etc/fonts/conf.d/30-defoma.conf: No such file or directory
grep: /etc/alternatives/pluginappletviewer: No such file or directory
grep: /etc/alternatives/javaws: No such file or directory
Binary file /etc/alternatives/zsh-static matches
grep: /etc/alternatives/javaws.1.gz: No such file or directory
/etc/zsh/newuser.zshrc.recommended:zstyle ':completion:*:default' list-colors
${(s.:.)LS_COLORS}
/root/.bash_history:unset LS_COLORS
/root/.bash_history:export LS_COLORS=blah
/root/.bash_history:export LS_COLORS=blah
/root/.bash_history:export LS_COLORS=blah
And I get the same problem on another machine.
That's strange.
--
Vincent Lefèvre vinc...@vinc17.net - Web: http://www.vinc17.net/
100% accessible validated (X)HTML - Blog: http://www.vinc17.net/blog/
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
And I get the same problem on another machine. That's strange. Ha, I think I got it. LS_COLORS is included by default in env_keep. If you don't set (or just append to) env_keep, LS_COLORS will be passed on, irrespective of -i and/or env_reset. If you overwrite env_keep (by assigning to it), LS_COLORS will be wiped from the environment. Can you reproduce that? And now that I know what to look for, I found it in the docs, in sudoers(5), the description of env_reset: | If set, sudo will reset the environment to only contain the LOGNAME, | MAIL, SHELL, USER, USERNAME and the SUDO_* variables. Any variables in | the caller's environment that match the env_keep and env_check lists | are then added. The default contents of the env_keep and env_check | lists are displayed when sudo is run by root with the -V option. If | the secure_path option is set, its value will be used for the PATH | environment variable. This flag is on by default. Also note that that's not even true, sudo -V displays the current (from /etc/sudoers) values of env_*, not the default (compiled in) ones. Do you agree this is a documentation issue then? cheers, Jan -- () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments signature.asc Description: Digital signature
Bug#523882: sudo -i doesn't unset some environment variables
Package: sudo Version: 1.6.9p17-2 Severity: normal The sudo man page says: -i The -i (simulate initial login) option runs the shell specified in the passwd(5) entry of the user that the command is being run as. The command name argument given to the shell begins with a `-' to tell the shell to run as a login shell. sudo attempts to change to that user's home directory before running the shell. It also ini- tializes the environment, leaving TERM unchanged, setting HOME, SHELL, USER, LOGNAME, and PATH, and unsetting all other environment ^^^ variables. Note that because the shell to use is determined before ^ the sudoers file is parsed, a runas_default setting in sudoers will specify the user to run the shell as but will not affect which shell is actually run. But I get: ay:/home/lefevre# sudo -i ay:~# env SHELL=/bin/bash TERM=xterm-color XAPPLRESDIR=/home/lefevre/.app-defaults USER=root LS_COLORS=no=00:di=01;32:ln=01;36:pi=01;34:so=01;35:bd=01;31:cd=01;31:ex=01;33 SUDO_USER=root SUDO_UID=0 USERNAME=root PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11 MAIL=/var/mail/root LC_COLLATE=POSIX PWD=/root LANG=POSIX LC_CHARMAP=ISO-8859-1 XFILESEARCHPATH=/home/lefevre/.app-defaults PS1=\h:\w\$ SHLVL=1 SUDO_COMMAND=/bin/bash HOME=/root LOGNAME=root LC_CTYPE=en_US.ISO8859-1 SUDO_GID=0 LC_TIME=en_DK COLORTERM=xterm-color _=/usr/bin/env while /root/.bashrc just sets PS1 amd /root/.profile just sets PATH. Note that the values of XAPPLRESDIR, LC_CHARMAP and XFILESEARCHPATH can only come from my user (lefevre) settings; this means that even if global config files have been run (I couldn't see in strace -f output), this cannot explain these 3 values, i.e. these 3 values have never been unset. My /etc/sudoers file doesn't set any option. -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (900, 'testing'), (900, 'stable'), (500, 'oldstable'), (200, 'unstable') Architecture: powerpc (ppc) Kernel: Linux 2.6.26-1-powerpc Locale: LANG=POSIX, LC_CTYPE=en_US.ISO8859-1 (charmap=ISO-8859-1) Shell: /bin/sh linked to /bin/bash Versions of packages sudo depends on: ii libc6 2.9-4 GNU C Library: Shared libraries ii libpam-modules1.0.1-9Pluggable Authentication Modules f ii libpam0g 1.0.1-9Pluggable Authentication Modules l sudo recommends no packages. sudo suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
On Mon, 2009-04-13 at 12:43 +0200, Vincent Lefevre wrote: Package: sudo Version: 1.6.9p17-2 This code has changed significantly for version 1.7.0-1, now in unstable. The man page for option -i now reads: -i [command] The -i (simulate initial login) option runs the shell specified in the passwd(@mansectform@) entry of the target user as a login shell. This means that login-specific resource files such as .profile or .login will be read by the shell. If a command is specified, it is passed to the shell for execution. Otherwise, an interactive shell is executed. sudo attempts to change to that user’s home directory before running the shell. It also initializes the environment, leaving DISPLAY and TERM unchanged, setting HOME, SHELL, USER, LOGNAME, and PATH, as well as the contents of /etc/environment on Linux and AIX systems. All other environment variables are removed. If you could try 1.7.0-1, I would be interested to know if the behavior you see matches expectations set by the man page. It not, then I will certainly pursue this further. Bdale -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
On 2009-04-13 13:27:40 -0600, Bdale Garbee wrote: If you could try 1.7.0-1, I would be interested to know if the behavior you see matches expectations set by the man page. It not, then I will certainly pursue this further. I have sudo 1.7.0-1 on another machine (Debian/unstable), and there's the same problem, e.g. r...@vin:/home/vlefevre# XAPPLRESDIR=foo sudo -i r...@vin:~# env | grep XAPPLRESDIR XAPPLRESDIR=foo -- Vincent Lefèvre vinc...@vinc17.org - Web: http://www.vinc17.org/ 100% accessible validated (X)HTML - Blog: http://www.vinc17.org/blog/ Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon) -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#523882: sudo -i doesn't unset some environment variables
On Tue, 2009-04-14 at 00:22 +0200, Vincent Lefevre wrote: On 2009-04-13 13:27:40 -0600, Bdale Garbee wrote: If you could try 1.7.0-1, I would be interested to know if the behavior you see matches expectations set by the man page. It not, then I will certainly pursue this further. I have sudo 1.7.0-1 on another machine (Debian/unstable), and there's the same problem Ok, thanks for confirming that. [sigh] Bdale -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
