search

sudo-project / sudo

Utility to execute a command as another user
https://www.sudo.ws
Other
1.2k stars 224 forks source link

Bug or feature? environment variables behaviour change #318

Closed JuanCarlosgg closed 1 year ago

JuanCarlosgg commented 1 year ago

Starting on version 1.9.4, specifically since this commit https://github.com/sudo-project/sudo/commit/7d0b19d2a0236ff50f8e8253ba86e1672399ae52, there is a change in the behaviour of the setenv/getenv functions when these are called from a pam_module or anything that is called from policy_init_session.

The previous behaviour was that the env functions made mofications on the environ pointer from the pam process. After this change the changes are made to the private enviroment from sudo. This happens because the envp pointer from the sudo env.envp pointer is not null (now the function sudoers_check_cmnd only calls to env_init(NULL) on errors), so the setenv hooks are used and it does not modify the pam process environ pointer.

Was this change intentional?

Thanks

millert commented 1 year ago

That is an unintentional side effect of the change. The reason for keeping the environment point available was to make it possible to log that information for rejected commands in the sudoers audit plugin. However, since the command was rejected, it is probably better to just log the user's original environment in that case instead. It should be safe to revert this change but I will need to verify that it doesn't cause problems with sub-command logging.

millert commented 1 year ago

Fixed by 0778262

qsW-git commented 10 months ago

If I don't fix this bug, what might be the impact on my use?

mariushoch commented 7 months ago

Fixed by 0778262

I think this might have caused https://bugzilla.redhat.com/show_bug.cgi?id=2272665.