Date: Sat, 15 Jul 2006 09:02:52 GMT From: "Dr. Markus Waldeck" <waldeck@gmx.de> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/100332: SUBoptimal sudo configuration Message-ID: <200607150902.k6F92q2g032562@www.freebsd.org> Resent-Message-ID: <200607150910.k6F9AM62096496@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 100332 >Category: ports >Synopsis: SUBoptimal sudo configuration >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Jul 15 09:10:16 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Dr. Markus Waldeck >Release: 6.1 >Organization: >Environment: FreeBSD fb 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Sun May 7 04:32:43 UTC 2006 root@opus.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 >Description: According to the CHANGES file (#432) in the sudo source code "env_reset" is normally default! sudo -V shows that there is no "Reset the environment to a default set of variables", but only "Ignore '.' in $PATH". This is NOT sufficient and will fail in following test case (see "How to repeat"). >How-To-Repeat: % echo 'echo BULLSHIT' > date % chmod +x date % date % export PATH=.:$PATH % date % sudo date % sudo sh # date >Fix: Use the default "env_reset" instead of "ignore_dot"! >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607150902.k6F92q2g032562>