Debian Bug report logs - #349587
sudo -s does not preserve $HOME environment variable

version graph

Package: sudo; Maintainer for sudo is Bdale Garbee <bdale@gag.com>; Source for sudo is src:sudo.

Reported by: Berend Reitsma <breitsma@gmail.com>

Date: Mon, 23 Jan 2006 21:48:11 UTC

Severity: critical

Tags: patch

Merged with 349196, 349549, 349729

Found in version sudo/1.6.8p7-1.3

Fixed in version sudo/1.6.8p12-2

Done: Steve Langasek <vorlon@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Berend Reitsma <breitsma@gmail.com>:
New Bug report received and forwarded. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Berend Reitsma <breitsma@gmail.com>
To: submit@bugs.debian.org
Subject: sudo -s does not preserve $HOME environment variable
Date: Mon, 23 Jan 2006 22:29:36 +0100
Package: sudo
Version: 1.6.8p7-1.3
Severity: grave
Justification: renders package unusable

*** Please type your report below this line ***

sudo -s removes environment variables including $HOME.
I went back to 1.6.8p7-1.2 because of this.
I don't really care too much about all other environment variables
but I would like to keep my $HOME variable thank you very much.


-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.4.24
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages sudo depends on:
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  libpam-modules              0.76-22      Pluggable Authentication Modules f
ii  libpam0g                    0.76-22      Pluggable Authentication Modules l

-- no debconf information



Merged 349196 349587. Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Merged 349196 349549 349587. Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to mith <dhuff@800hosting.com>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #14 received at 349587@bugs.debian.org (full text, mbox):

From: mith <dhuff@800hosting.com>
To: Debian Bug Tracking System <349587@bugs.debian.org>
Subject: sudo: This bug does not only occur with -s and breaks systems in place.
Date: Fri, 03 Feb 2006 12:35:27 -0600
Package: sudo
Version: 1.6.8p7-1.3
Followup-For: Bug #349587


This bug is actually a bit more far sweeping. The patch made in the
security advisory DSA 946-1 was not thought out at all. All of the
mechanisms to provide the workaround functionality put in place were
already in place. env_reset just needed to have the LC_* variables added
to it and possibly be turned on by default. This change in 1.3 causes
all sorts of un-intended breakage of automated systems which use sudo.
In fact, explicitly setting env_keep+="HOME" is broken without first
setting env_reset (even though the basic functionality is in place due
to the patch). Just simply using env_keep+="HOME" will not even
function. At the very least this should be documented if not completely
reversed and re-thought out.


-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.8-16-dobbs-1
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)

Versions of packages sudo depends on:
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  libpam-modules              0.76-22      Pluggable Authentication Modules f
ii  libpam0g                    0.76-22      Pluggable Authentication Modules l

-- no debconf information



Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Martin Schulze <joey@infodrom.org>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #19 received at 349587@bugs.debian.org (full text, mbox):

From: Martin Schulze <joey@infodrom.org>
To: 349729@bugs.debian.org
Subject: whitelist
Date: Fri, 10 Feb 2006 07:28:47 +0100
Please read the advisory again:
http://www.debian.org/security/2006/dsa-946

It says:

   "Additional variables are only passed through when set as env_check
   in /etc/sudoers, which might be required for some scripts to
   continue to work."

Use

Defaults        env_check = HOME

in /etc/sudoers for example.

Regards,

	Joey

-- 
Linux - the choice of a GNU generation.

Please always Cc to me when replying to me on the lists.



Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Marius Gedminas <mgedmin@b4net.lt>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #24 received at 349587@bugs.debian.org (full text, mbox):

From: Marius Gedminas <mgedmin@b4net.lt>
To: 349587@bugs.debian.org
Subject: 'Default senv_check = HOME' does not fix sudo
Date: Tue, 14 Feb 2006 12:26:16 +0200
I have added the suggested workaround

  Defaults env_check = HOME

to my sudoers, yet 'sudo env' shows that HOME is not preserved.

Regards,
Marius Gedminas
-- 
Prediction is very difficult, especially of the future.
                -- Niels Bohr



Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Steve Langasek <vorlon@debian.org>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #29 received at 349587@bugs.debian.org (full text, mbox):

From: Steve Langasek <vorlon@debian.org>
To: Marius Gedminas <mgedmin@b4net.lt>, 349587@bugs.debian.org
Subject: Re: Bug#349587: 'Default senv_check = HOME' does not fix sudo
Date: Tue, 14 Feb 2006 12:20:14 -0800
[Message part 1 (text/plain, inline)]
On Tue, Feb 14, 2006 at 12:26:16PM +0200, Marius Gedminas wrote:
> I have added the suggested workaround

>   Defaults env_check = HOME

> to my sudoers, yet 'sudo env' shows that HOME is not preserved.

AIUI, you must set env_reset before setting env_check; this is a bug in the
security patch that was applied.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Marius Gedminas <mgedmin@b4net.lt>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #34 received at 349587@bugs.debian.org (full text, mbox):

From: Marius Gedminas <mgedmin@b4net.lt>
To: 349587@bugs.debian.org
Subject: Re: Bug#349587: 'Default senv_check = HOME' does not fix sudo
Date: Wed, 15 Feb 2006 14:04:40 +0200
Confirming: adding

  Defaults env_reset, env_check = HOME

to /etc/sudoers fixes the problem for me with sudo 1.6.8p7-1.3

Thanks,
Marius Gedminas
-- 
I want patience, and I WANT IT NOW!



Severity set to `critical'. Request was from Jeroen van Wolffelaar <jeroen@wolffelaar.nl> to control@bugs.debian.org. Full text and rfc822 format available.

Merged 349196 349549 349587 349729. Request was from Jeroen van Wolffelaar <jeroen@wolffelaar.nl> to control@bugs.debian.org. Full text and rfc822 format available.

Tags added: patch Request was from Jeroen van Wolffelaar <jeroen@wolffelaar.nl> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Ewen McNeill <ewen@naos.co.nz>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #45 received at 349587@bugs.debian.org (full text, mbox):

From: Ewen McNeill <ewen@naos.co.nz>
To: 349587@bugs.debian.org
Cc: Martin Schulze <joey@infodrom.org>
Subject: sudo: DSA946: omitting $HOME
Date: Tue, 21 Mar 2006 14:57:00 +1200
In reply to bug 349729 Martin Schulze <joey@infodrom.org> wrote:
>Please read the advisory again:
>http://www.debian.org/security/2006/dsa-946
>
>It says:
>
>  "Additional variables are only passed through when set as env_check
>   in /etc/sudoers, which might be required for some scripts to
>   continue to work."
>
>[the advisory indicates only LC_*, LANG, LANGUAGE and TERM are passed through]

[ The discussion is now merged into:
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349587   
]

Out of interest what was the rationale for omitting $HOME from this list?
Omitting it (when -H and/or set_home and/or always_set_home isn't in
effect to overwrite $HOME) results in an environment without $HOME set
at all.

Since $HOME is one of the variables set by login(1), and rarely
stripped out, a lot of (interactive) programs assume that it'll be set.
Most recently I've encountered issues with vim complaining that it
can't read/write $HOME/.viminfo (due to passing the literal string
'$HOME/.viminfo' to open(2), since there was no variable to do expansion
on).

Obviously as a work around we can all do:

Defaults env_reset, env_check = HOME

on every single system we use that runs Debian.  But if there's a security
issue involved in passing through $HOME then I think it should at least
be documented so that we can be aware of it when deciding to either
put this work around in place, or live with the warnings when doing
"sudo vim foo", etc.  

If there's no security issue then $HOME seems like an obvious candidate
to add into the default whitelist.  (The only other variable set by
default by login(1) which isn't now set in the "sudo sh" environment is
$MAIL, and that doesn't seem particularly important in the context of
sudo.)

Ewen



Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Ewen McNeill <ewen@naos.co.nz>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #50 received at 349587@bugs.debian.org (full text, mbox):

From: Ewen McNeill <ewen@naos.co.nz>
To: 349587@bugs.debian.org
Cc: 349196@bugs.debian.org, Martin Schulze <joey@infodrom.org>
Subject: sudo: proposed fix seems okay (was Re: sudo: DSA946: omitting $HOME)
Date: Tue, 21 Mar 2006 15:53:45 +1200
Ewen McNeill writes:
>In reply to bug 349729 Martin Schulze <joey@infodrom.org> wrote:
>>http://www.debian.org/security/2006/dsa-946     [...]
>>[the advisory indicates only LC_*, LANG, LANGUAGE and TERM are passed through]
>[ The discussion is now merged into:
>  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349587   
>]
>
>Out of interest what was the rationale for omitting $HOME from this list?

I see that the proposed update noted in bug 349196 (which unfortunately
I missed before sending in my earlier comment) restores $HOME to the list
of environment variables allowed by default.  The Sarge package at:

http://klecker.debian.org/~joey/security/sudo/

(referenced from http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349196)

seems to work for me, at least to resolve the issue I was having with
vim and $HOME/.viminfo.

Although curiously the extra variables allowed (HOME, LOGNAME, PATH,
SHELL, TERM, DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, 
and USER), don't appear in the "sudo -V" list of variables to check;
only the original list of variables (in -1.3) appears there.  Presumably
this means they're being retained unconditionally which may or may not
be desirable.

Ewen



Reply sent to Bdale Garbee <bdale@gag.com>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Berend Reitsma <breitsma@gmail.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #55 received at 349196-close@bugs.debian.org (full text, mbox):

From: Bdale Garbee <bdale@gag.com>
To: 349196-close@bugs.debian.org
Subject: Bug#349196: fixed in sudo 1.6.8p12-2
Date: Sun, 02 Apr 2006 15:02:19 -0700
Source: sudo
Source-Version: 1.6.8p12-2

We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive:

sudo-ldap_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo-ldap_1.6.8p12-2_i386.deb
sudo_1.6.8p12-2.diff.gz
  to pool/main/s/sudo/sudo_1.6.8p12-2.diff.gz
sudo_1.6.8p12-2.dsc
  to pool/main/s/sudo/sudo_1.6.8p12-2.dsc
sudo_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo_1.6.8p12-2_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 349196@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bdale Garbee <bdale@gag.com> (supplier of updated sudo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun,  2 Apr 2006 14:26:20 -0700
Source: sudo
Binary: sudo-ldap sudo
Architecture: source i386
Version: 1.6.8p12-2
Distribution: unstable
Urgency: low
Maintainer: Bdale Garbee <bdale@gag.com>
Changed-By: Bdale Garbee <bdale@gag.com>
Description: 
 sudo       - Provide limited super user privileges to specific users
 sudo-ldap  - Provide limited super user privileges to specific users
Closes: 161012 203874 220808 228551 292833 314949 315115 315718 346325 349085 349129 349196 349549 349587 349729 350776 354431
Changes: 
 sudo (1.6.8p12-2) unstable; urgency=low
 .
   * fix typos in init scripts, closes: #346325
   * update to debhelper compat level 5
   * build depend on autotools-dev to ensure config.sub/guess are fresh
   * accept patch from Martin Schulze developed for 1.6.8p7-1.4 in stable, and
     use it here as well.  Thanks to Martin and the debian-security team.
     closes: #349196, #349549, #349587, #349729, #349129, #350776, #349085
     closes: #315115, #315718, #203874
     * Non-maintainer upload by the Security Team
     * Reworked the former patch to limit environment variables from being
       passed through, set env_reset as default instead [sudo.c, env.c,
       sudoers.pod, Bug#342948, CVE-2005-4158]
     * env_reset is now set by default
     * env_reset will preserve only HOME, LOGNAME, PATH, SHELL, TERM,
       DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER
       (in addition to the SUDO_* variables)
     * Rebuild sudoers.man.in from the POD file
     * Added README.Debian
   * patch from Alexander Zangerl to fix duplicated PATH issue, closes: #354431
   * simplify rules file by using more of Makefile, despite having to override
     default directories with more arguments to configure, closes: #292833
   * update sudo man page to reflect use of SECURE_PATH, closes: #228551
   * inconsistencies in sudoers man page resolved, closes: #220808, #161012
   * patch from Jeroen van Wolffelaar to improve behavior when FQDNs are
     unresolveable (requires adding bison as build dep), closes: #314949
Files: 
 73d77951ae86e88e906d28d0f94abb33 615 admin optional sudo_1.6.8p12-2.dsc
 b3205e53c871e64824c6b338c9fa8a35 33108 admin optional sudo_1.6.8p12-2.diff.gz
 22698e7f33a3f7179ec3ab59d24e4fec 161506 admin optional sudo_1.6.8p12-2_i386.deb
 d2418ccc65a98154b15c7b3c1342462b 173910 admin optional sudo-ldap_1.6.8p12-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEMEhZZKfAp/LPAagRAkw0AJwJq5L7amKiN48J0ldHRH3Sv29yFACbBi1b
LP3jMinYQ8qNMfE81BL1G9U=
=NSf8
-----END PGP SIGNATURE-----




Reply sent to Bdale Garbee <bdale@gag.com>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Berend Reitsma <breitsma@gmail.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #60 received at 349549-close@bugs.debian.org (full text, mbox):

From: Bdale Garbee <bdale@gag.com>
To: 349549-close@bugs.debian.org
Subject: Bug#349549: fixed in sudo 1.6.8p12-2
Date: Sun, 02 Apr 2006 15:02:19 -0700
Source: sudo
Source-Version: 1.6.8p12-2

We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive:

sudo-ldap_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo-ldap_1.6.8p12-2_i386.deb
sudo_1.6.8p12-2.diff.gz
  to pool/main/s/sudo/sudo_1.6.8p12-2.diff.gz
sudo_1.6.8p12-2.dsc
  to pool/main/s/sudo/sudo_1.6.8p12-2.dsc
sudo_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo_1.6.8p12-2_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 349549@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bdale Garbee <bdale@gag.com> (supplier of updated sudo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun,  2 Apr 2006 14:26:20 -0700
Source: sudo
Binary: sudo-ldap sudo
Architecture: source i386
Version: 1.6.8p12-2
Distribution: unstable
Urgency: low
Maintainer: Bdale Garbee <bdale@gag.com>
Changed-By: Bdale Garbee <bdale@gag.com>
Description: 
 sudo       - Provide limited super user privileges to specific users
 sudo-ldap  - Provide limited super user privileges to specific users
Closes: 161012 203874 220808 228551 292833 314949 315115 315718 346325 349085 349129 349196 349549 349587 349729 350776 354431
Changes: 
 sudo (1.6.8p12-2) unstable; urgency=low
 .
   * fix typos in init scripts, closes: #346325
   * update to debhelper compat level 5
   * build depend on autotools-dev to ensure config.sub/guess are fresh
   * accept patch from Martin Schulze developed for 1.6.8p7-1.4 in stable, and
     use it here as well.  Thanks to Martin and the debian-security team.
     closes: #349196, #349549, #349587, #349729, #349129, #350776, #349085
     closes: #315115, #315718, #203874
     * Non-maintainer upload by the Security Team
     * Reworked the former patch to limit environment variables from being
       passed through, set env_reset as default instead [sudo.c, env.c,
       sudoers.pod, Bug#342948, CVE-2005-4158]
     * env_reset is now set by default
     * env_reset will preserve only HOME, LOGNAME, PATH, SHELL, TERM,
       DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER
       (in addition to the SUDO_* variables)
     * Rebuild sudoers.man.in from the POD file
     * Added README.Debian
   * patch from Alexander Zangerl to fix duplicated PATH issue, closes: #354431
   * simplify rules file by using more of Makefile, despite having to override
     default directories with more arguments to configure, closes: #292833
   * update sudo man page to reflect use of SECURE_PATH, closes: #228551
   * inconsistencies in sudoers man page resolved, closes: #220808, #161012
   * patch from Jeroen van Wolffelaar to improve behavior when FQDNs are
     unresolveable (requires adding bison as build dep), closes: #314949
Files: 
 73d77951ae86e88e906d28d0f94abb33 615 admin optional sudo_1.6.8p12-2.dsc
 b3205e53c871e64824c6b338c9fa8a35 33108 admin optional sudo_1.6.8p12-2.diff.gz
 22698e7f33a3f7179ec3ab59d24e4fec 161506 admin optional sudo_1.6.8p12-2_i386.deb
 d2418ccc65a98154b15c7b3c1342462b 173910 admin optional sudo-ldap_1.6.8p12-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEMEhZZKfAp/LPAagRAkw0AJwJq5L7amKiN48J0ldHRH3Sv29yFACbBi1b
LP3jMinYQ8qNMfE81BL1G9U=
=NSf8
-----END PGP SIGNATURE-----




Reply sent to Bdale Garbee <bdale@gag.com>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Berend Reitsma <breitsma@gmail.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #65 received at 349587-close@bugs.debian.org (full text, mbox):

From: Bdale Garbee <bdale@gag.com>
To: 349587-close@bugs.debian.org
Subject: Bug#349587: fixed in sudo 1.6.8p12-2
Date: Sun, 02 Apr 2006 15:02:19 -0700
Source: sudo
Source-Version: 1.6.8p12-2

We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive:

sudo-ldap_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo-ldap_1.6.8p12-2_i386.deb
sudo_1.6.8p12-2.diff.gz
  to pool/main/s/sudo/sudo_1.6.8p12-2.diff.gz
sudo_1.6.8p12-2.dsc
  to pool/main/s/sudo/sudo_1.6.8p12-2.dsc
sudo_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo_1.6.8p12-2_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 349587@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bdale Garbee <bdale@gag.com> (supplier of updated sudo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun,  2 Apr 2006 14:26:20 -0700
Source: sudo
Binary: sudo-ldap sudo
Architecture: source i386
Version: 1.6.8p12-2
Distribution: unstable
Urgency: low
Maintainer: Bdale Garbee <bdale@gag.com>
Changed-By: Bdale Garbee <bdale@gag.com>
Description: 
 sudo       - Provide limited super user privileges to specific users
 sudo-ldap  - Provide limited super user privileges to specific users
Closes: 161012 203874 220808 228551 292833 314949 315115 315718 346325 349085 349129 349196 349549 349587 349729 350776 354431
Changes: 
 sudo (1.6.8p12-2) unstable; urgency=low
 .
   * fix typos in init scripts, closes: #346325
   * update to debhelper compat level 5
   * build depend on autotools-dev to ensure config.sub/guess are fresh
   * accept patch from Martin Schulze developed for 1.6.8p7-1.4 in stable, and
     use it here as well.  Thanks to Martin and the debian-security team.
     closes: #349196, #349549, #349587, #349729, #349129, #350776, #349085
     closes: #315115, #315718, #203874
     * Non-maintainer upload by the Security Team
     * Reworked the former patch to limit environment variables from being
       passed through, set env_reset as default instead [sudo.c, env.c,
       sudoers.pod, Bug#342948, CVE-2005-4158]
     * env_reset is now set by default
     * env_reset will preserve only HOME, LOGNAME, PATH, SHELL, TERM,
       DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER
       (in addition to the SUDO_* variables)
     * Rebuild sudoers.man.in from the POD file
     * Added README.Debian
   * patch from Alexander Zangerl to fix duplicated PATH issue, closes: #354431
   * simplify rules file by using more of Makefile, despite having to override
     default directories with more arguments to configure, closes: #292833
   * update sudo man page to reflect use of SECURE_PATH, closes: #228551
   * inconsistencies in sudoers man page resolved, closes: #220808, #161012
   * patch from Jeroen van Wolffelaar to improve behavior when FQDNs are
     unresolveable (requires adding bison as build dep), closes: #314949
Files: 
 73d77951ae86e88e906d28d0f94abb33 615 admin optional sudo_1.6.8p12-2.dsc
 b3205e53c871e64824c6b338c9fa8a35 33108 admin optional sudo_1.6.8p12-2.diff.gz
 22698e7f33a3f7179ec3ab59d24e4fec 161506 admin optional sudo_1.6.8p12-2_i386.deb
 d2418ccc65a98154b15c7b3c1342462b 173910 admin optional sudo-ldap_1.6.8p12-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEMEhZZKfAp/LPAagRAkw0AJwJq5L7amKiN48J0ldHRH3Sv29yFACbBi1b
LP3jMinYQ8qNMfE81BL1G9U=
=NSf8
-----END PGP SIGNATURE-----




Reply sent to Bdale Garbee <bdale@gag.com>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Berend Reitsma <breitsma@gmail.com>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #70 received at 349729-close@bugs.debian.org (full text, mbox):

From: Bdale Garbee <bdale@gag.com>
To: 349729-close@bugs.debian.org
Subject: Bug#349729: fixed in sudo 1.6.8p12-2
Date: Sun, 02 Apr 2006 15:02:19 -0700
Source: sudo
Source-Version: 1.6.8p12-2

We believe that the bug you reported is fixed in the latest version of
sudo, which is due to be installed in the Debian FTP archive:

sudo-ldap_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo-ldap_1.6.8p12-2_i386.deb
sudo_1.6.8p12-2.diff.gz
  to pool/main/s/sudo/sudo_1.6.8p12-2.diff.gz
sudo_1.6.8p12-2.dsc
  to pool/main/s/sudo/sudo_1.6.8p12-2.dsc
sudo_1.6.8p12-2_i386.deb
  to pool/main/s/sudo/sudo_1.6.8p12-2_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 349729@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bdale Garbee <bdale@gag.com> (supplier of updated sudo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun,  2 Apr 2006 14:26:20 -0700
Source: sudo
Binary: sudo-ldap sudo
Architecture: source i386
Version: 1.6.8p12-2
Distribution: unstable
Urgency: low
Maintainer: Bdale Garbee <bdale@gag.com>
Changed-By: Bdale Garbee <bdale@gag.com>
Description: 
 sudo       - Provide limited super user privileges to specific users
 sudo-ldap  - Provide limited super user privileges to specific users
Closes: 161012 203874 220808 228551 292833 314949 315115 315718 346325 349085 349129 349196 349549 349587 349729 350776 354431
Changes: 
 sudo (1.6.8p12-2) unstable; urgency=low
 .
   * fix typos in init scripts, closes: #346325
   * update to debhelper compat level 5
   * build depend on autotools-dev to ensure config.sub/guess are fresh
   * accept patch from Martin Schulze developed for 1.6.8p7-1.4 in stable, and
     use it here as well.  Thanks to Martin and the debian-security team.
     closes: #349196, #349549, #349587, #349729, #349129, #350776, #349085
     closes: #315115, #315718, #203874
     * Non-maintainer upload by the Security Team
     * Reworked the former patch to limit environment variables from being
       passed through, set env_reset as default instead [sudo.c, env.c,
       sudoers.pod, Bug#342948, CVE-2005-4158]
     * env_reset is now set by default
     * env_reset will preserve only HOME, LOGNAME, PATH, SHELL, TERM,
       DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER
       (in addition to the SUDO_* variables)
     * Rebuild sudoers.man.in from the POD file
     * Added README.Debian
   * patch from Alexander Zangerl to fix duplicated PATH issue, closes: #354431
   * simplify rules file by using more of Makefile, despite having to override
     default directories with more arguments to configure, closes: #292833
   * update sudo man page to reflect use of SECURE_PATH, closes: #228551
   * inconsistencies in sudoers man page resolved, closes: #220808, #161012
   * patch from Jeroen van Wolffelaar to improve behavior when FQDNs are
     unresolveable (requires adding bison as build dep), closes: #314949
Files: 
 73d77951ae86e88e906d28d0f94abb33 615 admin optional sudo_1.6.8p12-2.dsc
 b3205e53c871e64824c6b338c9fa8a35 33108 admin optional sudo_1.6.8p12-2.diff.gz
 22698e7f33a3f7179ec3ab59d24e4fec 161506 admin optional sudo_1.6.8p12-2_i386.deb
 d2418ccc65a98154b15c7b3c1342462b 173910 admin optional sudo-ldap_1.6.8p12-2_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEMEhZZKfAp/LPAagRAkw0AJwJq5L7amKiN48J0ldHRH3Sv29yFACbBi1b
LP3jMinYQ8qNMfE81BL1G9U=
=NSf8
-----END PGP SIGNATURE-----




Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Cyril Bouthors <cyb@debian.org>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #75 received at 349587@bugs.debian.org (full text, mbox):

From: Cyril Bouthors <cyb@debian.org>
To: control@bugs.debian.org, 349587@bugs.debian.org
Subject: $SSH_AGENT_PID is still not available with sudo -s
Date: Wed, 05 Apr 2006 19:05:07 +0200
[Message part 1 (text/plain, inline)]
reopen 349587
thanks

The bug is still there with sudo 1.6.8p12-2:

cyb@wide:~$ echo $SSH_AGENT_PID
4267
cyb@wide:~$ sudo -s
root@wide:~# echo $SSH_AGENT_PID

root@wide:~#

This makes the ssh client unable to run with sudo. It's useful to open
ssh tunnels on port <1024.
-- 
Cyril Bouthors
[Message part 2 (application/pgp-signature, inline)]

Bug reopened, originator not changed. Request was from Cyril Bouthors <cyb@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Steve Langasek <vorlon@debian.org>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #82 received at 349587@bugs.debian.org (full text, mbox):

From: Steve Langasek <vorlon@debian.org>
To: Cyril Bouthors <cyb@debian.org>, 349587@bugs.debian.org
Subject: Re: Bug#349587: $SSH_AGENT_PID is still not available with sudo -s
Date: Wed, 5 Apr 2006 12:24:35 -0700
[Message part 1 (text/plain, inline)]
clone 349587 -1
unmerge -1
retitle -1 sudo should also preserve the SSH_AGENT_PID variable
severity -1 important
close 349587 1.6.8p12-2
thanks

On Wed, Apr 05, 2006 at 07:05:07PM +0200, Cyril Bouthors wrote:

> The bug is still there with sudo 1.6.8p12-2:
> 
> cyb@wide:~$ echo $SSH_AGENT_PID
> 4267
> cyb@wide:~$ sudo -s
> root@wide:~# echo $SSH_AGENT_PID
> 
> root@wide:~#
> 
> This makes the ssh client unable to run with sudo. It's useful to open
> ssh tunnels on port <1024.

This is not what the bug report you just reopened was about.  That bug
report was about other env variables, and about the fact that the security
update was broken with respect to the documentation and required bizarre
gyrations to get any env vars passed.

Those bugs have all been fixed, which means that you can now export any
other variables you want to with use of env_check in /etc/sudoers; e.g.,

  env_check += SSH_AGENT_PID

wanting SSH_AGENT_PID preserved by default seems like a valid request, but
it is a separate bug and it doesn't seem to me that it warrants the same
severity.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/
[signature.asc (application/pgp-signature, inline)]

Bug marked as fixed in version 1.6.8p12-2, send any further explanations to Berend Reitsma <breitsma@gmail.com> Request was from Steve Langasek <vorlon@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Bdale Garbee <bdale@gag.com>:
Bug#349587; Package sudo. Full text and rfc822 format available.

Acknowledgement sent to Cyril Bouthors <cyb@debian.org>:
Extra info received and forwarded to list. Copy sent to Bdale Garbee <bdale@gag.com>. Full text and rfc822 format available.

Message #89 received at 349587@bugs.debian.org (full text, mbox):

From: Cyril Bouthors <cyb@debian.org>
To: Steve Langasek <vorlon@debian.org>
Cc: 349587@bugs.debian.org
Subject: Re: Bug#349587: $SSH_AGENT_PID is still not available with sudo -s
Date: Sat, 08 Apr 2006 13:31:55 +0200
[Message part 1 (text/plain, inline)]
On  5 Apr 2006, Steve Langasek wrote:

  > env_check += SSH_AGENT_PID

I've put `Defaults env_keep += *' in my /etc/sudoers and it fixed the
bug permanently.

We can consider this as a feature so I don't need anything to be
fixed.

Thanks.
-- 
Cyril Bouthors
[Message part 2 (application/pgp-signature, inline)]

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 25 Jun 2007 01:31:15 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 04:40:09 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.