Bug 872740

Summary: SPACE INVADES SUDO!
Product: Red Hat Enterprise Linux 6 Reporter: seth vidal <svidal>
Component: sudoAssignee: Daniel Kopeček <dkopecek>
Status: CLOSED ERRATA QA Contact: Aleš Mareček <amarecek>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.3CC: amarecek, ksrot, pvrabec, tcallawa, tlavigne
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sudo-1.8.6p3-5.el6 Doc Type: Bug Fix
Doc Text:
Cause: Spaces in the command arguments are not being escaped before passing them to the specified command. Consequence: Wrong arguments passed to the specified command. Fix: Rebase to new upstream version where the escaping of command arguments is done correctly again. Result: Command arguments specified on the command line are passed to the command as expected.
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-02-21 09:44:53 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description seth vidal 2012-11-02 21:09:46 UTC
Description of problem:
When you use sudo -i and you pass in a command w/arguments that include spaces the wrong arguments are passed to the command b/c the spaces are not escaped.


Version-Release number of selected component (if applicable):
sudo-1.7.4p5-13.el6_3.x86_64


How reproducible:
to test try this:
sudo -i -- python -c 'import sys; print sys.argv'

on a rhel6 system it will output:


 File "<string>", line 1
    import
         ^
SyntaxError: invalid syntax



On fedora 16, 17, or 18 you can do the same command
and get back:

sudo -i -- python -c 'import sys; print sys.argv'
['-c']


I've narrowed it down to being related to this patch:
http://www.sudo.ws/repos/sudo/rev/4c88da5fc510
However I patched and rebuilt the sudo srpm from rhel6 with this patch and it just ended up segfaulting :( So I clearly missed something else important in the change set between 1.7.4 and 1.7.7.

However, I rebuild 1.8.6p3 from fedora18 in mock for rhel6 and the resulting pkg (which built perfectly) works as expected.

Comment 2 Daniel Kopeček 2012-11-05 12:20:25 UTC
We are rebasing to 1.8.6p3 in rhel-6.4 so this is going to be fixed.

Comment 9 errata-xmlrpc 2013-02-21 09:44:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0363.html