Description of problem:

Due to being one of the few pam stacks that uses pam_rootok.so, /etc/pam.d/su bypasses pam_env when run as root. pam_env is in system-auth as the first entry which is not reached.

This causes variables set in /etc/environment to not be set.

A potential work around would be to either remove 'auth sufficient pam_rootok.so' or to add 'session required pam_env.so'


/etc/pam.d/su

   #%PAM-1.0
   auth		sufficient	pam_rootok.so
   # Uncomment the following line to implicitly trust users in the "wheel" group.
   #auth		sufficient	pam_wheel.so trust use_uid
   # Uncomment the following line to require a user to be in the "wheel" group.
   #auth		required	pam_wheel.so use_uid
   auth		substack	system-auth
   auth		include		postlogin
   account		sufficient	pam_succeed_if.so uid = 0 use_uid quiet
   account		include		system-auth
   password	include		system-auth
   session		include		system-auth
   session		include		postlogin
   session		optional	pam_xauth.so

/etc/pam.d/system-auth

   #%PAM-1.0
   # This file is auto-generated.
   # User changes will be destroyed the next time authconfig is run.
   auth        required      pam_env.so
   auth        sufficient    pam_fprintd.so
   auth        sufficient    pam_unix.so nullok try_first_pass
   auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
   auth        required      pam_deny.so

   account     required      pam_unix.so
   account     sufficient    pam_localuser.so
   account     sufficient    pam_succeed_if.so uid < 1000 quiet
   account     required      pam_permit.so

   password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
   password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
   password    required      pam_deny.so

   session     optional      pam_keyinit.so revoke
   session     required      pam_limits.so
   -session     optional      pam_systemd.so
   session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
   session     required      pam_unix.so


Version-Release number of selected component (if applicable):

  util-linux-2.23.2-59.el7_6.1.x86_64


How reproducible:

  Every time as root


Steps to Reproduce:

  1. Set a variable in /etc/environment
  2. su as root user
  3. note the variables are not set

Actual results:

  /etc/environment variables are not set since pam_env is never reached.


Expected results:

  /etc/environment variables should be set.