Bug 635250 - sudo -i preserves HOME, breaks expectations, past behaviour, and is inconsistent with man page
Summary: sudo -i preserves HOME, breaks expectations, past behaviour, and is inconsist...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: sudo
Version: 13
Hardware: All
OS: Linux
low
high
Target Milestone: ---
Assignee: Daniel Kopeček
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-09-18 12:01 UTC by Jan Pazdziora (Red Hat)
Modified: 2010-09-23 04:53 UTC (History)
3 users (show)

Fixed In Version: sudo-1.7.4p4-2.fc13
Clone Of:
Environment:
Last Closed: 2010-09-23 04:53:42 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Jan Pazdziora (Red Hat) 2010-09-18 12:01:59 UTC
Description of problem:

When I do sudo -i, the HOME environment variable is not reset to be the home of the new user.

Version-Release number of selected component (if applicable):

sudo-1.7.4p4-1.fc13.i686

How reproducible:

Deterministic.

Steps to Reproduce:
1. Setup /etc/sudoers.d/xxx to allow you to sudo to root.
2. Make sure sudo -i works.
3. Do sudo -i.
4. Run echo $HOME
  
Actual results:

Home of your original user.

Expected results:

/root

Additional info:

There is

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files.
#
# Added for backwards compatibility. See rhbz#614025.
#
Defaults    env_keep += "HOME"
Defaults   !always_set_home

in /etc/sudoers. I believe it was not there in the past. It causes HOME to be kept.

However, that breaks the  documentation which says

       -i [command]
                   The -i (simulate initial login) option runs the shell
                   specified in the passwd(5) entry of the target user as a
                   login shell.  This means that login-specific resource files
                   such as .profile or .login will be read by the shell.  If a
                   command is specified, it is passed to the shell for
                   execution.  Otherwise, an interactive shell is executed.
                   sudo attempts to change to that user’s home directory
                   before running the shell.  It also initializes the
                   environment, leaving DISPLAY and TERM unchanged, setting
                   HOME, MAIL, SHELL, USER, LOGNAME, and PATH, as well as the
                   contents of /etc/environment on Linux and AIX systems.  All
                   other environment variables are removed.

and

       HOME            Set to the home directory of the target user if -i or
                       -H are specified, env_reset or always_set_home are set
                       in sudoers, or when the -s option is specified and
                       set_home is set in sudoers

Comment 1 Jan Pazdziora (Red Hat) 2010-09-18 12:02:51 UTC
I'm pretty sure this was not happening earlier, so marking as Regression.

Comment 2 Jan Pazdziora (Red Hat) 2010-09-18 12:06:44 UTC
I was able to get the correct behaviour with

# cat /etc/sudoers.d/always_set_home 
Defaults env_keep -= "HOME"

but I really should not be forced to do that to get the correct behaviour.

I've tried

Defaults always_set_home
Defaults env_reset

but that did not  help -- so I believe that the

Defaults    env_keep += "HOME"

line in /etc/sudoers is the main cause of the troubles.

Comment 3 Jan Pazdziora (Red Hat) 2010-09-18 12:09:27 UTC
Bug 614025 and bug 619293 are likely to be related.

Please note that whatever resolution is going to be the default behaviour for sudo in general, this bugzilla is explicitly for sudo with option -i, where IMO the HOME needs to remain being reset, it for nothing else, to remain compliant with the man page.

Comment 4 Peter Vrabec 2010-09-18 12:33:54 UTC
This thread:

http://www.sudo.ws/pipermail/sudo-users/2010-September/004478.html

might be helpful. It seems the issue was introduced by upstream.

Comment 5 Fedora Update System 2010-09-20 06:52:42 UTC
sudo-1.7.4p4-2.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/sudo-1.7.4p4-2.fc13

Comment 6 Fedora Update System 2010-09-21 01:39:06 UTC
sudo-1.7.4p4-2.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update sudo'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/sudo-1.7.4p4-2.fc13

Comment 7 Jan Pazdziora (Red Hat) 2010-09-21 05:54:26 UTC
It's working for me. Marking as VERIFIED.

Comment 8 Fedora Update System 2010-09-23 04:53:38 UTC
sudo-1.7.4p4-2.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.