Tomas Mraz pointed out that pam_namespace PAM module executes external namespace.init script with an environment settings inherited form the program or service that has pam_namespace configured. Such environment may be untrusted in some cases (when running setuid program that does not sanitize environment prior to calling PAM), and may allow local user to escalate privileges.
Testing instructions: 1. add line: /var/tmp /var/tmp-inst/ user ~root to /etc/security/namespace.conf 2. add line: session optional pam_namespace.so to /etc/pam.d/sudo 3. add line /usr/bin/printenv to be executed in the /etc/security/namespace.init 4. add a command such as /usr/bin/id to be allowed in sudoers: testuser ALL=(ALL) /usr/bin/id 5. run sudo /usr/bin/id as testuser and observe that the current environment of the calling user is printed - you can for example augment the PATH to anything you like.
Public now via upstream CVS commit: http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/modules/pam_namespace/pam_namespace.c?view=log#rev1.13
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2010:0819 https://rhn.redhat.com/errata/RHSA-2010-0819.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2010:0891 https://rhn.redhat.com/errata/RHSA-2010-0891.html