sudo loses environment variables

HPUX, linux, Solaris, UNIX

Tricky. When a user uses sudo to “su” to another user, certain environment variables will not remain.

From the man page:

Variables that control how dynamic loading and binding is done can be used to subvert the program that sudo runs. To combat this the LD_*, _RLD_*, SHLIB_PATH (HP-UX only), and LIBPATH (AIX only) environment variables are removed from the environment passed on to all commands executed. sudo will also remove the IFS, ENV, BASH_ENV, KRB_CONF, KRBCONFDIR, KRBTKFILE, KRB5_CONFIG, LOCALDOMAIN, RES_OPTIONS, HOSTALIASES, NLSPATH, PATH_LOCALE, TERMINFO, TERMINFO_DIRS and TERMPATH variables as they too can pose a threat. If the TERMCAP variable is set and is a pathname, it too is ignored. Additionally, if the LC_* or LANGUAGE
variables contain the / or % characters, they are ignored. If sudo has been compiled with SecurID support, the VAR_ACE, USR_ACE and DLC_ACE variables are cleared as well. The list of environment variables that sudo clears is contained in the output of sudo -V when run as root.

Share

4 Responses

  1. this is a very interesting enter, tender thanks you on the information. Wretched my english is not the sheer best. do you know if it is practicable to turn this to the spanish language. that would be quite helpfull.

  2. Ken Acosta says:

    Ive book marked this for a later read. Very interesting

  3. updatezZz says:

    I really like your writing style, excellent information, thank you for posting :D .

  4. Good post…

    I saw this really good post today……