Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 484132 - app-admin/sudo make secure-path optional
Summary: app-admin/sudo make secure-path optional
Status: RESOLVED WORKSFORME
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-07 20:53 UTC by Mike Gilbert
Modified: 2013-09-13 00:09 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
Add secure-path use flag (use-secure-path.patch,1.51 KB, patch)
2013-09-07 20:53 UTC, Mike Gilbert
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Gilbert gentoo-dev 2013-09-07 20:53:41 UTC
Created attachment 358212 [details, diff]
Add secure-path use flag

We currently force the secure_path option to the value of ROOTPATH at build time.

Attached patch allows this feature to be disabled for those of us that find it annoying. When this is diabled, sudo inherits the PATH setting from the calling environment.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2013-09-07 21:34:25 UTC
By the way, is it possible to drop in new value for PATH in sudoers? If it is, I think we should be rather doing that than hardcoding the value at build-time.
Comment 2 SpanKY gentoo-dev 2013-09-12 20:39:51 UTC
i'm not sure we should bother.  you're going to see this behavior on every system out there that uses sudo.  if you really want to override PATH, the portable solution is to use `env`.

$ sudo env PATH='...your custom PATH...' whatever-program
Comment 3 Mike Gilbert gentoo-dev 2013-09-13 00:09:57 UTC
I somehow missed that this actually can be switched off in the sudoers file. I thought it was a hard-coded value.

Anyway, here's how to disable it, in case someone finds this in a search a few years from now.

Defaults !secure_path