Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 910701 - net-misc/openssh-9.3 - ssh_config - SendEnv instructions in gentoo config overwrites user and admin config
Summary: net-misc/openssh-9.3 - ssh_config - SendEnv instructions in gentoo config ove...
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal trivial with 1 vote (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-22 23:41 UTC by bugs.gentoo
Modified: 2023-11-21 22:13 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description bugs.gentoo 2023-07-22 23:41:18 UTC
In ssh_config.d, the file 9999999gentoo.conf contains (exclusively) SendEnv instructions. If a user adds their config into say 123-config.conf, as is intended, then those SendEnv lines will get applied afterwards.

As opposed to most instructions in ssh_config, SendEnv is not "first come first serve", later occurrences are merged into earlier ones.
To quote the man page:
> Multiple environment variables may be separated by
> whitespace or spread across multiple SendEnv directives.
> [...]
> It is possible to clear previously set SendEnv variable
> names by prefixing patterns with -.  The default is not to
> send any environment variables."

9999999gentoo.conf contains "SendEnv LANG LC_ALL [...]", so if I want to not send LC_ALL, I can do so using "SendEnv -LC_ALL". However I have to put that line *after* "SendEnv LC_ALL", or else the latter will overwrite it and send it anyway. As such, there is no way to stop LC_ALL and the other variables mentioned in 9999999gentoo.conf from being sent using my 123-config.conf, I would have to create a second configuration file zzz-config.conf, in which I then could not overwrite other directives set in for example 9999999gentoo-security.conf

I propose to move SendEnv instructions to 0000000gentoo.conf

Further, even that would still not allow a user to not send LC_ALL by setting "SendEnv -LC_ALL" in their ~/.ssh/config, a possible solution might be to import that file a second time after the 0000000gentoo.conf file, say in 0000001gentoo.conf