Re: Bug#762839: bash without importing shell functions from the environment
On 2014-09-26 10:33:20 +0200, Josselin Mouette wrote:
> Brian May <brian@microcomaustralia.com.au> wrote:
> No, I don't think that is the case. I believe sudo interprets
> those assignments itself (as also shown in man page), and the
> error I got clearly shows this to be the case.
>
> brian@aquitard:~$ sudo echo='() { /bin/echo bar; id; }'
> ./test.sh
> sudo: sorry, you are not allowed to set the following
> environment variables: echo
>
> My understanding is that sudo doesn't invoke any sort of shell
> unless you expressly tell it to do so.
>
>
> Does it also apply to variables that are part of env_keep in sudo?
> For example if you set TZ, PS1 or XAUTHORITY, which are preserved by
> default.
I'm not sure I understand your question. With CVE-2014-6271 fixed,
there are no problems, except for scripts that invoke TZ, PS1 or
XAUTHORITY as commands. This is rather unlikely, since commands
with uppercase letters are not so common (I just know GET, HEAD,
POST, and X).
--
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
Reply to: