Bug 161

Summary:	Sudo clears KRB5CCNAME before doing passwd lookups
Product:	Sudo	Reporter:	Ian Grant <ian.grant>
Component:	Sudo	Assignee:	Todd C. Miller <Todd.Miller>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	normal
Version:	1.6.7
Hardware:	PC
OS:	All

Description Ian Grant 2004-11-17 03:31:58 MST

Sudo clears the environment of all but a few known variables (HOME etc) before
doing user lookups with getpwent etc. This is a problem when something like
nss_ldap is configured for password table lookups using GSSAPI authentication
because the user's credentials may be needed to do the lookup. getXXXent calls
should be done before the environment is cleared.

This is a problem with 1.6.7p5 (as shipped with SuSE 9.2) and I would guess
1.6.8 as well.

Comment 1 Todd C. Miller 2004-11-17 09:17:48 MST

I'm going take the conservative approach and just add KRB5CCNAME to the list of variables 
preserved.