Bugzilla – Bug 155
CDPATH variable is not unset
Last modified: 2004-11-16 18:26:15 MST
sudo doesn't unset the CDPATH variable, which leads to possible security problems. It can also cause severe bugs when trying to install, compile or run software with superuser privileges, for instance: - mkinitrd (an sh-script uses cd) - kernel compilation (uses cd to build the list of PCI devices et al) - emacs with auctex (turns into a fork bomb under the most recent Debian version) While these problems also may be said to be issues with each package/program, I think it's only reasonable to expect sudo to take care of CDPATH, since it already takes care of the following, according to SECURITY NOTES in sudo(8): LD_*, _RLD_*, IFS, ENV, BASH_ENV, KRB_CONF, KRBCONFDIR, KRBTKFILE, KRB5_CONFIG, LOCALDOMAIN, RES_OPTIONS, HOSTALIASES, NLSPATH, PATH_LOCALE, TERMINFO, TERMINFO_DIRS and TERMPATH While the reported Platform/OS is PC/Linux, the CDPATH variable is in POSIX, so it should be independent of platform and OS. I don't know of any security exploit in the wild, since I'm not aware of any particular program that depends on this for security. But given how software development works, there's bound to be at least ten. :)
The next release of sudo will strip out CDPATH by default.
With all due respect, I think that version 1.6.8p2, which mentions CDPATH in the release notes and the manual pages, does *not* really unset it :) Is it possible that you missed actually adding CDPATH to the initial_badenv_table[] array in env.c? [roam@snark ~]> whoami roam [roam@snark ~]> sudo whoami root [roam@snark ~]> sudo -K [roam@snark ~]> whoami roam [roam@snark ~]> sudo whoami Password: root [roam@snark ~]> setenv CDPATH /home/roam [roam@snark ~]> printenv | fgrep CDPATH CDPATH=/home/roam [roam@snark ~]> sudo printenv | fgrep CDPATH CDPATH=/home/roam [roam@snark ~]> sudo -V | head -1 Sudo version 1.6.8p2 [root@snark ~]# sudo -V | fgrep PATH Ignore '.' in $PATH TERMPATH PATH_LOCALE NLSPATH [root@snark ~]# A pretty much one-line patch (adding CDPATH to the initial_badenv_table[] array) fixes the problem - CDPATH is no longer set, and is also displayed in the 'sudo -V' output.
Whoops, I mistakenly only applied the bash function diff and not the CDPATH one. I've released 1.6. 8p3 which does include the CDPATH diff as well as a fix for systems where _PATH_VAR_TMP does not include a trailing slash.