diff --git a/man/less-variables.xml b/man/less-variables.xml
index 08e513c99f..c52511ca8e 100644
--- a/man/less-variables.xml
+++ b/man/less-variables.xml
@@ -64,6 +64,15 @@
the invoking terminal is determined to be UTF-8 compatible).
+
+ $SYSTEMD_LESSSECURE
+
+ Takes a boolean argument. Overrides the $LESSSECURE environment
+ variable when invoking the pager, which controls the "secure" mode of less (which disables commands
+ such as | which allow to easily shell out to external command lines). By default
+ less secure mode is enabled, with this setting it may be disabled.
+
+
$SYSTEMD_COLORS
diff --git a/man/systemctl.xml b/man/systemctl.xml
index 1c55028837..a3f0c3041a 100644
--- a/man/systemctl.xml
+++ b/man/systemctl.xml
@@ -2240,6 +2240,7 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
+
diff --git a/man/systemd.xml b/man/systemd.xml
index a9040545c2..c92cfef776 100644
--- a/man/systemd.xml
+++ b/man/systemd.xml
@@ -692,6 +692,7 @@
+
diff --git a/src/shared/pager.c b/src/shared/pager.c
index e03be6d23b..9c21881241 100644
--- a/src/shared/pager.c
+++ b/src/shared/pager.c
@@ -9,6 +9,7 @@
#include
#include "copy.h"
+#include "env-util.h"
#include "fd-util.h"
#include "fileio.h"
#include "io-util.h"
@@ -152,8 +153,7 @@ int pager_open(PagerFlags flags) {
_exit(EXIT_FAILURE);
}
- /* Initialize a good charset for less. This is
- * particularly important if we output UTF-8
+ /* Initialize a good charset for less. This is particularly important if we output UTF-8
* characters. */
less_charset = getenv("SYSTEMD_LESSCHARSET");
if (!less_charset && is_locale_utf8())
@@ -164,6 +164,25 @@ int pager_open(PagerFlags flags) {
_exit(EXIT_FAILURE);
}
+ /* People might invoke us from sudo, don't needlessly allow less to be a way to shell out
+ * privileged stuff. */
+ r = getenv_bool("SYSTEMD_LESSSECURE");
+ if (r == 0) { /* Remove env var if off */
+ if (unsetenv("LESSSECURE") < 0) {
+ log_error_errno(errno, "Failed to uset environment variable LESSSECURE: %m");
+ _exit(EXIT_FAILURE);
+ }
+ } else {
+ /* Set env var otherwise */
+ if (r < 0)
+ log_warning_errno(r, "Unable to parse $SYSTEMD_LESSSECURE, ignoring: %m");
+
+ if (setenv("LESSSECURE", "1", 1) < 0) {
+ log_error_errno(errno, "Failed to set environment variable LESSSECURE: %m");
+ _exit(EXIT_FAILURE);
+ }
+ }
+
if (pager_args) {
r = loop_write(exe_name_pipe[1], pager_args[0], strlen(pager_args[0]) + 1, false);
if (r < 0) {