Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RFE] su: Allow environment variable whitelisting for --login #221

Closed
praiskup opened this issue Sep 14, 2015 · 3 comments
Closed

[RFE] su: Allow environment variable whitelisting for --login #221

praiskup opened this issue Sep 14, 2015 · 3 comments
Labels
TODO We going to think about it ;-)

Comments

@praiskup
Copy link

This would be similar to sudo's feature Defaults env_keep += "ENVNAME" in /etc/sudoers.
@karelzak
Copy link
Collaborator

We already have --preserve-environment, it's now ignored for --login, but maybe we can improve it, and make it usable with --login when a list of env.variables is specified, for example

su --login --preserve-environment=TERM,HOME

@praiskup
Copy link
Author

It would be nice to be able to specify this distro-wide, in particular to help with:
https://bugzilla.redhat.com/show_bug.cgi?id=1262837

@rapgro
Copy link

rapgro commented Jan 8, 2016

👍
This feature could be useful for any display manager with automatic login and avoiding usage of PAM configuration to set environment. Workaround is to use bash_profile.

@kapilhp kapilhp mentioned this issue Aug 9, 2018
Closed
@karelzak karelzak added the TODO We going to think about it ;-) label Aug 9, 2018
karelzak added a commit that referenced this issue Aug 15, 2018
@karelzak
su: add --whitelist-environment
75efef9 
* usable with --login to whitelist specified environment variables

* the list is ignored for the core variables like HOME, SHELL, USER,
  LOGNAME and PATH (su --login always resets these variables)

Note that su(1) requires password and after successful authentication
user has full control over the session, so he can set arbitrary
environment variables. The whitelist makes things more user friendly
only.

The patch removes unnecessary optimization when allocate environ[]. It
seems better to keep all in glibc hands and just reset the environment
array only.

Addresses: #221
Signed-off-by: Karel Zak <kzak@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
TODO We going to think about it ;-)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@karelzak @praiskup @rapgro