sudo/sudo-1.7.1-secure_path.diff

50 lines
1.2 KiB
Diff

--- env.c
+++ env.c
@@ -688,7 +688,7 @@
}
}
/* Replace the PATH envariable with a secure one? */
- if (def_secure_path && !user_is_exempt()) {
+ if (def_secure_path && !user_is_exempt() && def_env_reset) {
sudo_setenv("PATH", def_secure_path, TRUE);
SET(didvar, DID_PATH);
}
--- find_path.c
+++ find_path.c
@@ -87,7 +87,7 @@
}
/* Use PATH passed in unless SECURE_PATH is in effect. */
- if (def_secure_path && !user_is_exempt())
+ if (def_secure_path && !user_is_exempt() && def_env_reset)
path = def_secure_path;
else if (path == NULL)
return(NOT_FOUND);
--- logging.c
+++ logging.c
@@ -433,7 +433,7 @@
#ifndef NO_ROOT_MAILER
static char *root_envp[] = {
"HOME=/",
- "PATH=/usr/bin:/bin",
+ "PATH=/usr/sbin:/bin:/usr/bin:/sbin",
"LOGNAME=root",
"USERNAME=root",
"USER=root",
--- pathnames.h.in
+++ pathnames.h.in
@@ -41,9 +41,10 @@
#define _PATH_DEVNULL "/dev/null"
#endif /* _PATH_DEVNULL */
-#ifndef _PATH_DEFPATH
-#define _PATH_DEFPATH "/usr/bin:/bin"
-#endif /* _PATH_DEFPATH */
+/*
+ * _PATH_DEFPATH included from <paths.h> contains only "/usr/bin:/bin"
+ */
+#define _PATH_DEFPATH "/usr/sbin:/bin:/usr/bin:/sbin"
#ifndef _PATH_ENVIRONMENT
#define _PATH_ENVIRONMENT "/etc/environment"