isa/sudo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make the env_reset descriptions consistent.

Browse Source
This commit is contained in:
Todd C. Miller
2011-11-23 10:42:32 -05:00
parent 1b9f2cdbc6
commit e43b726e96
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
doc/sudoers.pod
View File

@@ -89,11 +89,11 @@ environment are inherited by the command to be run. There are two
distinct ways I<sudoers> can deal with environment variables. distinct ways I<sudoers> can deal with environment variables.
By default, the I<env_reset> option is enabled. This causes commands By default, the I<env_reset> option is enabled. This causes commands
to be executed with a minimal environment containing C<TERM>, to be executed with a minimal environment containing the C<TERM>,
C<PATH>, C<HOME>, C<MAIL>, C<SHELL>, C<LOGNAME>, C<USER> and C<USERNAME> in C<PATH>, C<HOME>, C<MAIL>, C<SHELL>, C<LOGNAME>, C<USER>, C<USERNAME>
addition to variables from the invoking process permitted by the and C<SUDO_*> variables in addition to variables from the
I<env_check> and I<env_keep> options. This is effectively a whitelist invoking process permitted by the I<env_check> and I<env_keep>
for environment variables. options. This is effectively a whitelist for environment variables.
If, however, the I<env_reset> option is disabled, any variables not If, however, the I<env_reset> option is disabled, any variables not
explicitly denied by the I<env_check> and I<env_delete> options are explicitly denied by the I<env_check> and I<env_delete> options are
@@ -123,6 +123,9 @@ and I<LOGNAME> are set based on the target user. On Linux and AIX
systems the contents of F</etc/environment> are also included. All systems the contents of F</etc/environment> are also included. All
other environment variables are removed. other environment variables are removed.
Lastly, if the I<env_file> option is defined, any variables present
in that file will be set to their specified values.
=head1 SUDOERS FILE FORMAT =head1 SUDOERS FILE FORMAT
The I<sudoers> file is composed of two types of entries: aliases The I<sudoers> file is composed of two types of entries: aliases
@@ -783,14 +786,17 @@ default.
=item env_reset =item env_reset
If set, B<sudo> will reset the environment to only contain the If set, B<sudo> will run the command in a minimal environment
LOGNAME, MAIL, SHELL, USER, USERNAME and the C<SUDO_*> variables. Any containing the C<TERM>, C<PATH>, C<HOME>, C<MAIL>, C<SHELL>,
C<LOGNAME>, C<USER>, C<USERNAME> and C<SUDO_*> variables. Any
variables in the caller's environment that match the C<env_keep> variables in the caller's environment that match the C<env_keep>
and C<env_check> lists are then added. The default contents of the and C<env_check> lists are then added, followed by any variables
C<env_keep> and C<env_check> lists are displayed when B<sudo> is present in the file specified by the I<env_file> option (if any).
run by root with the I<-V> option. If the I<secure_path> option The default contents of the C<env_keep> and C<env_check> lists are
is set, its value will be used for the C<PATH> environment variable. displayed when B<sudo> is run by root with the I<-V> option. If
This flag is I<@env_reset@> by default. the I<secure_path> option is set, its value will be used for the
C<PATH> environment variable. This flag is I<@env_reset@> by
default.
=item fast_glob =item fast_glob
@@ -1371,7 +1377,7 @@ B<Strings that can be used in a boolean context>:
=item env_file =item env_file
The I<env_file> options specifies the fully qualified path to a The I<env_file> option specifies the fully qualified path to a
file containing variables to be set in the environment of the program file containing variables to be set in the environment of the program
being run. Entries in this file should either be of the form being run. Entries in this file should either be of the form
C<VARIABLE=value> or C<export VARIABLE=value>. The value may C<VARIABLE=value> or C<export VARIABLE=value>. The value may