Add commented out line to add HOME to env_keep and add a warning

to the note about the HOME change in UPGRADE.

--HG--
branch : 1.7

diff --git a/UPGRADE b/UPGRADE
index 8f98d2f702d38b71b6c512e5de344f4588483ee5..b4ffa7a7330b68dbade1344070bb597fad4a4e5e 100644 (file)
--- a/UPGRADE
+++ b/UPGRADE
@@ -25,6 +25,10 @@ o Upgrading from a version prior to 1.7.4:
         Defaults env_keep += MAIL
     to preserve the old value of MAIL.
 
+    NOTE: preserving HOME has security implications since many programs
+    use when searching for configuration files.  Adding HOME to env_keep
+    may enable a user to run unrestricted commands via sudo.
+
 o Upgrading from a version prior to 1.7.0:
 
     Starting with sudo 1.7.0, comments in the sudoers file must not

diff --git a/sudoers b/sudoers
index 01d127f66ee85ce1da234ff48bcf435f5df186ca..183649f944136a7ccde9daaa46dcf9f570e0b1a9 100644 (file)
--- a/sudoers
+++ b/sudoers
@@ -37,6 +37,11 @@
 ## Locale settings
 # Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
 ##
+## Run X applications through sudo; HOME is used to find the
+## .Xauthority file.  Note that other programs use HOME to find   
+## configuration files and this may lead to privilege escalation!
+# Defaults env_keep += "HOME"
+##
 ## X11 resource path settings
 # Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
 ##

diff --git a/sudoers.pod b/sudoers.pod
index 1a5ab483b0398b8df16b8bc8e7eb879a1372acd6..7e1c1737b5f94805d7b98fd79a2a41266340abd2 100644 (file)
--- a/sudoers.pod
+++ b/sudoers.pod
@@ -1365,10 +1365,10 @@ Below are example I<sudoers> entries.  Admittedly, some of
 these are a bit contrived.  First, we allow a few environment
 variables to pass and then define our I<aliases>:
 
- # Run X applications through sudo; HOME is used to find .Xauthority file
- # Note that some programs may use HOME for other purposes too and
- # this may lead to privilege escalation!
- Defaults env_keep = "DISPLAY HOME"
+ # Run X applications through sudo; HOME is used to find the
+ # .Xauthority file.  Note that other programs use HOME to find
+ # configuration files and this may lead to privilege escalation!
+ Defaults env_keep += "DISPLAY HOME"
 
  # User alias specification
  User_Alias    FULLTIMERS = millert, mikef, dowdy