Don't describe env_editor as a security hole.

Users that are able to edit sudoers can grant themselves permissions
so the fact that visudo runs the editor as root is not a security issue.

diff --git a/INSTALL b/INSTALL
index b8f9be6d5a928bf87ad5e240873eeabae589a058..cf3b45201a4d697e6609fcace3f605194ad1ac2a 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -670,18 +670,19 @@ Options that set runtime-changeable default values:
   --with-editor=PATH
        Specify the default editor path for use by visudo.  This may be a
        single path name or a colon-separated list of editors.  In the latter
-       case, visudo will choose the editor that matches the user's VISUAL
-       or EDITOR environment variables or the first editor in the list that
-       exists.  The default is the path to vi on your system.
+       case, visudo will choose the editor that matches the user's SUDO_EDITOR,
+       VISUAL or EDITOR environment variable, or the first editor in the list
+       that exists.  The default is the path to vi on your system.
        Sudoers option: editor
 
   --with-env-editor
-       Makes visudo consult the VISUAL and EDITOR environment variables before
-       falling back on the default editor list (as specified by --with-editor).
-       Note that this may create a security hole as it allows the user to
-       run any arbitrary command as root without logging.  A safer alternative
-       is to use a colon-separated list of editors with the --with-editor
-       option.  visudo will then only use the VISUAL or EDITOR variables
+       Makes visudo consult the SUDO_EDITOR, VISUAL and EDITOR environment
+       variables before falling back on the default editor list (as specified
+       by --with-editor).  Note that visudo is typically run as root so this
+       option may allow a user with visudo privileges to run arbitrary
+       commands as root without logging.  An alternative is to use a
+       colon-separated list of "safe" editors with the --with-editor option.
+       visudo will then only use the SUDO_EDITOR, VISUAL or EDITOR variables
        if they match a value specified via --with-editor.
        Sudoers option: env_editor
 

diff --git a/doc/sudoers.cat b/doc/sudoers.cat
index 751ec09e4d2cabe087f9c8a00c55566b366c7804..77c69dbfe36309a8b13935c139883d1f53f578de 100644 (file)
--- a/doc/sudoers.cat
+++ b/doc/sudoers.cat
@@ -1040,17 +1040,18 @@ S\bSU\bUD\bDO\bOE\bER\bRS\bS O\bOP\bPT\bTI\bIO\bON\bNS\bS
 
      env_editor        If set, v\bvi\bis\bsu\bud\bdo\bo will use the value of the SUDO_EDITOR,
                        VISUAL or EDITOR environment variables before falling
-                       back on the default editor list.  Note that this may
-                       create a security hole as it allows the user to run any
-                       arbitrary command as root without logging.  A safer
-                       alternative is to place a colon-separated list of
-                       editors in the _\be_\bd_\bi_\bt_\bo_\br variable.  v\bvi\bis\bsu\bud\bdo\bo will then only
-                       use SUDO_EDITOR, VISUAL or EDITOR if they match a value
-                       specified in _\be_\bd_\bi_\bt_\bo_\br.  If the _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt flag is enabled,
-                       the SUDO_EDITOR, VISUAL and/or EDITOR environment
-                       variables must be present in the _\be_\bn_\bv_\b__\bk_\be_\be_\bp list for the
-                       _\be_\bn_\bv_\b__\be_\bd_\bi_\bt_\bo_\br flag to function when v\bvi\bis\bsu\bud\bdo\bo is invoked via
-                       s\bsu\bud\bdo\bo.  This flag is _\bo_\bf_\bf by default.
+                       back on the default editor list.  Note that v\bvi\bis\bsu\bud\bdo\bo is
+                       typically run as root so this option may allow a user
+                       with v\bvi\bis\bsu\bud\bdo\bo privileges to run arbitrary commands as
+                       root without logging.  An alternative is to place a
+                       colon-separated list of "safe" editors int the _\be_\bd_\bi_\bt_\bo_\br
+                       variable.  v\bvi\bis\bsu\bud\bdo\bo will then only use SUDO_EDITOR,
+                       VISUAL or EDITOR if they match a value specified in
+                       _\be_\bd_\bi_\bt_\bo_\br.  If the _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt flag is enabled, the
+                       SUDO_EDITOR, VISUAL and/or EDITOR environment variables
+                       must be present in the _\be_\bn_\bv_\b__\bk_\be_\be_\bp list for the _\be_\bn_\bv_\b__\be_\bd_\bi_\bt_\bo_\br
+                       flag to function when v\bvi\bis\bsu\bud\bdo\bo is invoked via s\bsu\bud\bdo\bo.  This
+                       flag is _\bo_\bf_\bf by default.
 
      env_reset         If set, s\bsu\bud\bdo\bo will run the command in a minimal
                        environment containing the TERM, PATH, HOME, MAIL,

diff --git a/doc/sudoers.man.in b/doc/sudoers.man.in
index fcc7ddb54b71952507df5fd78aea67efe8a7494d..af400a2371afab3a712a415f4e36ecaa73bb4a0e 100644 (file)
--- a/doc/sudoers.man.in
+++ b/doc/sudoers.man.in
@@ -2236,10 +2236,14 @@ will use the value of the
 or
 \fREDITOR\fR
 environment variables before falling back on the default editor list.
-Note that this may create a security hole as it allows the user to
-run any arbitrary command as root without logging.
-A safer alternative is to place a colon-separated list of editors
-in the
+Note that
+\fBvisudo\fR
+is typically run as root so this option may allow a user with
+\fBvisudo\fR
+privileges to run arbitrary commands as root without logging.
+An alternative is to place a colon-separated list of
+\(lqsafe\(rq
+editors int the
 \fIeditor\fR
 variable.
 \fBvisudo\fR

diff --git a/doc/sudoers.mdoc.in b/doc/sudoers.mdoc.in
index 8c4e23c08c9bfb94888e8870f1b9920c78ba3442..114399d6f074c4843500c34961b4e5ded94ce326 100644 (file)
--- a/doc/sudoers.mdoc.in
+++ b/doc/sudoers.mdoc.in
@@ -2101,10 +2101,14 @@ will use the value of the
 or
 .Ev EDITOR
 environment variables before falling back on the default editor list.
-Note that this may create a security hole as it allows the user to
-run any arbitrary command as root without logging.
-A safer alternative is to place a colon-separated list of editors
-in the
+Note that
+.Nm visudo
+is typically run as root so this option may allow a user with
+.Nm visudo
+privileges to run arbitrary commands as root without logging.
+An alternative is to place a colon-separated list of
+.Dq safe
+editors int the
 .Em editor
 variable.
 .Nm visudo

diff --git a/doc/visudo.cat b/doc/visudo.cat
index cd587c400b2d68efb7d5f4cf1cf9df18e35c7a61..8fe04449625d46f4785e8b87fbaf73541a748792 100644 (file)
--- a/doc/visudo.cat
+++ b/doc/visudo.cat
@@ -41,17 +41,17 @@ D\bDE\bES\bSC\bCR\bRI\bIP\bPT\bTI\bIO\bON\bN
      env_editor
                If set, v\bvi\bis\bsu\bud\bdo\bo will use the value of the SUDO_EDITOR, VISUAL or
                EDITOR environment variables before falling back on the default
-               editor list.  Note that this may create a security hole as it
-               allows the user to run any arbitrary command as root without
-               logging.  A safer alternative is to place a colon-separated
-               list of editors in the _\be_\bd_\bi_\bt_\bo_\br variable.  v\bvi\bis\bsu\bud\bdo\bo will then only
-               use SUDO_EDITOR, VISUAL or EDITOR if they match a value
-               specified in _\be_\bd_\bi_\bt_\bo_\br.  If the _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt flag is enabled, the
-               SUDO_EDITOR, VISUAL and/or EDITOR environment variables must be
-               present in the _\be_\bn_\bv_\b__\bk_\be_\be_\bp list for the _\be_\bn_\bv_\b__\be_\bd_\bi_\bt_\bo_\br flag to
-               function when v\bvi\bis\bsu\bud\bdo\bo is invoked via s\bsu\bud\bdo\bo.  The default value is
-               _\bo_\bf_\bf, which can be set at compile time via the --with-env-editor
-               configure option.
+               editor list.  Note that v\bvi\bis\bsu\bud\bdo\bo is typically run as root so this
+               option may allow a user with v\bvi\bis\bsu\bud\bdo\bo privileges to run arbitrary
+               commands as root without logging.  An alternative is to place a
+               colon-separated list of "safe" editors int the _\be_\bd_\bi_\bt_\bo_\br variable.
+               v\bvi\bis\bsu\bud\bdo\bo will then only use SUDO_EDITOR, VISUAL or EDITOR if they
+               match a value specified in _\be_\bd_\bi_\bt_\bo_\br.  If the _\be_\bn_\bv_\b__\br_\be_\bs_\be_\bt flag is
+               enabled, the SUDO_EDITOR, VISUAL and/or EDITOR environment
+               variables must be present in the _\be_\bn_\bv_\b__\bk_\be_\be_\bp list for the
+               _\be_\bn_\bv_\b__\be_\bd_\bi_\bt_\bo_\br flag to function when v\bvi\bis\bsu\bud\bdo\bo is invoked via s\bsu\bud\bdo\bo.
+               The default value is _\bo_\bf_\bf, which can be set at compile time via
+               the --with-env-editor configure option.
 
      The options are as follows:
 

diff --git a/doc/visudo.man.in b/doc/visudo.man.in
index 9bdc2197967e07919e28d93c59c01f1cecb5b8a8..f04ff36a4667f99a8c582a78baba6767a14b350a 100644 (file)
--- a/doc/visudo.man.in
+++ b/doc/visudo.man.in
@@ -130,10 +130,14 @@ will use the value of the
 or
 \fREDITOR\fR
 environment variables before falling back on the default editor list.
-Note that this may create a security hole as it allows the user to
-run any arbitrary command as root without logging.
-A safer alternative is to place a colon-separated list of editors
-in the
+Note that
+\fBvisudo\fR
+is typically run as root so this option may allow a user with
+\fBvisudo\fR
+privileges to run arbitrary commands as root without logging.
+An alternative is to place a colon-separated list of
+\(lqsafe\(rq
+editors int the
 \fIeditor\fR
 variable.
 \fBvisudo\fR

diff --git a/doc/visudo.mdoc.in b/doc/visudo.mdoc.in
index 20e5d63266844a316ab97e59a0d31b728342f004..059dc7b37932061271862c0ab8256250b6a55b3f 100644 (file)
--- a/doc/visudo.mdoc.in
+++ b/doc/visudo.mdoc.in
@@ -127,10 +127,14 @@ will use the value of the
 or
 .Ev EDITOR
 environment variables before falling back on the default editor list.
-Note that this may create a security hole as it allows the user to
-run any arbitrary command as root without logging.
-A safer alternative is to place a colon-separated list of editors
-in the
+Note that
+.Nm visudo
+is typically run as root so this option may allow a user with
+.Nm visudo
+privileges to run arbitrary commands as root without logging.
+An alternative is to place a colon-separated list of
+.Dq safe
+editors int the
 .Em editor
 variable.
 .Nm