From: Todd C. Miller Date: Mon, 19 Jul 2010 15:08:09 +0000 (-0400) Subject: If env_reset is enabled, set the MAIL environment variable based X-Git-Tag: SUDO_1_7_4~62 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ab29f9d8bd47ec7f46eaafa34117ee4c132043ae;p=sudo If env_reset is enabled, set the MAIL environment variable based on the target user unless MAIL is explicitly preserved in sudoers. --HG-- branch : 1.7 --- diff --git a/WHATSNEW b/WHATSNEW index 91c0938b1..2894f70ea 100644 --- a/WHATSNEW +++ b/WHATSNEW @@ -34,6 +34,10 @@ What's new in Sudo 1.7.4? more than 32 descriptors on SuSE Linux, where sysconf(_SC_CHILD_MAX) will return -1 when RLIMIT_NPROC is set to RLIMIT_UNLIMITED (-1). + * If env_reset is enabled in sudoers (the default), sudo will now set + the MAIL environment variable based on the target user unless MAIL is + explicitly preserved in sudoers. Previously MAIL was passed unchanged. + What's new in Sudo 1.7.3? * Support for logging I/O for the command being run. diff --git a/aclocal.m4 b/aclocal.m4 index 9e6eca8c0..5bbb4ac13 100644 --- a/aclocal.m4 +++ b/aclocal.m4 @@ -109,7 +109,7 @@ if test -z "$timedir"; then for d in /var/db /var/lib /var/adm /usr/adm; do if test -d "$d"; then timedir="$d/sudo" - break; + break fi done fi @@ -345,6 +345,39 @@ AC_DEFUN(SUDO_APPEND_LIBPATH, [ fi ]) +dnl +dnl Determine the mail spool location +dnl NOTE: must be run *after* check for paths.h +dnl +AC_DEFUN(SUDO_MAILDIR, [ +maildir=no +if test X"$ac_cv_header_paths_h" = X"yes"; then +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT +#include +int main() {char *p = _PATH_MAILDIR;}], [])], [maildir=yes], []) +fi +if test $maildir = no; then + # Solaris has maillock.h which defines MAILDIR + AC_CHECK_HEADERS(maillock.h, [ + SUDO_DEFINE(_PATH_MAILDIR, MAILDIR) + maildir=yes + ]) + if test $maildir = no; then + for d in /var/mail /var/spool/mail /usr/spool/mail; do + if test -d "$d"; then + maildir=yes + SUDO_DEFINE_UNQUOTED(_PATH_MAILDIR, "$d") + break + fi + done + if test $maildir = no; then + # unable to find mail dir, hope for the best + SUDO_DEFINE_UNQUOTED(_PATH_MAILDIR, "/var/mail") + fi + fi +fi +]) + dnl dnl private versions of AC_DEFINE and AC_DEFINE_UNQUOTED that don't support dnl tracing that we use to define paths for pathnames.h so autoheader doesn't diff --git a/config.h.in b/config.h.in index eeb444f06..39bd71fd9 100644 --- a/config.h.in +++ b/config.h.in @@ -316,6 +316,9 @@ /* Define to 1 if you have the `lrand48' function. */ #undef HAVE_LRAND48 +/* Define to 1 if you have the header file. */ +#undef HAVE_MAILLOCK_H + /* Define to 1 if you have the header file. */ #undef HAVE_MALLOC_H diff --git a/configure b/configure index 2aeae81bb..0707115ce 100755 --- a/configure +++ b/configure @@ -13873,6 +13873,68 @@ fi done fi + +maildir=no +if test X"$ac_cv_header_paths_h" = X"yes"; then +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ +$ac_includes_default +#include +int main() {char *p = _PATH_MAILDIR;} +int +main () +{ + + ; + return 0; +} +_ACEOF +if ac_fn_c_try_compile "$LINENO"; then : + maildir=yes +fi +rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext +fi +if test $maildir = no; then + # Solaris has maillock.h which defines MAILDIR + for ac_header in maillock.h +do : + ac_fn_c_check_header_mongrel "$LINENO" "maillock.h" "ac_cv_header_maillock_h" "$ac_includes_default" +if test "x$ac_cv_header_maillock_h" = x""yes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_MAILLOCK_H 1 +_ACEOF + + cat >>confdefs.h <<\EOF +#define _PATH_MAILDIR MAILDIR +EOF + + maildir=yes + +fi + +done + + if test $maildir = no; then + for d in /var/mail /var/spool/mail /usr/spool/mail; do + if test -d "$d"; then + maildir=yes + cat >>confdefs.h <>confdefs.h <pw_name); + else + easprintf(&cp, "MAIL=%s/%s", _PATH_MAILDIR, runas_pw->pw_name); + sudo_putenv(cp, ISSET(didvar, DID_MAIL), TRUE); + } } else { /* * Copy environ entries as long as they don't match env_delete or diff --git a/pathnames.h.in b/pathnames.h.in index b3bd537ed..c1d4e9ab6 100644 --- a/pathnames.h.in +++ b/pathnames.h.in @@ -122,6 +122,10 @@ #define _PATH_USRTMP "/usr/tmp/" #endif /* _PATH_USRTMP */ +#ifndef _PATH_MAILDIR +#undef _PATH_MAILDIR +#endif /* _PATH_MAILDIR */ + #ifndef _PATH_SUDO_SESH #undef _PATH_SUDO_SESH #endif /* _PATH_SUDO_SESH */ diff --git a/sudo.cat b/sudo.cat index 951b18278..b9c6a0c88 100644 --- a/sudo.cat +++ b/sudo.cat @@ -61,7 +61,7 @@ DDEESSCCRRIIPPTTIIOONN -1.7.4 July 14, 2010 1 +1.7.4 July 19, 2010 1 @@ -127,7 +127,7 @@ OOPPTTIIOONNSS -1.7.4 July 14, 2010 2 +1.7.4 July 19, 2010 2 @@ -193,7 +193,7 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) -1.7.4 July 14, 2010 3 +1.7.4 July 19, 2010 3 @@ -207,7 +207,7 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) ssuuddoo attempts to change to that user's home directory before running the shell. It also initializes the environment, leaving _D_I_S_P_L_A_Y and _T_E_R_M unchanged, setting - _H_O_M_E, _S_H_E_L_L, _U_S_E_R, _L_O_G_N_A_M_E, and _P_A_T_H, as well as the + _H_O_M_E, _M_A_I_L, _S_H_E_L_L, _U_S_E_R, _L_O_G_N_A_M_E, and _P_A_T_H, as well as the contents of _/_e_t_c_/_e_n_v_i_r_o_n_m_e_n_t on Linux and AIX systems. All other environment variables are removed. @@ -259,7 +259,7 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) -1.7.4 July 14, 2010 4 +1.7.4 July 19, 2010 4 @@ -325,7 +325,7 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) -1.7.4 July 14, 2010 5 +1.7.4 July 19, 2010 5 @@ -391,7 +391,7 @@ SSEECCUURRIITTYY NNOOTTEESS -1.7.4 July 14, 2010 6 +1.7.4 July 19, 2010 6 @@ -457,7 +457,7 @@ SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) -1.7.4 July 14, 2010 7 +1.7.4 July 19, 2010 7 @@ -494,6 +494,9 @@ EENNVVIIRROONNMMEENNTT EDITOR Default editor to use in --ee (sudoedit) mode if neither SUDO_EDITOR nor VISUAL is set + MAIL In --ii mode or when _e_n_v___r_e_s_e_t is enabled in _s_u_d_o_e_r_s, set + to the mail spool of the target user + HOME In --ss or --HH mode (or if sudo was configured with the --enable-shell-sets-home option), set to homedir of the target user @@ -518,12 +521,9 @@ EENNVVIIRROONNMMEENNTT SUDO_PS1 If set, PS1 will be set to its value for the program being run - SUDO_UID Set to the user ID of the user who invoked sudo - - -1.7.4 July 14, 2010 8 +1.7.4 July 19, 2010 8 @@ -532,6 +532,8 @@ EENNVVIIRROONNMMEENNTT SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + SUDO_UID Set to the user ID of the user who invoked sudo + SUDO_USER Set to the login of the user who invoked sudo USER Set to the target user (root unless the --uu option is @@ -584,12 +586,10 @@ EEXXAAMMPPLLEESS SSEEEE AALLSSOO _g_r_e_p(1), _s_u(1), _s_t_a_t(2), _l_o_g_i_n___c_a_p(3), _p_a_s_s_w_d(4), _s_u_d_o_e_r_s(5), - _v_i_s_u_d_o(1m) - -1.7.4 July 14, 2010 9 +1.7.4 July 19, 2010 9 @@ -598,6 +598,8 @@ SSEEEE AALLSSOO SUDO(1m) MAINTENANCE COMMANDS SUDO(1m) + _v_i_s_u_d_o(1m) + AAUUTTHHOORRSS Many people have worked on ssuuddoo over the years; this version consists of code written primarily by: @@ -653,8 +655,6 @@ DDIISSCCLLAAIIMMEERR - - -1.7.4 July 14, 2010 10 +1.7.4 July 19, 2010 10 diff --git a/sudo.man.in b/sudo.man.in index e58aa1d60..1ffea70e0 100644 --- a/sudo.man.in +++ b/sudo.man.in @@ -149,7 +149,7 @@ .\" ======================================================================== .\" .IX Title "SUDO @mansectsu@" -.TH SUDO @mansectsu@ "July 14, 2010" "1.7.4" "MAINTENANCE COMMANDS" +.TH SUDO @mansectsu@ "July 19, 2010" "1.7.4" "MAINTENANCE COMMANDS" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -347,7 +347,7 @@ it is passed to the shell for execution. Otherwise, an interactive shell is executed. \fBsudo\fR attempts to change to that user's home directory before running the shell. It also initializes the environment, leaving \fI\s-1DISPLAY\s0\fR and \fI\s-1TERM\s0\fR unchanged, setting -\&\fI\s-1HOME\s0\fR, \fI\s-1SHELL\s0\fR, \fI\s-1USER\s0\fR, \fI\s-1LOGNAME\s0\fR, and \fI\s-1PATH\s0\fR, as well as +\&\fI\s-1HOME\s0\fR, \fI\s-1MAIL\s0\fR, \fI\s-1SHELL\s0\fR, \fI\s-1USER\s0\fR, \fI\s-1LOGNAME\s0\fR, and \fI\s-1PATH\s0\fR, as well as the contents of \fI/etc/environment\fR on Linux and \s-1AIX\s0 systems. All other environment variables are removed. .IP "\-K" 12 @@ -615,6 +615,11 @@ information, please see the \f(CW\*(C`PREVENTING SHELL ESCAPES\*(C'\fR section i .IX Item "EDITOR" Default editor to use in \fB\-e\fR (sudoedit) mode if neither \f(CW\*(C`SUDO_EDITOR\*(C'\fR nor \f(CW\*(C`VISUAL\*(C'\fR is set +.ie n .IP "\*(C`MAIL\*(C'" 16 +.el .IP "\f(CW\*(C`MAIL\*(C'\fR" 16 +.IX Item "MAIL" +In \fB\-i\fR mode or when \fIenv_reset\fR is enabled in \fIsudoers\fR, set +to the mail spool of the target user .ie n .IP "\*(C`HOME\*(C'" 16 .el .IP "\f(CW\*(C`HOME\*(C'\fR" 16 .IX Item "HOME" diff --git a/sudo.pod b/sudo.pod index 889ef7ebd..c2426a0d8 100644 --- a/sudo.pod +++ b/sudo.pod @@ -230,7 +230,7 @@ it is passed to the shell for execution. Otherwise, an interactive shell is executed. B attempts to change to that user's home directory before running the shell. It also initializes the environment, leaving I and I unchanged, setting -I, I, I, I, and I, as well as +I, I, I, I, I, and I, as well as the contents of F on Linux and AIX systems. All other environment variables are removed. @@ -519,6 +519,11 @@ B utilizes the following environment variables: Default editor to use in B<-e> (sudoedit) mode if neither C nor C is set +=item C + +In B<-i> mode or when I is enabled in I, set +to the mail spool of the target user + =item C In B<-s> or B<-H> mode (or if sudo was configured with the