Re: su(1) --whitelist-environment

[Karel Zak <kzak@redhat.com>]

On Mon, Aug 13, 2018 at 10:57:01PM +0200, Bernhard Voelker wrote:
> On 08/10/2018 11:06 PM, Bruce Dubbs wrote:
> > I think it is unnecessary.  su itself does not need the environment 
> > variable.  If a user needs a specific setting, then set it in a script:
> > 
> > su --command myscript

The important is to say that reset environment is good, expected and
wanted thing. You want to have full control on environment in many
cases.

> I'm 50:50.  The point was to pass in variables values per environment
> to a process inside 'su' (or 'sudo'), and one can achieve that with e.g.

BTW, sudo has env_check, env_delete, or env_keep to control environment
in the sudoers.

>   $ su -c 'env VAR="val" myscript' user
> 
> Well, this might become slightly trickier with real shell or environment
> variables wrt/ correct shell quoting:
> 
>   $ VAR='some value'
>   $ su -c 'env VAR="'"$VAR"'" myscript' user

Well, probably usable way for scripts, but ugly for users on command line.

All the idea behind the patch is make things more user-friendly

    su -w GREP_COLOR,COLORFGBG - kzak

seems better than assume -c 'env VAR ..."

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com