Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

10
  • @BinaryZebra - Yes I know about env_delete, but I agree the crux of the problem is that the default behavior of env_reset ...causes commands to be executed with a new, minimal environment. We have a linux system with PAM, so according to the man page, The new environment contains the ... SHELL ... (variable). As you can see from my /etc/sudoers file above, we do not allow SHELL in the env_keep. So SHELL should not be preserved; we should have the root user's SHELL. Commented Oct 6, 2015 at 14:33
  • @BinaryZebra - I have added zabbix ALL=(root) NOPASSWD: /bin/env SHELL=/bin/sh /tmp/doit * to my /etc/sudoers/zabbix file, and it has a proper shell. Thanks, I now have a workaround. The question is, why did I need to include it? It seems dangerous (and broken) to pass the caller's SHELL but I can find no place where sudo is set to modify it. I have run find /etc/sudoers /etc/sysconfig -type f -exec grep env_ {} \; and I find no red flags; /etc/sudoers contains the only env_ string. So I don't think there is a sudoers flag interfering... Commented Oct 6, 2015 at 14:50
  • Mike: On a first level: A simple sudo bash should start a bash shell as root and it MUST have the SHELL variable set to the value from /etc/password. You report that SHELL is being set to (or preserved as) /sbin/nologin. That is a security issue, the shell started by root must not be controlled by an environment variable set by an user. That is something you must investigate. Commented Oct 6, 2015 at 19:14
  • Mike: Second, if this: zabbix ALL=(root) NOPASSWD: /bin/env SHELL=/bin/sh /tmp/doit * works for you, I would not waste more time on this. This is a safe way to set the environment variables. Commented Oct 6, 2015 at 19:15
  • Mike: third: Yes I am as lost as you as who is changing/setting/controling the SHELL variable. I strongly suspect it is PAM, but can not confirm (or negate) yet. Commented Oct 6, 2015 at 19:18