17
3
I'm running into the following error trying to allow some environment variables to pass through to the new environment when running sudo
:
sudo: sorry, you are not allowed to preserve the environment
Some information that may be helpful to debug:
[deploy@worker1 ~]$ sudo -l
Matching Defaults entries for deploy on this host:
requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin, env_keep+="GIT_WORK_TREE GIT_DIR", !requiretty
User deploy may run the following commands on this host:
(ALL) NOPASSWD: /usr/bin/git, (ALL) /etc/init.d/httpd*, (ALL) /sbin/service, (ALL) /usr/bin/make, (ALL) /bin/echo
My running example:
[deploy@worker1 ~]$ export GIT_DIR="/home/ashinn/testing"
[deploy@worker1 ~]$ sudo -E sh -c 'echo "$GIT_DIR"'
sudo: sorry, you are not allowed to preserve the environment
My sudoers.d file for this specific configuration:
Defaults:deploy env_keep += "GIT_WORK_TREE GIT_DIR", !requiretty
deploy ALL=(ALL) NOPASSWD: /usr/bin/git, /etc/init.d/httpd*, /sbin/service, /usr/bin/make, /bin/echo
I've also tried adding !env_reset
to the Defaults and it still fails with the same error. I feel like I may be missing something obvious and need a second set of eyes. What am I missing here?
1I believe that approximately 93% of us understand the point of your question, but your example command isn't very good.
sudo
(option(s))
echo $GIT_DIR
, if it doesn't fail outright, will display the pre-sudo
value of$GIT_DIR
, because the shell expands the variable in the command line beforesudo
is even invoked. Better tests aresudo printenv GIT_DIR
orsudo env | grep GIT_DIR
orsudo sh -c 'echo "$GIT_DIR"'
, where we're actually looking at the environment of the process that's running privileged. – G-Man Says 'Reinstate Monica' – 2015-11-21T07:00:55.683See also this question on Stack Overflow.
– Franklin Yu – 2018-08-16T00:22:57.250