4 ms·

Maybe it could be more explicit but the reasoning comes from the sudoers manual page[1]: > By default, the env_reset flag is enabled. This causes commands to

Maybe it could be more explicit but the reasoning comes from the sudoers manual page[1]: > By default, the env_reset flag is enabled. This causes commands to be executed with a new, minimal environment. On AIX (and Linux systems without PAM), the environment is initialized with the contents of the /etc/environment file. So if you want to make sure there are no sudo commands relying on PATH or any environmental variable you just delete the /etc/environment or set it empty. Like it says in the post, Ubuntu has the $PATH variable in it, and in other distributions it is just empty. The deletion suggestion is for systems where there is a big degree of control over the system, like embedded distributions built with yocto or custom container images. [1] https://linux.die.net/man/5/sudoers https://linux.die.net/man/5/sudoers

remram 5y ago
sudo relying on the PATH provided by /etc/environment is safe... What isn't is system() relying on the current PATH, provided by the (unprivileged) caller. The author is so very confused. Not a single argument actually in favor of system(), as opposed to execve() which is the alternative mentioned in manuals next to "don't use system".
- ptsneves 5y ago
  execve does not do the same as system at all, as per manual > execve() executes the program referred to by pathname. This causes the program that is currently being run by the calling process to be replaced with a new program The argument in favor of system is that it is a standard C library function. It is clearly in the article: > Better, while we are being pragmatic why not use good old system C stdlib function
  - remram 5y ago
    I meant fork+execve, obviously if you drop execve where system is, it doesn't work the same. You make a good point about it not being standard. Is there no standard way of creating a process from an argument vector, without dealing with the shell?

remram 5y ago

sudo relying on the PATH provided by /etc/environment is safe... What isn't is system() relying on the current PATH, provided by the (unprivileged) caller. The author is so very confused. Not a single argument actually in favor of system(), as opposed to execve() which is the alternative mentioned in manuals next to "don't use system".

ptsneves 5y ago
execve does not do the same as system at all, as per manual > execve() executes the program referred to by pathname. This causes the program that is currently being run by the calling process to be replaced with a new program The argument in favor of system is that it is a standard C library function. It is clearly in the article: > Better, while we are being pragmatic why not use good old system C stdlib function
- remram 5y ago
  I meant fork+execve, obviously if you drop execve where system is, it doesn't work the same. You make a good point about it not being standard. Is there no standard way of creating a process from an argument vector, without dealing with the shell?