From: Brian Candler <b.candler@...>
Date: 2010-08-03T18:32:51+09:00
Subject: Re: ENV['someapp']" is nil when the code is run with "sudo"

Esen Sagynov wrote:
> I have read the manual and see that env_reset is set to ON by default, 
> which means all users who will download my gem and try to install will 
> not succeed.
> 
> Is there anything you could suggest me to solve this problem?

Sure: you can configure sudo to keep specific environment variables, 
when running specific commands. Since you are allowing your users to run 
code as root, then you need to be very sure that they cannot abuse these 
environment variables to escalate privileges further.

If the specific problem is with installing a gem, and you don't want 
people to have to tweak their sudoers files, then I think you'd be 
better off asking on a gem-specific mailing list. I don't know if you 
can control which parts of the installation are run under sudo, and 
which are not.

> The other thing is I have seen so many gem which have their main 
> extconf.rb Ruby code which request ENV['...'] variables like PATH, and 
> others. How do they get the variables if sudo resets them by default?

sudo resets PATH to a safe value. It is very easy to escalate privileges 
if you can set PATH to a chosen value whilst running a suid root 
application. It's the same reason why other environment variables are 
cleared; if you're using sudo to run an app which wasn't intended to be 
run by an untrusted user, it's too easy to abuse if the user can set 
arbitrary environment variables.
-- 
Posted via http://www.ruby-forum.com/.