Your message dated Wed, 8 Aug 2018 22:00:49 +0200
with message-id <[email protected]>
and subject line Re: #434485: better in su from util-linux
has caused the Debian Bug report #434485,
regarding su: environment setting when doing su
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
434485: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=434485
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: login
Version: 1:4.0.18.1-11
Severity: normal
Hello,
Several remarks that are part of the same problem regarding su, pam and
environment setting.
1) If /etc/default/locale is set (or anything in /etc/environment), its
content is read when doing su (no args). I understand that it is read
when doing su -l, and not read when doing su -p. The behaviour when
doing simple su is best described (to my knowledge, which may be wrong)
by the man page:
The current environment is passed to the new shell. The value of $PATH
is reset to /bin:/usr/bin for normal users, or
/sbin:/bin:/usr/sbin:/usr/bin for the superuser. This may be changed
with the ENV_PATH and ENV_SUPATH definitions in /etc/login.defs.
Thus, I expect su to act closer to su -p than su -l.
One of the reason I would prefer this is that terminal charmap is
transported with the LC_CTYPE (or LANG) variable.
2) ENV_SUPATH on a basic etch install is:
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bi
n:/usr/bin/X11
PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games
Probably /usr/bin/X11 should be removed of this list.
Solving the problem for 2 is easy. Solving it for 1 may require
to make two different pam.d/su files: one for use in su -l and one for
use in su. The line reading /etc/default/locale would be removed.
Another solution is to patch pam_env.so so that (reading an argument on
the pam line) no variables could be clobbered if they are already set. I
already wrote this patch some time ago and can provide it if it is of
any interest.
The line would become (in /etc/pam.d/su):
session required pam_env.so readenv=1 noclobber=1
envfile=/etc/default/locale
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.18-1-686 (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages login depends on:
ii libc6 2.5-11 GNU C Library: Shared libraries
ii libpam-modules 0.79-4.1 Pluggable Authentication Modules f
ii libpam-runtime 0.79-4.1 Runtime support for the PAM librar
ii libpam0g 0.79-4.1 Pluggable Authentication Modules l
login recommends no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 2.32-0.4
The new su from util-linux supports differing PAM configurations
for su and su -.
Configuring the requested behaviour is now possible, and I think
this should be left to the local admin.
--- End Message ---
