topic Re: sudo environment settings in Operating System - HP-UX

sudo environment settings

Sanjiv Sharma_1 — Wed, 21 Sep 2005 01:27:59 GMT

Hi,

I have given sudo permission to a user to restart apache. The user is able to restart apache server but want to set the environment variable before restarting apache.

Is it possible to set the user profile so that when he run 'sudo' command the parameters remain set?
The parameter he need are :
export LD_PRELOAD=/usr/lib/lib123
export SHLIB_PATH=/usr:/usr/lib:/opt/abc/bin:/opt/abc/bin/lib/ext:/opt/abc/cgi-bin
export AB_LIBRARY_PATH=/opt/abc/cgi-bin
export ABC_DEFG_DIR=/opt/abc/cgi-bin

Thanks,

Re: sudo environment settings

RAC_1 — Wed, 21 Sep 2005 01:33:01 GMT

host_name (user_name) "export LD_PRELOAD=/usr/lib/lib123;export SHLIB_PATH=/usr:/usr/lib:/opt/abc/bin:/opt/abc/bin/lib/ext:/opt/abc/cgi-bin;export AB_LIBRARY_PATH=/opt/abc/c
gi-bin;export ABC_DEFG_DIR=/opt/abc/cgi-bin;apachectl start"

Will also work. You can also put required things in one file and last statement in this file to start apache.

host_name (user_name) "one_big_script"

Re: sudo environment settings

Arunvijai_4 — Wed, 21 Sep 2005 01:44:02 GMT

Yes, Sudo runs with user's environment variable. You can set in his profile.

-Arun

Re: sudo environment settings

Jeff Lightner_1 — Thu, 22 Sep 2005 08:11:53 GMT

Does the command only run as root? If it runs as another user you can give him permissions to run:

sudo su -

By doing the above he would get all environment variables that user normally gets.

Of course you would NOT want to set it up to allow him to do "sudo su - root" (or just "su -" which is the same thing).

Alternatively you could create a wrapper script that sets the above variables then executes the command and give him sudo access to execute that script. If you do that make sure the wrapper script is only editable by root so that no one puts a back door in it by adding an "su - " statement to it.

Re: sudo environment settings

Raj D. — Thu, 22 Sep 2005 09:09:39 GMT

Hi Raje ,

It seems you can put these commands ,

export LD_PRELOAD=/usr/lib/lib123
export SHLIB_PATH=/usr:/usr/lib:/opt/abc/bin:/opt/abc/bin/lib/ext:/opt/abc/cgi-bin
export AB_LIBRARY_PATH=/opt/abc/cgi-bin
export ABC_DEFG_DIR=/opt/abc/cgi-bin

in .profile of the user .
So when they will run sudo command it will be remain same,

You have to give the permission for running apache commands in /usr/local/etc/sudo/sudoers file.

Once the user .profile executed ..
the command would be look like that...and can start the apache web server:
$ /usr/locla/bin/sudo apache start

hth,
Raj.

Re: sudo environment settings

dirk dierickx — Mon, 26 Sep 2005 07:59:31 GMT

the user can define his own env vars, sudo will pick them up, except the LD_PRELOAD one!!

from the manpage;

Variables that control how dynamic loading and binding is done can be used to subvert the program that sudo runs. To combat this the LD_*, _RLD_*, SHLIB_PATH (HP-UX only), and LIBPATH (AIX only) environment variables are removed from the environment passed on to all commands executed.

Re: sudo environment settings

SANTOSH S. MHASKAR — Tue, 16 Jan 2007 02:44:18 GMT

Hi,

I agree with RAC,

U make a script to start apache as root, set all
env. in this script, and give access to this
script in /etc/sudoers to that user.
This will make /etc/sudoers simple and this is
more secure also.

-Santosh