Island of castaway thoughts

Eliah Kagan

04:33

@EliahKagan The reason--and maybe some or all of this should get moved to the island but I don't want to start it there because it's related to the issue of what should be done in the future with those questions and answers (which I definitely don't want deleted!) is that I think sudo might start behaving in a relevantly different way starting in 19.10.

ek@Apok:~$ sudo printenv HOME
/root
ek@Apok:~$ lsb_release -rd
Description:    Ubuntu Eoan Ermine (development branch)
Release:        19.10

Zanna

@EliahKagan oooh

Eliah Kagan

I don't think Eoan is at the point yet where a question about how sudo will behave differently in it would be considered on-topic for the main site. I could post a question on Launchpad Answers about it. We've discussed the various questions about that, though (not just those two, IIRC, but also What specific bad things happen when gedit is used with sudo? which at one time was almost wrongly deleted) so I figured you'd be interested.

(In no way do I intend to restrict this to us, though: obviously anybody who sees these messages is welcome to share their thoughts if they're interested and able to do so. So far, I think this is on-topic for the Downboat... most technical off-topic conversations do start this way, though... :) )

I have two Eoan systems. One is freshly installed from a minimal CD. The other is a WSL system that I upgraded to Eoan with do-release-upgrade -d. They both exhibit this new behavior, where the HOME environment variable is set to the home directory for root rather than for ek (my non-root user) even when neither -H nor -i is passed.

I guess I should first verify that this actually is new as of 19.10!

I've only ever used 19.04 as a step in the process of upgrading to 19.10. If the change were made in 19.04, I suppose someone would've posted a comment or answer (or proposed an edit) about it on one of those questions or their answers, but maybe not. I wouldn't have noticed the change for the brief time I was using 19.04.

Do you have a 19.04 system?

Eliah Kagan

07:52

@Zanna I've verified this behavior is new as of 19.10 by comparing the output of sudo printenv HOME run by a non-root user on the ubuntu:19.04 and ubuntu-daily:19.10 LXD images. And my Debian 10 system has the new behavior, suggesting it's not transitory and will be in 19.10 when released. I think the next thing to do is figure out where (upstream? downstream?), when, and why the change was made.

The difference isn't in the default /etc/sudoers. That file is the same in the ubuntu:19.04 and ubuntu-daily:19.10 images.

Zanna

10:52

@EliahKagan seems like an improvement :)

sorry for my absence

unexpected housework necessitated by uninvited 4 footed long tailed guest

Eliah Kagan

@Zanna Definitely not a problem!

Zanna

:)

I'm still using 18.04

Eliah Kagan

Ubuntu patch to add HOME to env_keep makes custom commands vulnerable by default

[impact] sudo does not set HOME to the target user's HOME [test case] ddstreet@thorin:~$ sudo printenv | grep HOME HOME=/home/ddstreet [regression potential] this is a significant behavior change. As mentioned in comment 11 (and later, and other bugs duped to this, and the mailing list discussion, etc) users of Ubuntu so far have been used to running sudo with their own HOME set, not root's HOME. Therefore, it's inappropriate to change this behavior for existing releases; this should be changed starting in Eoan, and only the sudo and sudoers man pages changed in previous releases to indicate the actual behavior of sudo in those releases. [other info] Shortly after upstream changed the behavior, the patch to keep HOME as the calling (instead of target) user was added in bug 760140. For quick reference to anyone coming to this bug, the pre-19.10 behavior (of sudo keeping the calling user's $HOME) can be disabled by running 'sudo visudo' and adding this line: Defaults …

sudo (Ubuntu)

Medium / Fix Released

Apparently it's pretty much Ubuntu (and its derivatives) in which sudo has preserved $HOME by default in recent years, and I just haven't used Debian enough (until just lately) to notice.

According to that bug report, Ubuntu is going to work like other OSes and no longer patch sudo to preserve $HOME, starting in 19.10.

Zanna

I didn't bring my other laptop to India. There is a customs rule about bringing 2 laptops. So the heavy one with the dodgy keyboard stayed at my parents' place. So I only have the one that doesn't like Ubuntu. Around the time I was wanting to intall 18.04, the USB ports all totally stopped working, so I had to do-release-upgrade from 17.10 before it went EoL, hoping it would work out. After a few days, the USB ports started working again without me doing anything.

But otherwise this laptop is feeling rickety. Things are temperamental. The keyboard is unresponsive (probably too much dust in there). So I have not upgraded. Trying to be gentle with it. My mind was also elsewhere

Eliah Kagan

Is the one you have with you the one that has a strange kind of EFI?

Zanna

11:01

yes :)

@EliahKagan wow, interesting thread

I guess I had never really thought about why this was an issue on Ubuntu

enlightening stuff

Eliah Kagan

Can you think of any good reasons for sudo to preserve $HOME by default? In hindsight, I cannot, at least not at the moment.

Zanna

no... I can't imagine what they thought when they did it

but noticed a comment there about users being potentially upset by the change

Eliah Kagan

:)

The use case described in the comment about wanting editor configuration to be used automatically by root seems bad, because that's also the situation where things go wrong due to running sudo without -H or -i. If a new configuration file ends up being created, it will be owned by root.

Zanna

yeah!

Eliah Kagan

Also, people should use sudoedit.

Zanna

11:16

I am thinking that the only reason you could want that would be if you always use a particular editor when you want to be root for some reason, but why not use sudoedit for that?

Eliah Kagan

I don't know why people don't use sudoedit but years ago I was one of those people, misunderstanding how it worked.

Zanna

maybe they don't know about it

Eliah Kagan

@Zanna I'm skeptical of the wisdom of automatically having root's editor configuration be the same as that of another user.

Zanna

yeah...

Eliah Kagan

The alternatives are more complex, though. Except sudoedit.

Some people may prefer to run editors directly as root. But if so, presumably that's because they want an environment that belongs to root and isn't influenced unexpectedly from the outside.

So for that, I think the better solution would be to keep editor configuration files in source control. Then root can get the new versions by merging, and can undo it if something goes wrong.

Or if the configuration never actually changes, then just make a copy. Or seed it in /etc/skel before creating users (or before most users). Or put it somewhere users can read but only root can write (if it's really never to be changed).

Zanna

11:29

source control?

Eliah Kagan

Like Git. Or Bazaar.

Zanna

oh right

yeah

Eliah Kagan

11:45

It will be interesting as answers on Ask Ubuntu are updated to account for the sudo change in 17.10. Ubuntu 16.04 remains supported until April 2021. Ubuntu 19.10 is planned for release in October of this year. So, starting in a couple months and going for about a year and a half, there will be:

(a) an officially supported release that still has gksu officially packaged (which used to be, and for that release still is, the best way to run graphical programs as root, if one must do so), 16.04 LTS

(b) a couple supported releases for which the current guidance is pretty good, mainly 18.04 LTS, and

(c) another for which most of the guidance about why running graphical programs as root using sudo without -H or -i causes problems is no longer accurate, 19.10.

Zanna

That will be fun :)

Transcript for

Island of castaway thoughts