admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

sudo: pass env variables without /usr/bin/env

Browse Source 
Using /usr/bin/env as a frontend for the actual command
prevents sudoers from restricting allowed commands and configuring
detailed command environment.
This commit is contained in:
Ilya Kulakov 2023-02-13 18:40:37 -08:00
parent eb7c6ad195
commit 9ff7ceb563
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Library/Homebrew/system_command.rb
View File

@ -121,7 +121,7 @@ class SystemCommand
sig { returns(T::Array[String]) } sig { returns(T::Array[String]) }
def command def command
[*sudo_prefix, *env_args, executable.to_s, *expanded_args] [*command_prefix, executable.to_s, *expanded_args]
end end
private private
@ -154,15 +154,23 @@ class SystemCommand
return [] if set_variables.empty? return [] if set_variables.empty?
["/usr/bin/env", *set_variables] set_variables
end end
sig { returns(T::Array[String]) } sig { returns(T::Array[String]) }
def sudo_prefix def sudo_prefix
return [] unless sudo?
askpass_flags = ENV.key?("SUDO_ASKPASS") ? ["-A"] : [] askpass_flags = ENV.key?("SUDO_ASKPASS") ? ["-A"] : []
["/usr/bin/sudo", *askpass_flags, "-E", "--"] ["/usr/bin/sudo", *askpass_flags, "-E", *env_args, "--"]
end
sig { returns(T::Array[String]) }
def env_previx
["/usr/bin/env", *env_args]
end
sig { returns(T::Array[String]) }
def command_prefix
sudo? ? sudo_prefix : env_previx
end end
sig { returns(T::Array[String]) } sig { returns(T::Array[String]) }

4
Library/Homebrew/test/system_command_spec.rb
View File

@ -54,8 +54,8 @@ describe SystemCommand do
expect(Open3) expect(Open3)
.to receive(:popen3) .to receive(:popen3)
.with( .with(
an_instance_of(Hash), ["/usr/bin/sudo", "/usr/bin/sudo"], "-E", "--", an_instance_of(Hash), ["/usr/bin/sudo", "/usr/bin/sudo"], "-E",
"/usr/bin/env", "A=1", "B=2", "C=3", "env", *env_args, pgroup: nil "A=1", "B=2", "C=3", "--", "env", *env_args, pgroup: nil
) )
.and_wrap_original do |original_popen3, *_, &block| .and_wrap_original do |original_popen3, *_, &block|
original_popen3.call("true", &block) original_popen3.call("true", &block)