1

Is there a way (without jumping through too many hoops) to run sudo -uuser command in such a way that user's environment is entirely preserved?

Basically, what I need is to ensure that specific environment variables are set for all users allowed to run sudo to impersonate certain IDs - mostly things like PATH, JAVA_HOME, and database-related (Oracle and Postgres) variables.

In other words - when I, as the user wobble, run sudo -u wibble echo $PATH I'd like to see wibble's path displayed instead of wobble's.

  • Do you also want sudo to remove all of wobble's environment? – Mark Plotnick Aug 31 '16 at 15:30
  • Not necessarily, but I need the PATH and other environment variables set for wibble to be available to everyone who runs commands as wibble – Eugenio Mastroviti Aug 31 '16 at 15:36
  • Does wibble set environment variables in something like .bashrc, .kshrc. or .cshrc? Or are they set in .profile or .login or .bash_profile or files that they source? The latter may require giving sudo the -i option, which may result in unwanted output if .profile et al are chatty. – Mark Plotnick Aug 31 '16 at 15:53
  • wibble sets env variables in .bashrc, and for some reason in RHEL6 sudo -i does not seem to work unless in the form "sudo -i -u wibble bash -c" – Eugenio Mastroviti Sep 1 '16 at 10:21
  • sudo -u webm echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/i17454_adm/bin sudo -i -u webm bash -c 'echo $PATH' /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/i17454_adm/bin:/opt/webm/admin/scripts:/home/webm/bin – Eugenio Mastroviti Sep 1 '16 at 10:31
2

You can certainly do the following for all users, or a given user wobble, however it applies to all commands sudo -u anyuser. Edit the /etc/sudoers file and add a line like

Defaults env_keep+="PATH JAVA_HOME"

for all users, or

Defaults:wobble env_keep+="PATH JAVA_HOME"

for just wobble, with all the variables you want to keep. Actually, PATH is usually a special case, and is reset so you may need to cancel that with an entry like

Defaults:wobble  !secure_path, env_keep+="PATH JAVA_HOME"

Obviously, these features are there for good reason, so beware.

There is also the ability to preserve the environment with sudo -E which can be allowed by a sudoers entry like:

wobble ALL = (wibble) SETENV: ALL

but this will still reset the special case PATH, though you can run commands like

sudo -E PATH=$PATH -u wibble ...
  • I think OP wants the opposite of this - he wants commands run as wibble to have wibble's environment. – Mark Plotnick Aug 31 '16 at 15:50
  • Oops, did I confuse a wibble with a wobble? As the original user's PATH is normally lost, I assumed that was what they wanted to preserve, since as you say -i is easy to add for the reverse case. Thanks. – meuh Aug 31 '16 at 16:03
0

You can use sudo -i to go through the full login processes for a user, so sudo -i -u wibble command will login as wibble, setup all its environment vars and run command as that user.

However sudo -i -u wibble echo $HOME will still print out your home path. This is because your prompt is expanding the $HOME var before sudo even starts and there is nothing sudo can do about this. So if you need to pass a environment variable in through the command line it must be escaped properly, here are some examples:

sudo echo $HOME
> /home/user
sudo -i echo '$HOME'
> /root
sudo echo '$HOME'
> $HOME
sudo bash -c 'echo $HOME'
> /root
sudo -i bash -c 'echo $HOME'
> /root

To all of these you can add -u wibble (before the command) to run them as wibble instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.