5

Is there a way (without jumping through too many hoops) to run sudo -uuser command in such a way that user's environment is entirely preserved?

Basically, what I need is to ensure that specific environment variables are set for all users allowed to run sudo to impersonate certain IDs - mostly things like PATH, JAVA_HOME, and database-related (Oracle and Postgres) variables.

In other words - when I, as the user wobble, run sudo -u wibble echo $PATH I'd like to see wibble's path displayed instead of wobble's.

6
  • Do you also want sudo to remove all of wobble's environment? Aug 31, 2016 at 15:30
  • Not necessarily, but I need the PATH and other environment variables set for wibble to be available to everyone who runs commands as wibble Aug 31, 2016 at 15:36
  • Does wibble set environment variables in something like .bashrc, .kshrc. or .cshrc? Or are they set in .profile or .login or .bash_profile or files that they source? The latter may require giving sudo the -i option, which may result in unwanted output if .profile et al are chatty. Aug 31, 2016 at 15:53
  • wibble sets env variables in .bashrc, and for some reason in RHEL6 sudo -i does not seem to work unless in the form "sudo -i -u wibble bash -c" Sep 1, 2016 at 10:21
  • sudo -u webm echo $PATH /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/i17454_adm/bin sudo -i -u webm bash -c 'echo $PATH' /usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/i17454_adm/bin:/opt/webm/admin/scripts:/home/webm/bin Sep 1, 2016 at 10:31

3 Answers 3

3

You can certainly do the following for all users, or a given user wobble, however it applies to all commands sudo -u anyuser. Edit the /etc/sudoers file and add a line like

Defaults env_keep+="PATH JAVA_HOME"

for all users, or

Defaults:wobble env_keep+="PATH JAVA_HOME"

for just wobble, with all the variables you want to keep. Actually, PATH is usually a special case, and is reset so you may need to cancel that with an entry like

Defaults:wobble  !secure_path, env_keep+="PATH JAVA_HOME"

Obviously, these features are there for good reason, so beware.

There is also the ability to preserve the environment with sudo -E which can be allowed by a sudoers entry like:

wobble ALL = (wibble) SETENV: ALL

but this will still reset the special case PATH, though you can run commands like

sudo -E PATH=$PATH -u wibble ...
2
  • 1
    I think OP wants the opposite of this - he wants commands run as wibble to have wibble's environment. Aug 31, 2016 at 15:50
  • Oops, did I confuse a wibble with a wobble? As the original user's PATH is normally lost, I assumed that was what they wanted to preserve, since as you say -i is easy to add for the reverse case. Thanks.
    – meuh
    Aug 31, 2016 at 16:03
1

You can use sudo -i to go through the full login processes for a user, so sudo -i -u wibble command will login as wibble, setup all its environment vars and run command as that user.

However sudo -i -u wibble echo $HOME will still print out your home path. This is because your prompt is expanding the $HOME var before sudo even starts and there is nothing sudo can do about this. So if you need to pass a environment variable in through the command line it must be escaped properly, here are some examples:

sudo echo $HOME
> /home/user
sudo -i echo '$HOME'
> /root
sudo echo '$HOME'
> $HOME
sudo bash -c 'echo $HOME'
> /root
sudo -i bash -c 'echo $HOME'
> /root

To all of these you can add -u wibble (before the command) to run them as wibble instead.

0

I think you are looking for

sudo su - USER

This will launch a shell with only the USERs environment variables (SUDO_USER etc. is removed as well):

   -, -l, --login
          Start the shell as a login shell with an environment similar to a real login

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .