`sudo --preserve-env=MY_VAR` vs `sudo env MY_VAR=$MY_VAR`

Question

I read in man sudo the following:

--preserve-env

Indicates to the security policy that the user wishes to preserve their existing environment variables. The security policy may return an error if the user does not have permission to preserve the environment.

But I wonder, even if I don't have that permission, what stops me from running

sudo env MY_VAR=$MY_VAR <cmd>

?

Answer 1

Interesting question. First of all setting the environment manually is tedious so --preserve-env is obviously better.

For the security aspect: the sudo configuration can disallow you to execute env with sudo or better only allow a specific list of commands to run which does not include env.

I would consider a sudoer configuration which is not restricted to a limited list of commands as full root access. It is not just env. Why not do sudo bash -c 'export MY_VAR="$MY_VAR"; exec <cmd>'. It is similar problematic as having a restricted shell you should not escape. If you not strictly limit what can be run there is likely an escape route.

This part of the sudoer man page supports this in my opinion:

SETENV and NOSETENV

These tags override the value of the setenv option on a per-command basis. Note that if SETENV has been set for a command, the user may disable the env_reset option from the command line via the -E option. Additionally, environment variables set on the command line are not subject to the restrictions imposed by env_check, env_delete, or env_keep. As such, only trusted users should be allowed to set variables in this manner. If the command matched is ALL, the SETENV tag is implied for that command; this default may be overridden by use of the NOSETENV tag.

So if a user is allowed to use all commands including env he/she can (by default) also use --preserve-env. If the configuration only allows a specific command it defaults to NOSETENV so the user neither can --preserve-env nor call env to bypass it.

TL;DR: it is unlikely that you lack permission to use --preserve-env but be able to use env.