5

The sudo manpage tells me, that I can preserve the environment by passing the -E option, which does not work in the case of $TMPDIR:

> env | grep TMPDIR
TMPDIR=/localdata/tmp
> sudo env | grep TMPDIR
[no output]
> sudo -E env | grep TMPDIR
[no output]

This option is not blacklisted, that is sudo sudo -V doesn't list it as "Environment variables to remove". Following the approach proposed in an answer the the question "How to specify root's environment variables", I tried to whitelist it, that is my /etc/sudoers reads:

Defaults        env_reset
Defaults        env_keep = "TMPDIR"

This doesn't work neither, it actually doesn't even make TMPDIR appear in the whitelist (that is, what ``sudo sudo -V` prints as "Environment variables to preserve".

(I'm running Ubuntu 10.04.)

2
  • Is $TMPDIR marked for export? export TMPDIR Feb 14, 2013 at 17:42
  • I can reproduce this on Ubuntu 12.10, and yes, $TMPDIR is marked for export.
    – hrunting
    Feb 15, 2013 at 1:43

1 Answer 1

5

It looks like glibc will remove certain environment variables when running setuid programs (sudo is, of course, setuid). TMPDIR is one of these environment variables, although it doesn't seem to be documented anywhere. This is a security feature to prevent setuid programs from having their environments altered to allow for malicious reading/writing of file data.

If you want TMPDIR in your sudo environment, you can pass it explicitly:

sudo TMPDIR=$TMPDIR env
2
  • Thanks - Your second reference leads to a Bugzilla entry, closed as notabug, claiming that this behaviour is documented in ld.so(8), which I cannot confirm. Feb 20, 2013 at 8:08
  • @hrunting, thanks a ton for this tip. I've just been struggling to get a build script for an embedded device to run because it wants 8 GB of scratch space in /tmp, but my VM's drive only has 2 GB free. I tried specifying TMPDIR before sudo, but this does not work. Putting it after worked like a charm. Thanks!
    – evadeflow
    May 3, 2013 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .