4

No matter what I try, it seems that the LD_LIBRARY_PATH environment variable is not kept after I run a command with sudo. The only way I managed to have it stick, is to prefix my sudo command with LD_LIBRARY_PATH=/the/path whenever I call it from the command-line, but I would like to not have to do this every time.

It seems the env_keep option ignores this variable, and so does the exempt_group option.

My %group currently has ALL=(ALL) NOPASSWD:ALL as its access in sudoers. I would like this specific environment variable to be kept for any command I run.

How can I do this?

My server is running Red Hat Enterprise Linux 5.7.

2
  • 2
    You know that allowing this through sudo allows execution of arbitary code as root, right?
    – pjc50
    Mar 20, 2012 at 16:47
  • Yes I know, but it's a requirement in my case. We are well aware of the implications. If it's the NOPASSWD option that is bugging you, it's just an example. I have set it on a local VM server to test this out and got tired of typing my password... Mar 20, 2012 at 17:22

4 Answers 4

15

You might expect that you can do this using

Defaults env_keep += "LD_LIBRARY_PATH FRED" 

but a quick test on a CentOS 6.2 with Sudo version 1.7.4p5 doesn't pass LD_LIBRARY_PATH but does pass FRED. The sudoers man page has this to say

Note that the dynamic linker on most operating systems will remove variables that
can control dynamic linking from the environment of setuid executables, including
sudo. Depending on the operating system this may include _RLD, DYLD_, LD_, 
LDR_, LIBPATH, SHLIB_PATH, and others. These type of variables are removed from 
the environment before sudo even begins execution and, as such, it is not 
possible for sudo to preserve them

So it looks like the system removes the LD_LIBRARY_PATH from the environment before sudo sees it.

3
  • That is indeed the behavior that I'm seeing. The question is: Is there a way to work around that without reinventing the wheel? Mar 20, 2012 at 17:23
  • 2
    It's not really sudo's problem as it never gets to see the LD_LIBRARY_PATH. I would wrap the commands I want to run in a script and set the environment variable within the secipt.
    – user9517
    Mar 20, 2012 at 17:51
  • It must work differently on Solaris then, because we have another server where this behavior does not occur. It's only doing this on Red Hat. Thanks for the explanation though! Mar 20, 2012 at 19:19
5

In order to get this to work I had to do this:

  1. Add Defaults env_keep += "LD_LIBRARY_PATH" to sudoers
  2. Add this alias in my .bashrc file: alias sudo='sudo LD_LIBRARY_PATH=/mypath'

Now any command I call with sudo will have the variable setup.

2
  • 1
    For me (don't know why) it was sufficient just to do step 2, i.e. sudo LD_LIBRARY_PATH=/mypath <cmd>
    – jfritz42
    Aug 6, 2014 at 19:07
  • agreed with @jfritz42, #2 was the only thing I needed to do.
    – ewong
    Jul 29, 2020 at 2:13
0

This is happening not only for LD_LIBRARY_PATH but a few other environment variables that could temper with your build environment. In my case, sudo has become:

sudo -HE env PATH=${PATH} LD_LIBRARY_PATH=${LD_LIBRARY_PATH} PYTHONPATH=${PYTHONPATH} my_command
1
  • what for -HE here?
    – kyb
    Aug 29, 2018 at 17:36
-1

It sounds like you haven't you done export LD_LIBRARY_PATH yet. Doing so will make environmental variable available to everything, and solve this problem you're having.

Alternatively, if you want a sure-fire persistent environmental variable, consider appending it to your bashrc (~/.bashrc) file, then opening a new terminal session.

1
  • The variable is exported just fine in my own user's environment. It gets lost after I run anything via sudo. Mar 20, 2012 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.