Re: Double SHELL variable defined

On Thu, 06 Nov 2025 16:04:23 +0100, Alejandro Lopez via sudo-workers wrote:

> A customer of ours found a minor bug when the `SHELL` variable is set twice
> in the environment. Most of the time this is not a problem, but `zsh`
> doesn't sanitize the environment as `bash` does, and two identical
> variables are set. Accessing `$SHELL` will show only one of the variables,
> but `env` will show both.

The problem is that `didvar` is not being updated for the `sudo -i`
when the default environment variables are set.  The following
change will fix it.  Nothing checks for DID_LOGNAME, DID_LOGIN or
DID_USER past that point.

This optimization probably isn't worth the added complexity to be
honest.

 - todd

diff --git a/plugins/sudoers/env.c b/plugins/sudoers/env.c
index 866ef3991..61b615513 100644
--- a/plugins/sudoers/env.c
+++ b/plugins/sudoers/env.c
@@ -966,6 +966,7 @@ rebuild_env(const struct sudoers_context *ctx)
 	if (ISSET(ctx->mode, MODE_LOGIN_SHELL)) {
 	    CHECK_SETENV2("SHELL", ctx->runas.pw->pw_shell,
 		ISSET(didvar, DID_SHELL), true);
+	    SET(didvar, DID_SHELL);
 #ifdef _AIX
 	    CHECK_SETENV2("LOGIN", ctx->runas.pw->pw_name,
 		ISSET(didvar, DID_LOGIN), true);
____________________________________________________________
sudo-workers mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-workers