Return to BUGS CVS log | Up to [local] / src / usr.bin / sudo |
File: [local] / src / usr.bin / sudo / Attic / BUGS (download)
Revision 1.10, Thu Jul 26 16:10:15 2007 UTC (16 years, 10 months ago) by millert
Update to sudo 1.6.9p1. Note that the environment handling in sudo 1.6.9 has changed relative to older versions. Sudo now starts commands with a minimal environment containing the variables in the env_keep and env_check lists. This behavior is configurable in the sudoers file. Please see the "SECURITY NOTES" section in the sudo manual. |
Known bugs in sudo version 1.6.9 ================================ 1) Sudo should have an option to log when removing "dangerous" environment variables. 2) On DUNIX in sia mode, hitting return at the prompt does not quit. 3) In parse.lex, '@' should not need to be a special character. However, because lex does greedy matching, {WORD} will match instead of the "^Defaults[:@]?" line. 4) In list mode (sudo -l), characters escaped with a backslash are shown verbatim with the backslash. 5) Because the parser only does a single pass it is possible to make a sudoers file where the "defaults" options are set after a user's entry has been validated, changing the permissions for the user. The work-around is to put all 'defaults' entries before the "User privilege specification" section but after all the "alias specifications". In the future the parser will converted to a two-pass parser. 6) For the same reason as #5, changing the value of "ignore_dot" has no effect (find_path() is called before sudoers is parsed). For a list of things that are not bugs but that I would like to add / fix, please see the TODO file.