3

I'm setting up a Vagrant box and I noticed something I found odd.

root@box:~# sudo --user=vagrant bash
bash: /root/.bashrc: Permission denied
vagrant@box:~$ export
declare -x HOME="/root"

Why is HOME set to /root here? The home directory for the user vagrant is certainly not /root:

vagrant@box:~$ grep vagrant /etc/passwd
vagrant:x:1000:1000::/home/vagrant:/bin/bash

Everything I found online talked about how to inherit environment variables, not how to prevent it. The sudoers file contains the env_reset default. I don't know what else controls this behavior.

Braiam
  • 35,991
Oliver Salzburg
  • 1,041

1 Answers1

7

This is a choice. If you don't like it, you can use the -i or -H option, or change the configuration. The sudo(8) man page says for HOME:

Set to the home directory of the target user if -i or -H are specified, env_reset or always_set_home are set in sudoers, or when the -s option is specified and set_home is set in sudoers.

Actually env_reset doesn't have an effect on $HOME under Ubuntu (but see below). This is an inaccuracy in the man page. See Launchpad bug #889936.

Additional information

Some environment variables may still be kept when env_reset is provided. There are compile-time defaults, and this can be changed with the env_keep option; see the sudoers(5) man page for more information. In the sudo -V output under root, you can see the list of these environment variables under "Environment variables to preserve:". In particular, HOME is listed by default under Ubuntu, but not under Debian.

For more information, see:

Community
  • 1
vinc17
  • 12,174
  • Kinda sounds like the env_reset should already have solved this. Regardless, using --set-home works. – Oliver Salzburg Dec 17 '14 at 00:25
  • @OliverSalzburg Yes, note that --set-home is the long name for -H (the option mentioned in the man page). Not sure why about env_reset. If it doesn't behave as documented, report a bug. – vinc17 Dec 17 '14 at 00:27
  • 2
    @OliverSalzburg The bug has actually already been reported... several years ago! I've updated my answer. It currently seems to be a bug in the documentation, the behavior being regarded as correct. – vinc17 Dec 17 '14 at 00:36