1

This is on Ubuntu 15.10

I'm trying to get a better understanding of visudo and how it works. The documentation explains that visudo will consult the VISUAL environment variable and compare it against a fixed list of editors. Where can I find this list and what does it consist of?

The man page mentions a list somewhere, but I can't tell if it's a compile-time configuration option or the contents of some file somewhere.

There is a hard-coded list of one or more editors that visudo will use set at compile-time that may
 be overridden via the editor sudoers Default variable.  This list defaults to /usr/bin/editor.
 Normally, visudo does not honor the VISUAL or EDITOR environment variables unless they contain an
 editor in the aforementioned editors list.  However, if visudo is configured with the
 --with-env-editor option or the env_editor Default variable is set in sudoers, visudo will use any
 the editor defines by VISUAL or EDITOR.  Note that this can be a security hole since it allows the
 user to execute any program they wish simply by setting VISUAL or EDITOR.

This is all fine, except that /usr/bin/vi seems not to be on this list although vi is.

$ sudo env VISUAL=/usr/bin/vi visudo

launches nano, the executable invoked by /usr/bin/editor through a series of symlinks.

$ sudo env VISUAL=vi visudo

launches vi and works fine.

This is confusing to me. The entire justification for having a fixed list of editors is to prevent an arbitrary command from being executed just by changing an environment variable. If visudo consults the PATH to determine where to find vi then I can effectively execute any command I want by changing the path and naming my executable vi.

So, why does visudo have a fixed list of editors that it will honor? Are there any security benefits to doing that? Assuming there is some advantage, why wouldn't the whitelist use absolute paths instead of names of commands?

Greg Nisbet
  • 3,076
  • Try doing 'sudo env VISUAL=./vi visudo' Did open with nano or vi? – John Militer Apr 28 '16 at 20:34
  • 1
    @John, Neither. It is interpreted as a path in the current working directory. visudo: specified editor (./vi) doesn't exist. I'll correct my question to say command rather than relative path. @eyoung100, I'm not just asking about how to configure visudo to change the editor, I'd like to know why it behaves the way it does. What's the right way to phrase that question? – Greg Nisbet Apr 28 '16 at 20:40
  • I've done some digging and I think this question is actually closer to a duplicate of this one: http://unix.stackexchange.com/questions/129246/why-does-visudo-discourage-other-editors?rq=1 – Greg Nisbet Apr 29 '16 at 03:30

0 Answers0