This is on Ubuntu 15.10
I'm trying to get a better understanding of visudo
and how it works. The documentation explains that visudo
will consult the VISUAL
environment variable and compare it against a fixed list of editors. Where can I find this list and what does it consist of?
The man page mentions a list somewhere, but I can't tell if it's a compile-time configuration option or the contents of some file somewhere.
There is a hard-coded list of one or more editors that visudo will use set at compile-time that may
be overridden via the editor sudoers Default variable. This list defaults to /usr/bin/editor.
Normally, visudo does not honor the VISUAL or EDITOR environment variables unless they contain an
editor in the aforementioned editors list. However, if visudo is configured with the
--with-env-editor option or the env_editor Default variable is set in sudoers, visudo will use any
the editor defines by VISUAL or EDITOR. Note that this can be a security hole since it allows the
user to execute any program they wish simply by setting VISUAL or EDITOR.
This is all fine, except that /usr/bin/vi
seems not to be on this list although vi
is.
$ sudo env VISUAL=/usr/bin/vi visudo
launches nano, the executable invoked by /usr/bin/editor
through a series of symlinks.
$ sudo env VISUAL=vi visudo
launches vi and works fine.
This is confusing to me. The entire justification for having a fixed list of editors is to prevent an arbitrary command from being executed just by changing an environment variable. If visudo
consults the PATH
to determine where to find vi
then I can effectively execute any command I want by changing the path and naming my executable vi
.
So, why does visudo
have a fixed list of editors that it will honor? Are there any security benefits to doing that? Assuming there is some advantage, why wouldn't the whitelist use absolute paths instead of names of commands?
visudo: specified editor (./vi) doesn't exist
. I'll correct my question to say command rather than relative path. @eyoung100, I'm not just asking about how to configure visudo to change the editor, I'd like to know why it behaves the way it does. What's the right way to phrase that question? – Greg Nisbet Apr 28 '16 at 20:40