From: Matthias Andree <matthias.andree@gmx.de>
Date: Thu, 07 May 2009 09:02:21 GMT
Subject: Re: [PATCH] To make GIT-VERSION-FILE, search for git more widely
Message-ID: <op.utjx17xn1e62zd@merlin.emma.line.org>
In-Reply-To: <4A02A008.30800@viscovery.net>

Am 07.05.2009, 10:47 Uhr, schrieb Johannes Sixt <j.sixt@viscovery.net>:

> Junio C Hamano schrieb:
>> Matthias Andree <matthias.andree@gmx.de> writes:
>>
>>> Problem: when git is installed into /usr/local/bin, running 'sudo make
>>> install' won't find git in $PATH (because sudo strips PATH, for  
>>> instance
>>> on openSUSE 11.1, and doesn't include /usr/local/whatever).
>>
>> That sounds like a bug/misfeature in sudo (which I do not use) to me.
>
> sudo resets the environment, in particular also PATH. Why would this be  
> a bug?
>
> Current distros set env_reset in /etc/soduers for a reason. Not that I
> know the reason in detail, but I won't claim that I'm more clever with
> regards to security issues than distro packagers; so I trust that if they
> do it, then it makes sense.

comments in my suoders file:

| ...
| # Prevent environment variables from influencing programs in an
| # unexpected or harmful way (CVE-2005-2959, CVE-2005-4158, CVE-2006-0151)
| Defaults always_set_home
| Defaults env_reset
| ...

I don't bother, this is a convenience-and-usability feature. It has always  
irritated me why "make && sudo make install" would build twice.

Let's fix this for good unless someone can show that this is harmful. (OK,  
the $(prefix)/bin/git part might grab an old version, but we may want to  
use that for bootstrapping, and it should usually be good enough.)

-- 
Matthias Andree