I am using Ubuntu 10.04 Server and trying to set up sudoers to respect a user's EDITOR choice (within limits)
In my sudoers I have:
Defaults editor=/usr/bin/nano:/usr/bin/vim Defaults env_reset
And in the user .bashrc:
$EDITOR is set:
$ echo $EDITOR /usr/bin/vim
man sudoers this should be enough for $EDITOR to be set to vim:
editor A colon (':') separated list of editors allowed to be used with visudo. visudo will choose the editor that matches the user's EDITOR environment variable if possible, or the first editor in the list that exists and is executable. The default is the path to vi on your system.
nano is still being used for this user. A quick check of env:
$ sudo -- env | grep EDITOR
$ sudo -E -- env | grep EDITOR
I am aware that I could do the following things to make EDITOR work:
env_keep+=EDITORor any other option that keeps the EDITOR variable in sudoers: I don't want to do this as it could allow arbitrary execution of anything (e.g.
sudo -Eor even
alias sudo='sudo -E': Defeats the point of having
env_resetand users without SETENV (not something I want to give out: see previous point) get
sudo: sorry, you are not allowed to preserve the environment
editor=/usr/bin/vim: But there are other users who don't know vim
sudo select-editor: Close, but
sudo visudostill opens in
- Just use sudoedit or vim directly: But then you lose the safety of tools like
- Just deal with it: Probably, but if I'm missing some insight I would love to know
I've also tried setting the
SUDO_EDITOR variables (in desperation)
Is there something I have missed that will make
sudo visudo open in the users editor of choice, without making the compromises above?
I think I understand why this isn't working as I expect. I'm putting it down here in case anyone else has the same misconception.
In the sudoers file
- Only refers to the list of editors that are allowed when running
visudo(not any other program)
editorchecks $EDITOR, but if running
sudodoes not set $EDITOR, so when
visudoruns it will be empty
- Therefore the first editor is used, in this case
Can anyone confirm that this is correct?
I expected therefore that a safe solution would be to add:
i.e. keep EDITOR if and only if running visudo. This would then be checked against
And if it didn't match either would use
Weirdly though, this doesn't seem to be the case:
$ sudo su - root # export EDITOR=/bin/echo # visudo /etc/sudoers.tmp visudo: /etc/sudoers.tmp unchanged
/bin/echo is used as the editor. Bug? Or another misconception?