<div dir="ltr">The patch : <div><br></div><div><div>diff -rNaud polkit-0.105/src/programs/pkexec.c polkit-0.105-new/src/programs/pkexec.c</div><div>--- polkit-0.105/src/programs/pkexec.c<span class="" style="white-space:pre"> </span>2012-04-24 18:05:34.000000000 +0200</div><div>+++ polkit-0.105-new/src/programs/pkexec.c<span class="" style="white-space:pre"> </span>2016-02-27 13:15:21.683832135 +0100</div><div>@@ -76,6 +76,7 @@</div><div> " --help |\n"</div><div> " --disable-internal-agent |\n"</div><div> " [--user username] PROGRAM [ARGUMENTS...]\n"</div><div>+ " [--keep-user-env] PROGRAM [ARGUMENTS...]\n"</div><div> "\n"</div><div> "See the pkexec manual page for more details.\n");</div><div> }</div><div>@@ -391,6 +392,7 @@</div><div> gboolean opt_show_help;</div><div> gboolean opt_show_version;</div><div> gboolean opt_disable_internal_agent;</div><div>+ gboolean opt_keep_user_env;</div><div> PolkitAuthority *authority;</div><div> PolkitAuthorizationResult *result;</div><div> PolkitSubject *subject;</div><div>@@ -417,6 +419,8 @@</div><div> "LC_ALL",</div><div> "TERM",</div><div> "COLORTERM",</div><div>+ /* option to keep $USER env Jean-Philippe Guillemin <<a href="mailto:h1p8r10n@gmail.com">h1p8r10n@gmail.com</a>> */</div><div>+ "USER",</div><div> </div><div> /* By default we don't allow running X11 apps, as it does not work in the</div><div> * general case. See</div><div>@@ -478,6 +482,7 @@</div><div> opt_show_help = FALSE;</div><div> opt_show_version = FALSE;</div><div> opt_disable_internal_agent = FALSE;</div><div>+ opt_keep_user_env = FALSE;</div><div> for (n = 1; n < (guint) argc; n++)</div><div> {</div><div> if (strcmp (argv[n], "--help") == 0)</div><div>@@ -503,6 +508,11 @@</div><div> {</div><div> opt_disable_internal_agent = TRUE;</div><div> }</div><div>+ /* option to keep $USER env Jean-Philippe Guillemin <<a href="mailto:h1p8r10n@gmail.com">h1p8r10n@gmail.com</a>> */</div><div>+ else if (strcmp (argv[n], "--keep-user-env") == 0)</div><div>+ {</div><div>+ opt_keep_user_env = TRUE;</div><div>+ }</div><div> else</div><div> {</div><div> break;</div><div>@@ -783,13 +793,19 @@</div><div> else</div><div> s = g_strdup_printf ("/usr/sbin:/usr/bin:/sbin:/bin:%s/bin", pw->pw_dir);</div><div> g_ptr_array_add (saved_env, s);</div><div>- g_ptr_array_add (saved_env, g_strdup ("LOGNAME"));</div><div>- g_ptr_array_add (saved_env, g_strdup (pw->pw_name));</div><div>- g_ptr_array_add (saved_env, g_strdup ("USER"));</div><div>- g_ptr_array_add (saved_env, g_strdup (pw->pw_name));</div><div>+ </div><div>+ /* option to keep $USER env Jean-Philippe Guillemin <<a href="mailto:h1p8r10n@gmail.com">h1p8r10n@gmail.com</a>> */</div><div>+ if (opt_keep_user_env == FALSE)</div><div>+ {</div><div>+ g_ptr_array_add (saved_env, g_strdup ("USER"));</div><div>+ g_ptr_array_add (saved_env, g_strdup (pw->pw_name));</div><div>+</div><div>+ }</div><div> g_ptr_array_add (saved_env, g_strdup ("HOME"));</div><div> g_ptr_array_add (saved_env, g_strdup (pw->pw_dir));</div><div>-</div><div>+ g_ptr_array_add (saved_env, g_strdup ("LOGNAME"));</div><div>+ g_ptr_array_add (saved_env, g_strdup (pw->pw_name));</div><div>+ </div><div> s = g_strdup_printf ("%d", getuid ());</div><div> g_ptr_array_add (saved_env, g_strdup ("PKEXEC_UID"));</div><div> g_ptr_array_add (saved_env, s);</div></div><div><br></div><div><br><div class="gmail_extra"><br><div class="gmail_quote">2016-02-27 13:01 GMT+01:00 Jean-Philippe Guillemin <span dir="ltr"><<a href="mailto:h1p8r10n@gmail.com" target="_blank">h1p8r10n@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Hi, <div>Many X applications require root privileges, but at the same time want to keep the original $USER env variable.<br></div><div><br></div><div>This option (see attached patch), while preserving the sanitized environment, and also while still honoring the org.freedesktop.policykit.exec.allow_gui annotate key : allow the user to preserve the $USER environment variable.</div><div><br></div><div>I believe, this option is both safe, clean, and a must have for pkexec.</div><div><br></div><div>All the best</div><span class=""><font color="#888888"><div><br></div><div>JP</div></font></span></div>
</blockquote></div><br></div></div></div>