[pca] pca ignoring .pca file??

[jaearick at colby.edu]

On Thu, 5 Aug 2010, Martin Paul wrote:

> Date: Thu, 05 Aug 2010 14:37:52 +0200
> From: Martin Paul <martin at par.univie.ac.at>
> Reply-To: "PCA (Patch Check Advanced) Discussion" <pca at lists.univie.ac.at>
> To: "PCA (Patch Check Advanced) Discussion" <pca at lists.univie.ac.at>
> Subject: Re: [pca] pca ignoring .pca file??
> 
> jaearick at colby.edu wrote:
>> It seems like pca is ignoring/missing the .pca file in my home
>> directory.  Observe:
>> ...
>> CWD: /export/home/admin/jaearick
>> Found /usr/sfw/bin/wget (1.12, 11200, https)
>
> You're right, it doesn't find any config files. It would show up like in this 
> sample output:
>
>  CWD: /home/martin/tmp
>  Config files: /home/martin/.pca
>  Found /usr/sfw/bin/wget (1.12, 11200, https)
>
> pca uses the HOME environment variable to determine the home directory. Is it 
> possible that's it not set in your shell? Try "echo $HOME".
>
Ahah!  I recently upgraded from sudo 1.7.3 to 1.7.4.  The release notes for
sudo 1.7.4 say:

  The HOME and MAIL environment variables are now reset based on the
    target user's password database entry when the env_reset sudoers option
    is enabled (which is the case in the default configuration).  Users
    wishing to preserve the original values should use a sudoers entry like:
        Defaults env_keep += HOME
    to preserve the old value of HOME and
        Defaults env_keep += MAIL
    to preserve the old value of MAIL.

    NOTE: preserving HOME has security implications since many programs
    use when searching for configuration files.  Adding HOME to env_keep
    may enable a user to run unrestricted commands via sudo.

Sure enough, sudo works as advertised:

[3] % echo $HOME
/export/home/admin/jaearick
[4] % echo $MAIL
/var/mail/j/jaearick
[5] % sudo -s
# echo $HOME
/
# echo $MAIL
/var/mail/root

So I added the "Defaults env_keep += HOME" line to /etc/sudoers, and tried 
again:

[2] % echo $HOME
/export/home/admin/jaearick
[3] % sudo -s
Password: 
# echo $HOME
/export/home/admin/jaearick
# pca --debug -d -i -n
Option download: 1
Option install: 1
Option patchdir: /export/home/admin/jaearick/.
Option user: <user>
Option passwd: <passwd>
Option pattern: !VERITAS
Option noreboot: 1
Option syslog: local7
Option debug: 1
Command: /usr/local/adm/pca
ARGV: missing
Version: 20100727-01
CWD: /export/home/admin/jaearick
Config files: /export/home/admin/jaearick/.pca 
Found /usr/sfw/bin/wget (1.12, 11200, https)
Using /usr/sfw/bin/wget
Found /usr/bin/uname
(etc, did the right thing)

Thanks for the hint.

Jeff Earickson
Colby College