[SRU] Add -E support to lxqt-sudo

Bug #2039093 reported by Simon Quigley
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
lxqt-sudo (Ubuntu)
Status tracked in Mantic
Jammy
Fix Committed
Medium
Simon Quigley
Lunar
Fix Committed
Medium
Simon Quigley
Mantic
Fix Committed
Medium
Simon Quigley

Bug Description

[ Impact ]

LXQt Sudo is a tool used by the Lubuntu desktop to authorize applications requiring escalated privileges. While presenting a graphical prompt (making it useful for graphical applications), it uses sudo/su/etc. on the backend to actually honor that request.

It recently came to my attention during the review process for bug 2038958 that lxqt-sudo does not pass enough environment variables. Rather than taking the approach of replacing that command with pksudo (or even a direct sudo), this adds a feature to LXQt Sudo allowing those environment variables to pass through. As a simple, opt-in command line option, this will not affect existing users who don't know about it.

I've submitted the patch upstream for review. As is usual when I submit patches, it'll probably be rejected, and we'll keep it as a vendor patch anyway. https://github.com/lxqt/lxqt-sudo/pull/204

[ Test Plan ]

 * Launch QTerminal.
 * Run `lxqt-sudo qterminal` (or some other graphical app)
   - No XDG-specific environment variables will be present when running `env`
 * Run `lxqt-sudo -E qterminal`
   - When running `env`, all environment variables present for the user should now be present on that child process.

Both of those commands should run without issue.

[ Where problems could occur ]

 * If lubuntu-update-notifier is not released after (or with) lxqt-sudo, it will fail to run. Explicit dependencies are set, so apt should prevent this.
 * If someone calls lxqt-sudo ARGS COMMAND when they really meant lxqt-sudo COMMAND ARGS, they could trigger this on accident. This scenario is unlikely.
 * As noted in some of the code comments on the file already, some applications will break when ran with this. That being said, they're accepting the same risk they would otherwise with `sudo -E`, so this is more of a calibration in user expectations than it is a bug.
 * If Qt behavior changes drastically, or its underpinnings, the environment variables have the potential not to be read.

[ Other Info ]

In case you're wondering why -E isn't passed through *directly* to sudo (or similar), it's because the environment variables are being read into an array anyway, for string escaping and such. (I'd just like to keep the impact of this change low.)

Simon Quigley (tsimonq2)
Changed in lxqt-sudo (Ubuntu Jammy):
assignee: nobody → Simon Quigley (tsimonq2)
Changed in lxqt-sudo (Ubuntu Lunar):
assignee: nobody → Simon Quigley (tsimonq2)
Changed in lxqt-sudo (Ubuntu Mantic):
assignee: nobody → Simon Quigley (tsimonq2)
importance: Undecided → Medium
Changed in lxqt-sudo (Ubuntu Lunar):
importance: Undecided → Medium
Changed in lxqt-sudo (Ubuntu Jammy):
importance: Undecided → Medium
status: New → In Progress
Changed in lxqt-sudo (Ubuntu Lunar):
status: New → In Progress
Changed in lxqt-sudo (Ubuntu Mantic):
status: New → In Progress
Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Simon, or anyone else affected,

Accepted lxqt-sudo into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/lxqt-sudo/1.2.0-1ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in lxqt-sudo (Ubuntu Lunar):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-lunar
Changed in lxqt-sudo (Ubuntu Mantic):
status: In Progress → Fix Committed
Changed in lxqt-sudo (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello Simon, or anyone else affected,

Accepted lxqt-sudo into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/lxqt-sudo/0.17.0-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.