From 5b1da017988c987fc68b55d1f45b5d2676474ce1 Mon Sep 17 00:00:00 2001 From: Radosław Piliszek Date: Mon, 29 Aug 2022 09:55:59 +0000 Subject: Fix CVE-2022-38060 Closes-Bug: #1985784 Change-Id: I66476a2b396e2cbe41e68ac51f57aae1806b2ed8 --- docker/base/sudoers | 2 ++ 1 file changed, 2 insertions(+) (limited to 'docker/base/sudoers') diff --git a/docker/base/sudoers b/docker/base/sudoers index da9c04c30..9b2bfb8dc 100644 --- a/docker/base/sudoers +++ b/docker/base/sudoers @@ -6,6 +6,8 @@ # anyone in the kolla group may sudo -E (set the environment) Defaults: %kolla setenv +Defaults secure_path="/var/lib/kolla/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + # root may run any commands via sudo as the network seervice user. This is # neededfor database migrations of existing services which have not been # converted to run as a non-root user, but instead do that via sudo -E glance -- cgit v1.2.3