# HG changeset patch
# User Roland Vollgraf <30869947+rvollgraf@users.noreply.github.com>
# Date 1629386021 -7200
# Node ID 5120e22882de98d0eb231548d240a6de26a12167
# Parent  587c76726b5fdaf372e08956c479ab43a5b5c89f
pass on sever process environment to child processes (option -e) (#118)

diff -r 587c76726b5f -r 5120e22882de dropbear.8
--- a/dropbear.8	Sat May 01 20:47:15 2021 +0800
+++ b/dropbear.8	Thu Aug 19 17:13:41 2021 +0200
@@ -35,6 +35,11 @@
 .B \-E
 Log to standard error rather than syslog.
 .TP
+.B \-e
+Pass on the server environment to all child processes. This is required, for example,
+if dropbear is launched on the fly from a SLURM workload manager. The enviroment is not
+passed by default. Note that this can be a potential security risk.
+.TP
 .B \-m
 Don't display the message of the day on login.
 .TP
diff -r 587c76726b5f -r 5120e22882de runopts.h
--- a/runopts.h	Sat May 01 20:47:15 2021 +0800
+++ b/runopts.h	Thu Aug 19 17:13:41 2021 +0200
@@ -130,6 +130,8 @@
         char *pubkey_plugin_options;
 #endif
 
+	int pass_on_env;
+
 } svr_runopts;
 
 extern svr_runopts svr_opts;
diff -r 587c76726b5f -r 5120e22882de svr-chansession.c
--- a/svr-chansession.c	Sat May 01 20:47:15 2021 +0800
+++ b/svr-chansession.c	Thu Aug 19 17:13:41 2021 +0200
@@ -943,19 +943,21 @@
 	seedrandom();
 #endif
 
-	/* clear environment */
+	/* clear environment if -e was not set */
 	/* if we're debugging using valgrind etc, we need to keep the LD_PRELOAD
 	 * etc. This is hazardous, so should only be used for debugging. */
+	if ( !svr_opts.pass_on_env) {
 #ifndef DEBUG_VALGRIND
 #ifdef HAVE_CLEARENV
-	clearenv();
+		clearenv();
 #else /* don't HAVE_CLEARENV */
-	/* Yay for posix. */
-	if (environ) {
-		environ[0] = NULL;
-	}
+		/* Yay for posix. */
+		if (environ) {
+			environ[0] = NULL;
+		}
 #endif /* HAVE_CLEARENV */
 #endif /* DEBUG_VALGRIND */
+	}
 
 #if DROPBEAR_SVR_MULTIUSER
 	/* We can only change uid/gid as root ... */
diff -r 587c76726b5f -r 5120e22882de svr-runopts.c
--- a/svr-runopts.c	Sat May 01 20:47:15 2021 +0800
+++ b/svr-runopts.c	Thu Aug 19 17:13:41 2021 +0200
@@ -64,6 +64,7 @@
 					"-R		Create hostkeys as required\n" 
 #endif
 					"-F		Don't fork into background\n"
+					"-e		Pass on server process environment to child process\n"
 #ifdef DISABLE_SYSLOG
 					"(Syslog support not compiled in, using stderr)\n"
 #else
@@ -173,6 +174,7 @@
         svr_opts.pubkey_plugin = NULL;
         svr_opts.pubkey_plugin_options = NULL;
 #endif
+	svr_opts.pass_on_env = 0;
 
 #ifndef DISABLE_ZLIB
 	opts.compress_mode = DROPBEAR_COMPRESS_DELAYED;
@@ -223,6 +225,10 @@
 					opts.usingsyslog = 0;
 					break;
 #endif
+				case 'e':
+					svr_opts.pass_on_env = 1;
+					break;
+
 #if DROPBEAR_SVR_LOCALTCPFWD
 				case 'j':
 					svr_opts.nolocaltcp = 1;