Ensure sudo Runs In A Minimal Environment - sudo env_reset
Enable the Defaults env_reset option so sudo runs commands in a clean, minimal environment instead of inheriting the invoking user's environment variables.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Forcing sudo to reset the environment ensures that user-controlled variables (e.g. LD_PRELOAD, LD_LIBRARY_PATH, PATH, IFS) are not passed to the privileged command. Without env_reset, an attacker who controls the calling shell's environment could hijack the privileged process, loading a malicious library or redirecting it to a planted binary, turning a routine sudo into a privilege-escalation vector.
What Pavois checks
Pavois greps the active sudoers tree, /etc/sudoers and every file under /etc/sudoers.d/, for an uncommented Defaults ... env_reset. Because sudo assembles its policy from the main file plus all drop-ins (and @include directives), scanning the whole tree reflects the effective sudo policy, not just one file that a later drop-in could override.
describe command('grep -rqE \'^[^#]*Defaults[^#]*\benv_reset\b\' /etc/sudoers /etc/sudoers.d/ 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run sudo -V | grep -i 'reset the environment' or inspect the parsed policy with sudo grep -rE '^[^#]*Defaults.*env_reset' /etc/sudoers /etc/sudoers.d/. A matching line confirms the option is active. env_reset is the compiled-in default of modern sudo, so the expected result is that it is present and not overridden by !env_reset.
Inspect & investigate
Every sudo invocation is logged to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL), and to journalctl -t sudo. These entries show who ran what; combined with the policy check they confirm privileged commands run under the minimal environment.
Remediation
Pavois's harden plan writes a file resource at /etc/sudoers.d/99-Pavois-env_reset containing Defaults env_reset, owned root:root with mode 0440, and validates it with visudo -cf before it takes effect. Apply it with pavois harden apply. Using a dedicated drop-in keeps the change isolated and reversible without touching the main /etc/sudoers.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | Defaults env_reset |
|---|---|
| group | root |
| mode | 0440 |
| owner | root |
| path | /etc/sudoers.d/99-pavois-env_reset |
| resource | file |
| verify | visudo -cf %{path} |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
env_reset strips most environment variables, which can break scripts that rely on passing variables (e.g. http_proxy, custom PATH) through sudo. If specific variables are genuinely required, allow only those via Defaults env_keep += "VAR" rather than disabling env_reset. The drop-in is validated by visudo before activation, so a syntax error cannot corrupt the sudoers policy or lock you out of sudo.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R39 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.