Skip to content

Fix issue when changing user in exec subcommands#2230

Open
sabre1041 wants to merge 1 commit into
getsops:mainfrom
sabre1041:fix-user-exec
Open

Fix issue when changing user in exec subcommands#2230
sabre1041 wants to merge 1 commit into
getsops:mainfrom
sabre1041:fix-user-exec

Conversation

@sabre1041

@sabre1041 sabre1041 commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Fix exec subcommands (exec-file and exec-env) to set HOME, USER, and LOGNAME environment variables in the child process when the --user flag is used.

Originating Issue

When using --user to run a child process as a different user, SwitchUser() changes the UID/GID but leaves the environment variables pointing at the original user. This causes the child process to inherit incorrect values for HOME,
USER, and LOGNAME, which can break tools that rely on these variables (e.g., resolving ~ or determining the current user).

Example of issue:

sops exec-env --user=sops test.yml bash
bash: /root/.bashrc: Permission denied

Changes

  • Added UserEnv() function in exec_unix.go that looks up the target user and returns the correct HOME, USER, and LOGNAME environment variables
  • Updated ExecWithFile() and ExecWithEnv() to capture user environment variables before switching the user, then inject them into the child process environment
  • User environment variables are included in both pristine and non-pristine modes when --user is set
  • Added a stub UserEnv() on Windows (exec_windows.go) that fatals, consistent with the existing SwitchUser() behavior
  • Added unit tests in exec_unix_test.go covering UserEnv() output, process environment isolation, and integration with both exec modes in pristine and non-pristine configurations

@felixfontein felixfontein left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for working on this!

Comment thread cmd/sops/subcommand/exec/exec_windows.go Outdated
Signed-off-by: Andrew Block <andy.block@gmail.com>

@felixfontein felixfontein left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming you did run the root tests (I don't think they run in CI), this looks good!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants