On Mon, 24 Mar 2025 13:59:00 -0700 John Darrah <xyl...@gmail.com> wrote:
> I encountered the following error while upgrading a 'testing/trixie'
> install.
>
> Setting up network-manager (1.52.0-5) ...
> Insecure $ENV{CDPATH} while running with -T switch at
> /usr/share/perl5/Debian/AdduserLogging.pm line 157.
> dpkg: error processing package network-manager (--configure):
> installed network-manager package post-installation script
> subprocess returned error exit status 25
>
> I unset CDPATH, then reinstalled and it completed without an error. I
> would think the apt toolchain should not allow the root interactive
> environment to be exposed while installing packages.
This isn't really the fault of apt. apt may legitimately need to
change its behavior in response to environment variables, and there are
packages (at least outside of the Debian archive, and maybe inside as
well) that change their behavior depending on the environment they're
called with. Kicksecure's packages are an example of this, and they
very much benefit from the environment propagating like this.
The program that should be sanitizing your environment is whatever
privilege escalation tool you're using (usually sudo). If it's not
sanitizing your environment properly, you may want to check your
sudoers configuration and change it so it does sanitize things
properly. Alternatively, if you're logging in as root and then running
apt, you can use "env -i" to sanitize the environment before calling
apt.
--
Aaron
> -- john
pgp_fgLRk36QQ.pgp
Description: OpenPGP digital signature
