Can I use the value of an environment variable in a sudoers rule

[Andy]

I want to do something like

ALL ALL=/bin/mount -o loop -t ext3 $HOME/* $HOME/*

to allow users to loopback mount a filesystem image, but only in their
own home directory.
by doing, for example

$ sudo /bin/mount -o loop -t ext3 $HOME/imagefile $HOME/mountpoint

That one passes the value of $HOME to sudo and rule doesn't match.
Single quoting $HOME to avoid shell interpretaion passes $HOME to /bin/
mount which
fails to understand.

I have set my /etc/sudoers to preserve the value of $HOME.
It will work with '/bin/bash' inserted but that seems wide open to
abuse.
Is there any way to get sudo to use the value of $HOME in a rule?

best

Andy

[Gerard H. Pille]

Andy wrote:
> I want to do something like
>
> ALL ALL=/bin/mount -o loop -t ext3 $HOME/* $HOME/*
>

Why not have a script that does that, and allow them to execute that script?

[Andy]

Because I can write any series of statements into the $HOME string

e.g. export HOME="; cd /; rm -rf * ; /etc/halt;"
sudo script

You could obviously try to scan the $HOME string but.....
Running a sudoed shell or other interpreter is a bad idea IMHO.

Andy

[Gerard H. Pille]

Andy wrote:
> Running a sudoed shell or other interpreter is a bad idea IMHO.
>
> Andy

As is using sudo.