Skip to content

fix(vim): prevent E12 and E523 errors when sourced in secure mode#241

Merged
arran4 merged 2 commits intomainfrom
fix/vimrc-secure-mode-guard-8414635880217990202
Mar 3, 2026
Merged

fix(vim): prevent E12 and E523 errors when sourced in secure mode#241
arran4 merged 2 commits intomainfrom
fix/vimrc-secure-mode-guard-8414635880217990202

Conversation

@google-labs-jules
Copy link
Contributor

When sudo vim is executed from the user's home directory, Vim attempts to source the local .vimrc. Because the file is owned by the user (uid 1000) and the effective user is root (uid 0), Vim treats it as an untrusted exrc file and evaluates it in a "secure" sandbox.

Because our .vimrc makes use of auto-commands, mapping overrides, and other operations restricted in secure mode, sudo vim fails to load correctly, producing a slew of E12 and E523 errors:

Error detected while processing /home/arran/.vimrc[1]../usr/share/vim/vim91/syntax/syntax.vim[16]../usr/share/vim/vim91/syntax/nosyntax.vim:
line   15:
E12: Command not allowed from exrc/vimrc in current dir or tag search: au! Syntax
...

This PR resolves this issue by adding a guard at the top of dot_vimrc. If &secure is set, it executes finish to immediately stop loading the file, avoiding the restricted commands. This cleanly suppresses the errors while keeping the user's configuration entirely intact for normal use.


PR created automatically by Jules for task 8414635880217990202 started by @arran4

When running `sudo vim` from a user's home directory, Vim sources the local
`.vimrc`. If the owner of that file does not match the effective user (e.g.,
`arran` vs `root`), Vim executes it with the `secure` option enabled as a
security precaution.

This caused a barrage of errors like "E12: Command not allowed from
exrc/vimrc" and "E523: Not allowed here" because our `.vimrc` contains
restricted commands such as `autocmd`, `syntax on`, and mapping overrides
that aren't allowed in secure mode.

This commit adds a guard at the very beginning of the `.vimrc` file. If
the `secure` option is active, we simply call `finish` to abort loading
the rest of the user configuration. This correctly suppresses the errors and
lets `sudo vim` fall back cleanly to a standard system configuration.
@google-labs-jules
Copy link
Contributor Author

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

@arran4
Copy link
Owner

arran4 commented Mar 3, 2026

@jules is it possible to address the issue or it a security feature?

@google-labs-jules
Copy link
Contributor Author

@jules is it possible to address the issue or it a security feature?

Yes, secure mode is a built-in Vim security feature. When you run sudo vim from your home directory, Vim runs as the root user but tries to load the .vimrc file from the current directory (which is owned by your user account). To prevent a potentially malicious .vimrc from executing dangerous commands as root, Vim automatically evaluates the file in a restricted sandbox (secure mode).

Because your .vimrc contains commands like autocmd (syntax on), which are not allowed in this restricted mode, it triggers a long list of E12 and E523 errors.

The fix I provided (if &secure | finish | endif) is the standard and safest way to address this. It detects if Vim is running in this restricted mode and immediately stops evaluating the file, cleanly suppressing the errors while letting sudo vim fall back to its safe, default configuration.

When running `sudo vim` from a user's home directory, Vim sources the local
`.vimrc`. If the owner of that file does not match the effective user (e.g.,
`arran` vs `root`), Vim executes it with the `secure` option enabled as a
security precaution.

This caused a barrage of errors like "E12: Command not allowed from
exrc/vimrc" and "E523: Not allowed here" because our `.vimrc` contains
restricted commands such as `autocmd`, `syntax on`, and mapping overrides
that aren't allowed in secure mode.

This commit adds a guard at the very beginning of the `.vimrc` file. If
the `secure` option is active, we simply call `finish` to abort loading
the rest of the user configuration. This correctly suppresses the errors and
lets `sudo vim` fall back cleanly to a standard system configuration.
@arran4 arran4 merged commit 3f63009 into main Mar 3, 2026
4 checks passed
@arran4 arran4 deleted the fix/vimrc-secure-mode-guard-8414635880217990202 branch March 3, 2026 02:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant