sudo not looking into /usr/local

[Samuel Rakitničan]

Hi,

Something I stumbled upon today is that there is no convenient way by default to make some
custom script accessible via sudo without specifying full path. Found out that sudo have
limited set of paths in its environment that is looking into [1]. Sadly, none of it is
appropriate for custom scripts. I think it would be nice to include /usr/local/bin and
/usr/local/sbin also.

[1] http://unix.stackexchange.com/a/8652

[Anoop C S]

On Tue, 2016-11-15 at 18:42 +0000, Samuel Rakitničan wrote:
>  Hi,
>  
>  Something I stumbled upon today is that there is no convenient way by default to make
> some custom
>  script accessible via sudo without specifying full path. 
What about -E option?

> Found out that sudo have limited set of paths in its environment that is looking into
[1]. Sadly,
> none of it is appropriate for custom scripts. I think it would be nice to include
/usr/local/bin
> and /usr/local/sbin also.
> 
> [1] http://unix.stackexchange.com/a/8652
> _______________________________________________
> devel mailing list -- devel(a)lists.fedoraproject.org
> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org

[Samuel Rakitničan]

>  On Tue, 2016-11-15 at 18:42 +0000, Samuel Rakitničan wrote:
>  
>  What about -E option? 
Thanks for that, didn't take this into consideration. -E option however seems to have
no effect on PATH environment variable.

$ sudo -E env | grep ^PATH
PATH=/sbin:/bin:/usr/sbin:/usr/bin

Following however works, but I don't find it convenient, I might as well type in the
whole path (easier to remember). More so, I don't want the whole user's PATH
including user's /home, but just fewer safe locations.

$ sudo PATH=$PATH env | grep ^PATH

[Jens Lody]

Am 16.11.2016 08:08, schrieb Samuel Rakitničan:
> > On Tue, 2016-11-15 at 18:42 +0000, Samuel Rakitničan wrote:
> > 
> > What about -E option?
>  
>  Thanks for that, didn't take this into consideration. -E option
>  however seems to have no effect on PATH environment variable.
>  
>  $ sudo -E env | grep ^PATH
>  PATH=/sbin:/bin:/usr/sbin:/usr/bin
>  
>  Following however works, but I don't find it convenient, I might as
>  well type in the whole path (easier to remember). More so, I don't
>  want the whole user's PATH including user's /home, but just fewer safe
>  locations.
>  
>  $ sudo PATH=$PATH env | grep ^PATH 
You can change the default behaviour in "/etc/sudoers" or (better) by 
adding a file in "/etc/sudoers.d".

If you want to keep the users path, add:

Defaults env_keep += "PATH"
Defaults !secure_path

or to change the (default) secure path, just add

Defaults secure_path = /your/path/here:/as/usual

[Samuel Rakitničan]

>  Am 16.11.2016 08:08, schrieb Samuel Rakitničan:
>  
>  You can change the default behaviour in "/etc/sudoers" or (better) by 
>  adding a file in "/etc/sudoers.d".
>  
>  If you want to keep the users path, add:
>  
>  Defaults env_keep += "PATH"
>  Defaults !secure_path
>  
>  or to change the (default) secure path, just add
>  
>  Defaults secure_path = /your/path/here:/as/usual 
File in /etc/sudoers.d is neat, thanks. But I am hoping we can came up with a new default
setting or is there a reason not to include anything else?

I was thinking about it some more, and I think this setting does more harm then good. It
limits what users can do but it doesn't stop them to bypass it with a simple alias
sudo="sudo PATH=$PATH". So in my opinion the original "If you don't
trust the people running sudo to have a sane PATH environment variable you may want to use
this." kind of defeats its purpose.

[Mathieu Bridon]

On Wed, 2016-11-16 at 14:19 +0000, Samuel Rakitničan wrote:
>  > Am 16.11.2016 08:08, schrieb Samuel Rakitničan:
>  > 
>  > You can change the default behaviour in "/etc/sudoers" or (better)
>  > by adding a file in "/etc/sudoers.d".
>  > 
>  > If you want to keep the users path, add:
>  > 
>  > Defaults env_keep += "PATH"
>  > Defaults !secure_path
>  > 
>  > or to change the (default) secure path, just add
>  > 
>  > Defaults secure_path = /your/path/here:/as/usual
>  
>  File in /etc/sudoers.d is neat, thanks. But I am hoping we can came
>  up with a new default setting or is there a reason not to include
>  anything else?
>  
>  I was thinking about it some more, and I think this setting does more
>  harm then good. It limits what users can do but it doesn't stop them
>  to bypass it with a simple alias sudo="sudo PATH=$PATH". So in my
>  opinion the original "If you don't trust the people running sudo to
>  have a sane PATH environment variable you may want to use this." kind
>  of defeats its purpose. 
Note that there's been a ticket in Bugzilla requesting this for two
years:

    https://bugzilla.redhat.com/show_bug.cgi?id=1166185


-- 
Mathieu