Bug 1166185 - Add /usr/local/sbin and /usr/local/bin to secure_path
Summary: Add /usr/local/sbin and /usr/local/bin to secure_path
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: sudo
Version: 24
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Radovan Sroka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1506582 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-20 14:31 UTC by Alexandre Franke
Modified: 2017-12-14 11:45 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-12-14 11:30:36 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Update the sudoers secure_path (1.99 KB, patch)
2016-07-19 19:42 UTC, Mathieu Bridon
no flags Details | Diff

Description Alexandre Franke 2014-11-20 14:31:24 UTC
Software installed in /usr/local/sbin can not be run with sudo


Steps to Reproduce:
1. Install software foo in /usr/local/sbin
2. Run sudo foo

Actual results:
foo is not found

Expected results:
foo runs

Additional info:
http://fedoraproject.org/wiki/Features/SbinSanity states that /usr/local/sbin was added to PATH for all users, but that's not enough.

For info, Ubuntu has secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Maybe /usr/local/bin should be added too.

Comment 1 Fedora End Of Life 2015-05-29 13:20:22 UTC
This message is a reminder that Fedora 20 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 20. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '20'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 20 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 2 Mathieu Bridon 2015-05-29 13:50:52 UTC
The behaviour described by the OP is still the same on F22.

Comment 3 Fedora End Of Life 2016-07-19 12:25:49 UTC
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 4 Mathieu Bridon 2016-07-19 12:45:44 UTC
This is still the case in Fedora 24.

Comment 5 Haïkel Guémar 2016-07-19 13:13:32 UTC
Daniel could you answer?

Comment 6 Mathieu Bridon 2016-07-19 19:41:35 UTC
Ok, so I reproduced this issue:

  $ cat /usr/local/bin/mooh 
  #!/bin/bash
  echo "mooh"
  $ mooh
  mooh
  $ su -
  # mooh
  mooh
  # logout
  $ sudo mooh
  sudo: mooh: command not found

Comment 7 Mathieu Bridon 2016-07-19 19:42:44 UTC
Created attachment 1181793 [details]
Update the sudoers secure_path

This commit removes /sbin and /bin from the secure_path, as they are
symlinks to /usr/sbin and /usr/bin and therefore don't need to be listed
twice.

This commit also adds /usr/local/sbin and /usr/local/bin to the
secure_path, as they already are in the default PATH.

https://bugzilla.redhat.com/show_bug.cgi?id=1166185

Comment 8 Daniel Kopeček 2016-07-20 07:59:53 UTC
Hello. I won't change the distribution defaults because of custom scripts in /usr/local. You can adjust the configuration to suit your needs. No package in Fedora should install executables under /usr/local and if it does, then it's most likely a bug.

Please see the Fedora packaging guidelines:

https://fedoraproject.org/wiki/Packaging:Guidelines#No_Files_or_Directories_under_.2Fsrv.2C_.2Fusr.2Flocal.2C_or_.2Fhome.2F.24USER

"
In addition, no Fedora package can contain files or directories or modify files under:

    /usr/local as these directories are not permitted to be used by Distributions in the FHS
"

Comment 9 Mathieu Bridon 2016-07-20 08:19:54 UTC
Daniel, whether packages in Fedora install things in /usr/local or not is not the point. (and you're right that they don't, and shouldn't)

The point is, /usr/local/bin and /usr/local/sbin are in $PATH. They are also in sudo's secure_path in other popular distributions.

Given those two arguments, it would make sense to add them to secure_path in Fedora.

Comment 10 Daniel Kopeček 2016-07-20 08:32:31 UTC
(In reply to Mathieu Bridon from comment #9)
> Daniel, whether packages in Fedora install things in /usr/local or not is
> not the point. (and you're right that they don't, and shouldn't)
> 
> The point is, /usr/local/bin and /usr/local/sbin are in $PATH. They are also
> in sudo's secure_path in other popular distributions.
> 
> Given those two arguments, it would make sense to add them to secure_path in
> Fedora.

Maybe this a good candidate for a FESCo ticket which you can create at https://fedorahosted.org/fesco/. I don't see a point in supporting paths in the default configuration that cannot contain executables from installed packages.

Comment 11 Laurent Bigonville 2016-11-16 14:06:24 UTC
> I don't see a point in supporting paths in the default configuration that cannot contain executables from installed packages.

For consistency with the other distributions and convinance for the users installing custom scripts/software?

Comment 12 srakitnican 2016-11-17 16:12:30 UTC
Hello,

I have opened FESCo ticket: https://pagure.io/fesco/issue/1646

Comment 13 Matthew Miller 2017-10-26 11:05:18 UTC
*** Bug 1506582 has been marked as a duplicate of this bug. ***

Comment 14 Kevin Kofler 2017-10-26 15:31:18 UTC
But the current behavior is inconsistent with how the regular PATH for root (as in "su -") is set up. Fedora should have consistent defaults.

Comment 15 Dominik 'Rathann' Mierzejewski 2017-10-26 15:49:02 UTC
FESCo has already decided on this issue (https://pagure.io/fesco/issue/1646 mentioned in comment #12), so unless you have convinced the current FESCo otherwise, it makes no sense to reopen this bug.

Comment 16 Kevin Kofler 2017-10-26 16:17:34 UTC
https://pagure.io/fesco/issue/1788

Comment 17 Kevin Kofler 2017-10-26 16:26:05 UTC
I was hoping that this would not have to go through FESCo again and that consistency would be a strong enough argument to convince the maintainer directly. But apparently I was wrong.

Comment 18 Kevin Kofler 2017-11-19 17:05:37 UTC
FESCo ruled that "The setup and sudo package maintainers are free to make the decision about this issue without FESCo", so this is no longer a FESCo matter, reopening.

Comment 19 Radovan Sroka 2017-12-14 11:30:36 UTC
Hi,

I made requested change in rawhide. Please check it out. It is included in "sudo-1.8.22-0.1.b1.fc28".
I don't want to push it to stable fedoras so it will be in next branched fedora(28).


Note You need to log in before you can comment on or make changes to this bug.