Bug 467605 - Add sbin in $PATH environment
Add sbin in $PATH environment
Status: CLOSED DEFERRED
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: setup (Show other bugs)
5.2
All Linux
medium Severity medium
: rc
: ---
Assigned To: Ondrej Vasik
BaseOS QE
:
: 467610 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-10-19 03:55 EDT by Andrew
Modified: 2009-02-06 09:46 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-02-06 09:46:06 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Andrew 2008-10-19 03:55:59 EDT
Omitting system binary path is a type of "security through obscurity". In most cases, this method of security is not hard to defeat. Not including sbin dir will not make a system more secure. When a normal user wants to execute a file within that directory, if he has permission, all he has to do is to add prefix /sbin to the execute file name. I believe it is never a good idea to secure a system though obscurity. In this case, let the permission handle the authorisation. If you do not want a normal user execute a system binary file, chmod it properly.
Comment 1 Radek Bíba 2008-10-20 04:05:04 EDT
*** Bug 467610 has been marked as a duplicate of this bug. ***
Comment 2 Radek Bíba 2008-10-20 04:16:03 EDT
It's not a question of security. The thing is most utilities in /sbin and /usr/sbin require root privileges because they access or modify stuff that can only be accessed or modified by root, so why would you want to run them? Why should bash bother looking for commands in these directories?

Anyway, there are utilities there that can partially work for normal users as well, and as a matter of coincidence, the plan is to add these directories to $PATH of normal users in Fedora 10 - http://fedoraproject.org/wiki/Features/SbinSanity . Not sure this is something to do in RHEL 5, though.
Comment 3 Roman Rakus 2009-01-06 07:58:22 EST
And to be precise, bash only reads PATH env, but not set it.
Comment 4 Ondrej Vasik 2009-02-06 09:46:06 EST
Closing DEFERRED, that's not something what should be changed in RHEL-5 - change in behaviour - but as it is already added in Fedora(after sbin sanity check - to F10), I guess it would be added in RHEL-6.

Note You need to log in before you can comment on or make changes to this bug.