/sbin:/usr/sbin in mortal's PATH

Chris Tyler chris at tylers.info
Sat May 6 19:40:14 UTC 2006


The /sbin and /usr/sbin directories contain many utilities that are
useful to non-superusers, such as ifconfig, netstat, arp, fuser, lsusb,
runlevel, dumpe2fs, hwclock, lsof, traceroute, and many others.
Obviously, most of those utilities can do -more- when run as superuser,
but that doesn't diminish their value to mortals.

For years, one of the first changes I've made to my Fedora (and RHL)
systems is to comment out 'if' in /etc/profile that adds
"/sbin:/usr/sbin:/usr/local/sbin" only to the path of the superuser:

	# Path manipulation
	#if [ $EUID = 0 ]; then
	        pathmunge /sbin
	        pathmunge /usr/sbin
	        pathmunge /usr/local/sbin
	#fi

Here's my question: Why don't we take that 'if' in the
default /etc/profile, so those directories are in everyone's (default)
PATH? Reasoning:

- This change may encourage users to perform more tasks as
non-superuser, which can only be a Good Thing(tm).

- Utilities which a mortal user can't/shouldn't use are already
protected from execution by permission or other mechanisms (e.g.,
explicit checks in 'neat' and 'lokkit').

- The hit for the additional path searching is miniscule. Really.

Thoughts? (Am I missing something?)

--
Chris Tyler




More information about the fedora-devel-list mailing list