这是不带sudo的PATH变量:
$ echo 'echo $PATH' | sh
/opt/local/ruby/bin:/usr/bin:/bin
这是sudo的PATH变量:
$ echo 'echo $PATH' | sudo sh
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
据我所知，sudo应该不影响PATH。这是怎么呢我该如何改变呢?(这是在Ubuntu 8.04上)。
更新:据我所知，没有一个脚本以任何方式以根更改PATH开始。
来自man sudo:
为了防止命令欺骗，sudo 检查“。和“”(都表示 当前目录)最后搜索 在用户的PATH(如果 一个或两个都在PATH中)。请注意, 然而，实际的路径 未修改环境变量 并原封不动地传递给程序 sudo执行。
当前回答
PATH是一个环境变量，因此在默认情况下由sudo重置。
您需要特殊的权限才能被允许这样做。
来自man sudo
-E The -E (preserve environment) option will override the env_reset
option in sudoers(5)). It is only available when either the match-
ing command has the SETENV tag or the setenv option is set in sudo-
ers(5).
Environment variables to be set for the command may also be passed on
the command line in the form of VAR=value, e.g.
LD_LIBRARY_PATH=/usr/local/pkg/lib. Variables passed on the command
line are subject to the same restrictions as normal environment vari-
ables with one important exception. If the setenv option is set in
sudoers, the command to be run has the SETENV tag set or the command
matched is ALL, the user may set variables that would overwise be for-
bidden. See sudoers(5) for more information.
用法示例:
cat >> test.sh
env | grep "MYEXAMPLE" ;
^D
sh test.sh
MYEXAMPLE=1 sh test.sh
# MYEXAMPLE=1
MYEXAMPLE=1 sudo sh test.sh
MYEXAMPLE=1 sudo MYEXAMPLE=2 sh test.sh
# MYEXAMPLE=2
更新
man 5 sudoers :
env_reset If set, sudo will reset the environment to only contain
the LOGNAME, SHELL, USER, USERNAME and the SUDO_* vari-
ables. Any variables in the caller's environment that
match the env_keep and env_check lists are then added.
The default contents of the env_keep and env_check
lists are displayed when sudo is run by root with the
-V option. If sudo was compiled with the SECURE_PATH
option, its value will be used for the PATH environment
variable. This flag is on by default.
所以可能需要检查这个是/没有编译。
在Gentoo中是默认的
# ( From the build Script )
....
ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}})
....
econf --with-secure-path="${ROOTPATH}"
其他回答
这似乎对我很管用
sudo -i
它采取非sudo路径
Secure_path是你的朋友，但如果你想让自己免于Secure_path，那就这样做吧
sudo visudo
和附加
Defaults exempt_group=your_goup
如果您想免除一堆用户，创建一个组，将所有用户添加到其中，并使用它作为您的豁免组。男人5 sudoer更多。
PATH是一个环境变量，因此在默认情况下由sudo重置。
您需要特殊的权限才能被允许这样做。
来自man sudo
-E The -E (preserve environment) option will override the env_reset
option in sudoers(5)). It is only available when either the match-
ing command has the SETENV tag or the setenv option is set in sudo-
ers(5).
Environment variables to be set for the command may also be passed on
the command line in the form of VAR=value, e.g.
LD_LIBRARY_PATH=/usr/local/pkg/lib. Variables passed on the command
line are subject to the same restrictions as normal environment vari-
ables with one important exception. If the setenv option is set in
sudoers, the command to be run has the SETENV tag set or the command
matched is ALL, the user may set variables that would overwise be for-
bidden. See sudoers(5) for more information.
用法示例:
cat >> test.sh
env | grep "MYEXAMPLE" ;
^D
sh test.sh
MYEXAMPLE=1 sh test.sh
# MYEXAMPLE=1
MYEXAMPLE=1 sudo sh test.sh
MYEXAMPLE=1 sudo MYEXAMPLE=2 sh test.sh
# MYEXAMPLE=2
更新
man 5 sudoers :
env_reset If set, sudo will reset the environment to only contain
the LOGNAME, SHELL, USER, USERNAME and the SUDO_* vari-
ables. Any variables in the caller's environment that
match the env_keep and env_check lists are then added.
The default contents of the env_keep and env_check
lists are displayed when sudo is run by root with the
-V option. If sudo was compiled with the SECURE_PATH
option, its value will be used for the PATH environment
variable. This flag is on by default.
所以可能需要检查这个是/没有编译。
在Gentoo中是默认的
# ( From the build Script )
....
ROOTPATH=$(cleanpath /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/opt/bin${ROOTPATH:+:${ROOTPATH}})
....
econf --with-secure-path="${ROOTPATH}"
我认为实际上让sudo重置PATH是可取的:否则，攻击者已经破坏了你的用户帐户，可以在你的用户的PATH上放置各种工具的后门版本，并且在使用sudo时它们将被执行。
(当然，让sudo重置PATH并不能完全解决这类问题，但它有帮助)
这确实是当你使用
Defaults env_reset
在/etc/sudoers中，不使用豁免组或env_keep。
这也很方便，因为您可以将只对根目录有用的目录(例如/sbin和/usr/sbin)添加到sudo路径，而不必将它们添加到用户的路径中。使用实例指定sudo使用的路径。
Defaults secure_path="/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin"
只需在/etc/sudoers中编辑env_keep即可
它看起来是这样的:
默认值env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASURE LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL L language LINGUAS XDG_SESSION_COOKIE"
只需要在最后附加PATH，所以在更改之后，它看起来就像这样:
默认值env_keep = "LANG LC_ADDRESS LC_CTYPE LC_COLLATE LC_IDENTIFICATION LC_MEASURE LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME LC_ALL L language LINGUAS XDG_SESSION_COOKIE路径"
关闭终端，然后再次打开。
