Potential Security Risk with PATH statement

English Open Chat
#1

The Tumbleweed PATH statement reads as follows

before expansion
$HOME/bin:/usr/local/bin:/usr/bin:/bin:/usr/games

within the .profile

/home/leslie/bin:/usr/local/bin:/usr/bin:/bin:/usr/games

What I question is why the user’s home bin directory is first in the list. Should it not be last?
This placement suggests that a local executable can take precedence over a system one, leading to a potential security risk.

If the ${HOME}/bin does not exist, should it even be in the path statement at all?

If Tumbleweed is to include the $PATH statement with the user’s optional bin directory I believe the path statement
should be similar to the one below

I modified my .profile as follows

PATH=/usr/local/bin:/usr/bin:/bin:/usr/games:

The following is to provide

#protection from exiting terminal mode and returning multiple times.

U=~/.local.bin:~/bin
if ! echo “$PATH” | grep -q “home”; then
export PATH=$PATH:${U}
fi

testing outside of .profile
echo $PATH

/usr/local/bin:/usr/bin:/bin:/usr/games:/home/leslie/.local/bin:/home/leslie/bin

#2

First, please to keep your posts readable, put all computer text between CODE tags (the # button in the tool bar of the post editor). Amongst several other important effects, it will clearly show us which is story telling and which is computer facts.

Like; my PATH:

henk@boven:~> echo $PATH
/home/henk/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/X11R6/bin:/usr/games:/opt/kde3/bin:/home/henk/.local/bin
henk@boven:~>

The above also includes the prompts and the command. Easy to include them in one’s mouse sweep and it gives more, offen needed information.

=================================

Then about your question.

I did not read all of what you posted (mostly because of the lack of formatting), but the contents of the PATH variable can be a subject of many debates. What you get at installation and later at user creation, are, as you said, defaults. First the system administrator can of course deviate from that and secondly each user can change there what he likes.

You can of course doubt if the default is the best default possible. This is again debatable. Defaults in a Linux distribution are often made in a way that the Linux noob can start working without having to have much Unix/Linux knowledge.

I see e.g. that you think that your ~/bin should not be in the first place. The argument here could be that when one creates an executable ~/bin/kill (because the noob user would not know that there is already a /bin/kill, is he supposed to check all of the other directories in the PATH variable to see if there is a kill?), he would not see “his” kill executed.
I do not see the security risk you see. The user will execute kill and his kill will run, as he expects.

You may be afraid that another user (in most cases root) will use his PATH without knowing what is in there and tthus go wrong. This is a well known threat and I quote the SDB document https://en.opensuse.org/SDB%3ALogin_as_root:

When longer root access is needed use the su command. A new shell is started with root privileges. The usage of the option - (or -l or --login) is strongly recommended because it starts the shell for root as a login shell. This means that all initializations run during a normal login is done and among other things this will give you the correct PATH variable. When not doing this you will have the PATH variable of happy/admin which may contain unexpected directories which may contain dangerous executables. Most notorious is the directory . (your working directory).

This good practice is btw mentioned in numerous posts here also.
And you will notice that ~/bin is in another place in root’s PATH:

boven:~ # echo $PATH
/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/X11R6/bin:/usr/games:/opt/kde3/bin
boven:~ #

And you are correct that when ~/bin does not exist, there is no use (but it is not dangerous) for it in the PATH. But ~/bin is created by default (the adminstrator can change that of course) and when the user understands enough of Linux to feel he can delete it, he then can also adapt his PATH IMHO.

#3

You can change “.profile”. And you can create your own “.bashrc” if you wish. That way, you can control how the path is set when you login.

What I question is why the user’s home bin directory is first in the list. Should it not be last?

Personal preference.

I have it first. That way, I can write a short shell script that takes precedence over a system command. I occasionally find that useful.

This placement suggests that a local executable can take precedence over a system one, leading to a potential security risk.

The local executable might be a shell script that then invokes the system command (via a full path) with particular parameters. This can be a convenience and need not be a security risk.

If the ${HOME}/bin does not exist, should it even be in the path statement at all?

This doesn’t actually matter, and is harmless.

I modified my .profile as follows

PATH=/usr/local/bin:/usr/bin:/bin:/usr/games:

I would have omitted that final “:”, which I do see as a potential security risk.