Does sudo a command temporarily change $PATH to be the root's?

When running sudo under a user login session, will that change $PATH to be the root's $PATH during the running of sudo ?

sudo will change $PATH variable, depend on your security policy. From sudo man page:

PATH
    May be overridden by the security policy.

In most system, env_reset option is enabled by default, this causes commands to be executed with a minimal environment containing TERM, PATH, HOME, SHELL, LOGNAME, USER and USERNAME in addition to variables from the invoking process permitted by the env_check and env_keep sudoers options.

For security reason, /etc/sudoers has secure_path option to set the safe PATH for sudo:

Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

If relies on the user's $PATH, not the root's $PATH, how can the user run sudo successfully?

Because the user's PATH can be preserved when you run sudo. You can always do:

sudo env "PATH=$PATH" <command>

This is actually configuration-dependent. There is an env_reset option in sudoers that, combined with env_check and env_delete, controls whether to replace, extend, or pass through some or all environment variables, including PATH.

The default behaviour is to have env_reset enabled, and to reset PATH. The value PATH is set to can be controlled with the secure_path option, and otherwise it is determined by the user configuration.

You can disable env_reset or add PATH to env_keep to change that behaviour, but note that it may not have the effect you want overall - there are often directories (sbin) in root's PATH that aren't in your user's. You can enable setenv instead to allow overriding environment for a single execution of sudo using the -E option to sudo.

All of these could be changed in your distribution's default configuration already. Run sudo visudo to have a look at what's currently in your sudoers file.


There are alternative approaches. One simple one is to use sudo's built-in environment variable setting or env:

sudo PATH="$PATH" command ...
sudo env PATH="$PATH" command ...

will both run just this command with your current user's PATH. You can set other variables there as well in the same way, which is often useful. One or other of those may be disallowed by your configuration.


Do you need to get an interactive login root shell?

sudo -H -i

from man sudo:

 -H          The -H (HOME) option requests that the security policy set the HOME environment variable to the home directory of the
             target user (root by default) as specified by the password database.  Depending on the policy, this may be the default
             behavior.


 -i [command]
             The -i (simulate initial login) option runs the shell specified by the password database entry of the target user as a
             login shell.  This means that login-specific resource files such as .profile or .login will be read by the shell.  If a
             command is specified, it is passed to the shell for execution via the shell's -c option.  If no command is specified,
             an interactive shell is executed.  sudo attempts to change to that user's home directory before running the shell.  The
             security policy shall initialize the environment to a minimal set of variables, similar to what is present when a user
             logs in.  The Command Environment section in the sudoers(5) manual documents how the -i option affects the environment
             in which a command is run when the sudoers policy is in use.

Tags:

Path

Sudo