1

I am aware of the --preserve-env or -E flag in sudo, however, it seems like this flag causes sudo to act weird in Fedora.

I installed ranger with LinuxBrew, Here's what I get when I type in which ranger as a non-root user:

$ which ranger
/home/linuxbrew/.linuxbrew/bin/ranger

And if I sudo,

$ sudo -E which ranger
which: no ranger in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin)

$ sudo -E echo $PATH
/usr/lib64/qt-3.3/bin:/usr/share/Modules/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/home/david/bin:/home/david/.gem/ruby/2.6.0:/home/david/prog/flutter/bin:/home/david/go/bin:/home/linuxbrew/.linuxbrew/bin:/home/david/.local/bin:/snap/bin:/var/lib/snapd/snap/bin:/home/david/.gem/ruby/2.6.0:/home/david/go/bin:/home/linuxbrew/.linuxbrew/bin:/home/david/.local/bin:/snap/bin:/home/david/prog/flutter/bin

$ sudo -E ranger
sudo: ranger: command not found

But things get weirder:

sudo --preserve-env=PATH which ranger
/home/linuxbrew/.linuxbrew/bin/ranger

$ sudo --preserve-env=PATH ranger
sudo: ranger: command not found

Can anyone explain what the actual heck is going on here?

Any help will be appreciated!

0

1 Answer 1

4

This is a security feature of sudo. In your /etc/sudoers file, you should have a line such as :

Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin

The meaning of the secure_path option is given in the man page of sudoers:

secure_path : Path used for every command run from sudo. If you don't trust the people running sudo to have a sane PATH environment variable you may want to use this. Another use is if you want to have the “root path” be separate from the “user path”. Users in the group specified by the exempt_group option are not affected by secure_path. This option is not set by default.

If you want to avoid this behavior you can define the exempt_group option in /etc/sudoers with your user inside it. Such as:

Defaults exempt_group+=jo

On some old RHEL distibutions, you have to create a system group for this: see https://access.redhat.com/solutions/150783

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .