Alfred Perlstein alfred at freebsd.org
Fri Dec 25 07:42:04 UTC 2015

On 12/24/15 3:13 PM, Jilles Tjoelker wrote:
> In <paths.h> there is a #define _PATH_DEFPATH which is set to
> /usr/bin:/bin. This does not include /sbin, /usr/sbin and ports
> (/usr/local/bin and /usr/local/sbin) directories and is therefore often
> insufficient.
> This is rarely a problem because _PATH_DEFPATH is overridden by
> /etc/login.conf, ~/.login_conf and/or shell startup files. _PATH_DEFPATH
> is still used as a default by execlp(), execvp(), posix_spawnp() and sh
> if PATH is not set, and by cron.
> Especially the latter is a common trap (most recently in PR 204813). We
> can fix it for 99% by changing _PATH_DEFPATH to
> /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
> This is the path in the default class in the default /etc/login.conf,
> excluding ~/bin which would not be expanded properly in a string
> constant.
> For consistency, the _PATH_DEFPATH for RESCUE below and in 3 man pages
> (exec.3, posix_spawn.3, crontab.5) need to be adjusted as well.
I have stubbed toes against this silly restricted path so many times 
that this would be a welcome change.

However before changing the PATH please consult secteam to make sure 
it's safe.

I might recommend for the time being going with the suggestion in the PR 
which asks that a friendly note be added to files.  This would be more 
"safe" until secteam can analyze.


More information about the freebsd-arch mailing list