Why is www's $PATH only /usr/bin:/bin?

[Steve O'Hara-Smith]

On Tue, 26 Apr 2016 21:40:48 +0200
Niklaas Baudet von Gersdorff <stdin at niklaas.eu> wrote:

> Hi,
> 
> I figured that www's $PATH is only /usr/bin:/bin. Why is that if
> /etc/login.conf says the following?
> 
>     default:\
>     --------8<--------
>         :path=/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin
> ~/bin:\
>     --------8<--------

	I assume you mean this is the path available to CGI or similar
running under a web server. If so then the reason for the discrepancy is at
least in part that user www never logged in ...

> /etc/passwd looks like this.
> 
>     www:*:80:80:World Wide Web Owner:/nonexistent:/usr/sbin/nologin

	... and indeed cannot log in so the login.conf is not going to
apply. It is also possible (indeed likely) that the web server deliberately
minimises the path passed to CGI scripts for security.

> So, I left everything the default.
> 
> The thing is that I want to run something in /usr/local/bin with PHP's
> 
>     shell_exec($cmd);
> 
> but that's not working because it's not in $PATH.
> 
> Any hint is very much appreciated.

	It should be possible to adjust the path seen by PHP in the PHP
config.

-- 
Steve O'Hara-Smith <steve at sohara.org>