Vyacheslav Matjukhin

So, imagine you're a CentOS user, and you want to install a CPAN module into the system. Let's say you want to install cpanm.

You get the root shell with sudo -s.
You enter: cpan App-cpanminus.
And then you enter: cpanm --help... and oops:

[root@localhost vagrant]# cpanm --help
bash: cpanm: command not found

WAT?

What just happened is that cpan installs scripts into /usr/local/bin/, and /usr/local/bin/ is not in the root's $PATH.

I don't think CPAN toolchain is to blame here. But I think that if you can't run the software you just installed, something somewhere is horribly wrong.

But wait, there's more.
There're several different ways to get the root shell:

1. sudo -s
2. su -
3. su

Let's see...

[vagrant@localhost ~]$ sudo -s
[root@localhost vagrant]# echo $PATH
/sbin:/bin:/usr/sbin:/usr/bin

[vagrant@localhost ~]$ su
Password:
[root@localhost vagrant]# echo $PATH
/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/vagrant/bin

[vagrant@localhost ~]$ su -
Password:
[root@localhost ~]# echo $PATH
/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin

The first one, sudo -s, uses the secure_path option from /etc/sudoers.

The second one, su, inherits the current user's environment.

And the third one, su -, is the same as su -l, makes the shell a login shell, which resets the environment, so that it's the same as if you'd login with the root account initially.

But wait, it gets worse. Let's try cron:

[root@localhost ~]# crontab -l
* * * * * perl -E 'say $ENV{PATH}' >/tmp/cron.path

[root@localhost ~]# cat /tmp/cron.path
/usr/bin:/bin

Cron is the reason I wrote this post in the first place. The most popular complain about my Ubic these days is that it doesn't start services after the reboot. That's because Ubic bootstraps services on reboot with the crontab, which doesn't include /usr/local/bin/ (because there are many ways to setup Ubic, e.g., with perlbrew, so I didn't want to make any assumptions about the user's environment).
I'm giving up. I'm just going to always add /usr/local/bin to $PATH if it's not already there.

BTW, sudo -s $PATH issue is more RedHat-family specific, but cron's $PATH issue is not, as far as I know.

But why? What's the reason for all this? Is it for the sake of security? Can there really be such a program that's safe to keep in /usr/local/bin, accessible to all users, but not to the root? Really?

PS: I know, I know, everyone should use Perlbrew. I agree, but don't forget to source $HOME/perl5/perlbrew/etc/bashrc everywhere, especially in your crontabs.

If you enjoyed this blog post, you could give me a +1 on the questhub for it.