How to Safely Add /sbin and /usr/sbin to a User's PATH in Linux

On Debian, administrative paths like /sbin and /usr/sbin are intentionally excluded from a regular user's $PATH, even when using sudo or su (without the - flag). This design choice emphasizes security and ensures that users don't unintentionally execute commands meant for root. However, if a user frequently needs commands from these directories, adding them to their $PATH can save time and improve workflow. This guide explains why these paths are excluded and how to add them safely while maintaining good security practices.

Why Aren't /sbin and /usr/sbin in the PATH by Default?

Debian separates user and administrative environments to reduce the risk of accidental or unauthorized use of system-critical commands. When you run sudo or su without the - flag, your environment retains the user’s $PATH, excluding directories like /sbin. Only when you explicitly invoke su - or configure the system to add these paths will they appear.

This behavior is designed to encourage intentional command execution and avoid confusion. However, if you trust the user and the system is in a controlled environment, you can add /sbin to their $PATH for convenience.

Steps to Add /sbin to a User’s PATH

Follow these steps to safely add /sbin and /usr/sbin to a user’s $PATH.

1. Temporarily Add /sbin to PATH

If the need for /sbin commands is temporary, you can add it for the current session:

export PATH=$PATH:/sbin:/usr/sbin

This change lasts only for the current terminal session and won’t affect other users or persist after logout.

2. Permanently Add /sbin to PATH

To make the change permanent for a specific user, edit their ~/.bashrc or ~/.profile file:

nano ~/.bashrc

Add the following line at the end of the file:

export PATH=$PATH:/sbin:/usr/sbin

Save the file and reload the shell configuration:

source ~/.bashrc

Verify the change by running:

echo $PATH

3. Understand the Risks

Adding /sbin to a user’s $PATH doesn’t inherently make the system less secure, especially if the user already has sudo privileges. However, it does expose administrative commands to their shell environment, increasing the likelihood of accidental use. To mitigate risks:

• Ensure the user understands the potential impact of these commands.
• Encourage the use of sudo to ensure intentional command execution.

When Should You Add /sbin to PATH?

Adding /sbin to a user’s $PATH is appropriate when:

• The user frequently uses commands from /sbin or /usr/sbin.
• The system is in a trusted or personal environment.
• Convenience outweighs the slight risk of accidental command use.

Conclusion

Debian’s default behavior of excluding /sbin and /usr/sbin from a regular user’s $PATH is intentional and prioritizes security. However, in controlled environments or for trusted users, adding these paths can improve productivity. By following these steps, you can safely make the change while maintaining best practices.