Sudo can't see symbollically linked executables in path

Question

On CentOS 7, I installed some executables in /opt/app-version/bin/executable. Those executables have the following permissions:

rwxrwxr-x. 500 500

Ownership of every directory in the path /opt/app-version/bin/ is 500 500--except /opt, which is root root.

My first question: what is this 500 500 business? Given that I installed the executables using sudo, shouldn't the owner and group be root?

I've run the following command as root to create symbolic links to the executables in /usr/local/bin/:

ln /opt/app-version/bin/executable /usr/local/bin/executable --symbolic

I am able to run executable from the command line as a regular user, but not as a regular user using sudo.

Running sudo executable returns sh: executable: command not found.

Running sudo echo $PATH shows that /usr/local/bin/ is in $PATH for sudo environments. ( Or does it? Am I seeing the contents of $PATH for the super user environment, or $PATH for the environment of the user that called sudo? Does CentOS create a new environment for commands run with sudo, or does it just run the command in the caller's environment? )

Running sudo ls -la /usr/local/bin/executable returns a listing for executable in /usr/local/bin/ with ownership lrwxrwxrwx. 1 root root. ( Does ln --symbolic really create globally editable links by default? Isn't that--a horrible idea? ) My understanding is that this shows sudo should be able to run executable.

What am I missing?

Answer 1

Looking first at the 500 500, if you restore from a tar archive (among others) the owner and group will be preserved from the system where the archive was created: I'm guessing that the installer does this, and if the restored user or group does not exist on your system the numeric value is displayed.

Looking now at the PATH, I have reproduced this on Ubuntu, and it seems that sudo modifies PATH: in your command sudo echo $PATH the PATH variable was expanded in the original shell before calling sudo. There is a file /etc/sudoers with an entry "defaults secure_path="...", and this seems to be what is used.

If you use sudo sh -c 'echo $PATH' you will get a better idea of the PATH being used. Note that I deliberately used sh instead of bash in order to bypass some of the initialisation files, which may change things, although sh will of course have some of its own.

On Ubuntu, the secure_path line does contain /user/local/bin, but CentOS may be different (both are derived from Debian, but according to man sudoers SELinux may override some entries). As far as I can see you have at least four options:-

• Modify secure_path to include `/usr/local/bin'.
• Put the link into one of the directories defined in secure_path.
• Use su -c "{command} {parameters}" instead of sudo {command} {parameters}.
• Use sudo -s to get a root bash with the same PATH initialisation as the original shell, then call your executable from there and exit afterwards.

I also found a lot of discussion and some other possible solutions here.