debian su – and su $PATH differences?

$ su -
Password: 
# echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# exit
logout
$ su
Password: 
# echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

I have no idea why /bin and /sbin are not added to $PATH, if I do the plain su. This used to be the case. How can I fix this? I did notice that:

-rw-r--r-- 1 root root 0 Jan  8  2018 /etc/environment

But otherwise my system seems normal.

EDIT: I forgot the obligatory uname -a

Linux rpi3 4.17.0-1-arm64 #1 SMP Debian 4.17.8-1 (2018-07-20) aarch64 GNU/Linux

EDIT2:

$ cat /etc/issue
Debian GNU/Linux buster/sid n l

all of the packages are from the “testing” repo, since “stable” ones don’t work very well on aarch64.

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

Very recently (with version 2.32-0.2 of util-linux from 27 Jul 2018) Debian switched to a different su implementation, see bug 833256. The “new” su is from util-linux while the “old” one was contained in the login package and originated from src:shadow

Quoting from util-linux/NEWS.Debian.gz:

The two implementations are very similar but have some minor differences (and there might be more that was not yet noticed ofcourse), e.g.

• new ‘su’ (with no args, i.e. when preserving the environment) also preserves PATH and IFS, while old su would always reset PATH and IFS even in ‘preserve environment’ mode.
• su ” (empty user string) used to give root, but now returns an error.
• previously su only had one pam config, but now ‘su -‘ is configured separately in /etc/pam.d/su-l

The first difference is probably the most user visible one. Doing plain ‘su’ is a really bad idea for many reasons, so using ‘su -‘ is strongly recommended to always get a newly set up environment similar to a normal login. If you want to restore behaviour more similar to the previous one you can add ‘ALWAYS_SET_PATH yes’ in /etc/login.defs.

The previously used su implementation behaved differently regarding PATH. This is also discussed in this bug report, see 833256#80. The new su preserves PATH if not invoked with su -.

In short: Debian’s old su behaved like su -, at least regarding PATH. With the new implementation you should almost always use su -, similar to other distributions.

Method 2

The Debian su manpage tells:

The current environment is passed to the new shell. The value of $PATH
is reset to /bin:/usr/bin for normal users, or
/sbin:/bin:/usr/sbin:/usr/bin for the superuser. This may be changed
with the ENV_PATH and ENV_SUPATH definitions in /etc/login.defs.

Quoting from /etc/login.defs:

# Three items must be defined:  MAIL_DIR, ENV_SUPATH, and ENV_PATH.
# If unspecified, some arbitrary (and possibly incorrect) value will
# be assumed.  All other items are optional - if not specified then

On a normal Debian system the variables are defined in/etc/login.defs :

#
# *REQUIRED*  The default PATH settings, for superuser and normal users.
#
# (they are minimal, add the rest in the shell startup files)
ENV_SUPATH      PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ENV_PATH        PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

Testing by commenting out ENV_SUPATH reproduces partially your problem: su will not have /sbin (nor /usr/local/bin) while su - will execute the login script /etc/profile which will redefine PATH as expected for the root user.

So you should check for any alteration of /etc/login.defs and correct it, or see if an other part alters the PATH later (like a shell startup script such as some non-login bashrc script)

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0