Keep the root PATH free of relative and writable directories

Description

When root types a command name, the shell searches the directories of PATH in order. Each entry must be an absolute path to an existing directory owned by root and not writable by group or others. Empty entries and . mean the current directory.

Rationale

If root's PATH includes the current directory or a directory another user can write to, that user can drop a program named like a common command (ls, sudo) and have root run it.

Impact

None for the Debian default PATH. Scripts that relied on running programs from the current directory must use ./program.

Audit

Run su - root -c 'echo $PATH'. It must have no empty entry, no ., no relative path, and each directory must exist, be owned by root and not be group or world writable.

Automated: every check must pass. Scanners report each check by its id.

root-path

PATH of a root login shell.

script: |
  p=$(su - root -c 'printf %s "$PATH"' 2>/dev/null) || exit 3
  echo "PATH=$p"
  case ":$p:" in *::* | *:.:*) echo "empty or . entry"; exit 1 ;; esac
  rc=0
  IFS=:
  for d in $p; do
    case $d in /*) ;; *) echo "relative: $d"; rc=1; continue ;; esac
    [ -d "$d" ] || continue
    [ "$(stat -L -c %U "$d")" = root ] || { echo "not owned by root: $d"; rc=1; }
    m=$(stat -L -c %a "$d")
    [ $(( 0$m & 022 )) -eq 0 ] || { echo "group/world writable: $d ($m)"; rc=1; }
  done
  exit $rc

Remediation

Remove empty, . and relative entries from the PATH set in /root/.profile, /root/.bashrc, /etc/profile and /etc/environment. Fix the owner and mode of any listed directory with chown root:root and chmod go-w.

References

• bash(1), Debian manual pages (PATH) Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle