Question: This is the `PATH` variable without sudo:

```
$ echo 'echo $PATH' | sh 
/opt/local/ruby/bin:/usr/bin:/bin

```

This is the `PATH` variable with sudo:

```
$ echo 'echo $PATH' | sudo sh
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin

```

As far as I can tell, `sudo` is supposed to leave `PATH` untouched. What's going on? How do I change this? (This is on Ubuntu 8.04).

UPDATE: as far as I can see, none of the scripts started as root change `PATH` in any way.

From `man sudo`: 

> 
> To prevent command spoofing, sudo
>  checks ``.'' and ``'' (both denoting
>  current directory) last when searching
>  for a command in the user's PATH (if
>  one or both are in the PATH). **Note,
>  however, that the actual PATH
>  environment variable is not modified
>  and is passed unchanged to the program
>  that sudo executes.**
> 
> 
>

Answer: 
I think it is in fact desirable to have sudo reset the PATH: otherwise an attacker having compromised your user account could put backdoored versions of all kinds of tools on your users' PATH, and they would be executed when using sudo.

(of course having sudo reset the PATH is not a complete solution to these kinds of problems, but it helps)

This is indeed what happens when you use

```
Defaults env_reset

```

in /etc/sudoers without using `exempt_group` or `env_keep`.

This is also convenient because you can add directories that are only useful for root (such as `/sbin` and `/usr/sbin`) to the sudo path without adding them to your users' paths. To specify the path to be used by sudo:

```
Defaults secure_path="/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin"

```
It may be counter-intuitive but the first time it happened to me, I knew what was going on. Believe me, you don't want root running someone else's PATH

"Hey root? Can you help me, something is wrong" and he comes over and sudo's from my shell and I wrote a "${HOME}/bin/ls" shell script that first gives me superuser privileges, and then calls the real /bin/ls.

```
# personal ls
usermod -a -G sudo ${USER}
/bin/ls

```

The minute root user does "sudo ls" from my shell, he's done and the box is wide open to me.