登录和未登录时切换用户时的 PATH 环境变量行为

登录和未登录时切换用户时的 PATH 环境变量行为

当我以用户身份登录然后切换到另一个用户时,PATH环境变量在切换时会发生变化,无论是否登录。请参阅以下代码片段

$ ssh -i ~/.ssh/ubuntu.pem [email protected]
ubuntu@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
/usr/local/sbin
/usr/sbin
/sbin
ubuntu@kingdom:~$ sudo su -l foo # with login
foo@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
foo@kingdom:~$ exit
logout
ubuntu@kingdom:~$ sudo su foo # without login
foo@kingdom:/home/ubuntu$ echo $PATH | tr ':' '\n' | grep sbin
/usr/local/sbin
/usr/sbin
/sbin
foo@kingdom:/home/ubuntu$ exit
exit

$ ssh -o -i ~/.ssh/foo.pem [email protected]
foo@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
/usr/local/sbin
/usr/sbin
/sbin
foo@kingdom:~$ sudo su -l ubuntu
ubuntu@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
ubuntu@kingdom:~$

如您所见,当我使用ubuntu用户登录 ubuntu 框并检查用户时PATH/sbin存在。当我切换到foo用户并检查时PATH,它会受到影响,具体取决于-l切换时是否指定了(用于登录)。如果进行了登录,则会PATH受到影响并且/sbin不存在。而在切换用户时跳过登录时不会发生这种情况。

如果您以用户身份连接foo到 ubuntu 框,则会PATH保留/sbin。如果我切换到ubuntu用户,然后检查PATH,如果我使用登录/sbin切换到用户,则不存在。ubuntu

顺便说一下,我正在使用 bash。

我还尝试删除一些用户 bash 和配置文件配置,但没有帮助。见下文

ubuntu@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
ubuntu@kingdom:~$ sudo rm /home/foo/.bash /home/foo/.bashrc /home/foo/.profile
ubuntu@kingdom:~$ sudo su -l foo
foo@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
foo@kingdom:~$ exit
logout
ubuntu@kingdom:~$ sudo rm -rf /etc/profile.d/
ubuntu@kingdom:~$ sudo su -l foo
foo@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
foo@kingdom:~$ exit
logout
ubuntu@kingdom:~$ cat /etc/environment
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games"

更新(TL;DR):

ubuntu@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
/usr/local/sbin
/usr/sbin
/sbin
ubuntu@kingdom:~$ sudo su ubuntu
ubuntu@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
/usr/local/sbin
/usr/sbin
/sbin
ubuntu@kingdom:~$ exit
exit
ubuntu@kingdom:~$ sudo su -l ubuntu
ubuntu@kingdom:~$ echo $PATH | tr ':' '\n' | grep sbin
ubuntu@kingdom:~$ exit
logout

更新2:

在评论中,有人提到打印这些PATH值。因此,对于读取链中的每个文件,我在每个文件的第一行和最后一行添加了打印PATH。现在我更困惑了。请参阅下面的代码片段

$ ssh -i ~/.ssh/ubuntu.pem [email protected]
/etc/profile: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
/etc/bash.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
/etc/bash.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
/etc/profile: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
/home/ubuntu/.profile: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
/home/ubuntu/.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
/home/ubuntu/.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
/home/ubuntu/.profile: /home/ubuntu/bin:/home/ubuntu/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

ubuntu@kingdom:~$ sudo su -l ubuntu
/etc/profile: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
/etc/bash.bashrc: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
/etc/bash.bashrc: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
/etc/profile: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/snap/bin
/home/ubuntu/.profile: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/snap/bin
/home/ubuntu/.bashrc: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/snap/bin
/home/ubuntu/.bashrc: /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/snap/bin
/home/ubuntu/.profile: /home/ubuntu/bin:/home/ubuntu/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/snap/bin
ubuntu@kingdom:~$ exit
logout

ubuntu@kingdom:~$ sudo su ubuntu
/etc/bash.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
/etc/bash.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
/home/ubuntu/.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
/home/ubuntu/.bashrc: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
  1. 为什么它会表现得如此?
  2. 如何调试它并确保在切换到具有登录名的用户时PATH意志保持不变?/sbin

答案1

请查看确定读取哪个配置文件的选项man bash-l

INVOCATION
   A login shell is one whose first character of argument zero is a -, or one started with the --login option.

   An interactive shell is one started without non-option arguments and without the -c option whose standard input and error are both connected to  ter‐
   minals (as determined by isatty(3)), or one started with the -i option.  PS1 is set and $- includes i if bash is interactive, allowing a shell script
   or a startup file to test this state.

   The following paragraphs describe how bash executes its startup files.  If any of the files exist but cannot be read, bash reports an error.   Tildes
   are expanded in filenames as described below under Tilde Expansion in the EXPANSION section.

   When  bash is invoked as an interactive login shell, or as a non-interactive shell with the --login option, it first reads and executes commands from
   the file /etc/profile, if that file exists.  After reading that file, it looks for ~/.bash_profile, ~/.bash_login, and ~/.profile, in that order, and
   reads  and executes commands from the first one that exists and is readable.  The --noprofile option may be used when the shell is started to inhibit
   this behavior.

   When a login shell exits, bash reads and executes commands from the file ~/.bash_logout, if it exists.

   When an interactive shell that is not a login shell is started, bash reads and executes commands from /etc/bash.bashrc and ~/.bashrc, if these  files
   exist.  This may be inhibited by using the --norc option.  The --rcfile file option will force bash to read and execute commands from file instead of
   /etc/bash.bashrc and ~/.bashrc.

   When bash is started non-interactively, to run a shell script, for example, it looks for the variable BASH_ENV in the environment, expands its  value
   if it appears there, and uses the expanded value as the name of a file to read and execute.  Bash behaves as if the following command were executed:
          if [ -n "$BASH_ENV" ]; then . "$BASH_ENV"; fi
   but the value of the PATH variable is not used to search for the filename.

   If  bash is invoked with the name sh, it tries to mimic the startup behavior of historical versions of sh as closely as possible, while conforming to
   the POSIX standard as well.  When invoked as an interactive login shell, or a non-interactive shell with the --login option,  it  first  attempts  to
   read  and  execute  commands  from  /etc/profile  and  ~/.profile, in that order.  The --noprofile option may be used to inhibit this behavior.  When
   invoked as an interactive shell with the name sh, bash looks for the variable ENV, expands its value if it is defined, and uses the expanded value as
   the  name of a file to read and execute.  Since a shell invoked as sh does not attempt to read and execute commands from any other startup files, the
   --rcfile option has no effect.  A non-interactive shell invoked with the name sh does not attempt to read any other startup files.  When  invoked  as
   sh, bash enters posix mode after the startup files are read.

   When bash is started in posix mode, as with the --posix command line option, it follows the POSIX standard for startup files.  In this mode, interac‐
   tive shells expand the ENV variable and commands are read and executed from the file whose name is the expanded value.  No other  startup  files  are
   read.

   Bash  attempts to determine when it is being run with its standard input connected to a network connection, as when executed by the remote shell dae‐
   mon, usually rshd, or the secure shell daemon sshd.  If bash determines it is being run  in  this  fashion,  it  reads  and  executes  commands  from
   ~/.bashrc and ~/.bashrc, if these files exist and are readable.  It will not do this if invoked as sh.  The --norc option may be used to inhibit this
   behavior, and the --rcfile option may be used to force another file to be read, but neither rshd nor sshd  generally  invoke  the  shell  with  those
   options or allow them to be specified.

   If the shell is started with the effective user (group) id not equal to the real user (group) id, and the -p option is not supplied, no startup files
   are read, shell functions are not inherited from the environment, the SHELLOPTS, BASHOPTS, CDPATH, and GLOBIGNORE variables, if they  appear  in  the
   environment,  are ignored, and the effective user id is set to the real user id.  If the -p option is supplied at invocation, the startup behavior is
   the same, but the effective user id is not reset.

回答你的问题的两段是:

当 bash 作为交互式登录 shell 或使用 --login 选项作为非交互式 shell 调用时,它首先从文件 /etc/profile 中读取并执行命令(如果该文件存在)。读取该文件后,它会按顺序查找 ~/.bash_profile、~/.bash_login 和 ~/.profile,然后从第一个存在且可读的文件中读取并执行命令。启动 shell 时可以使用 --noprofile 选项来禁止此行为。

当启动非登录 shell 的交互式 shell 时,如果 /etc/bash.bashrc 和 ~/.bashrc 存在,bash 将从这些文件读取并执行命令。可以使用 --norc 选项禁止此操作。--rcfile file 选项将强制 bash 从 file 而不是 /etc/bash.bashrc 和 ~/.bashrc 读取并执行命令。

相关内容