<div class="gmail_quote">2008/3/27 Jesse Keating <<a href="mailto:jkeating@redhat.com">jkeating@redhat.com</a>>: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> This question applies today regardless of default path statements. Absolutely nothing on a default Fedora system prevents me as a non-root user from calling any setuid binary from (/usr)/sbin. Nothing. If we're concerned about the security of these things, we would have to audit them regardless of any path changes. Period. </blockquote></div> I'm not disagreeing. What I am suggesting that perhaps historic choices have been made under the false assumption that path separation would provide protection. And now that we are considering things be put into the default path for all user, its a really good time to check to see if that false assumption still lingers. Not as a blocker on action but as an opportunity to focus our attention on the sbin executables. -jef