Why `newgidmap` is in my $PATH ? (a question about binaires..)

Help
1

Hello everyone!

Context: Ultimately I would like to better control what binaries are exposed in my CLI environment, thus reducing drastically what is exposed in $PATH. With a profile/usecase-based escape hatch to access certain binaries I don’t normally have.

While checking availability of some command name (for my own scripts and tools), new<TAB> gave me:
newgidmap newgidmap.real newgrp newgrp.real newuidmap newuidmap.real newusers

=> Loads of binaries I will never use in my day-to-day use of the computer!
So today is the day I ask:

Why are these binaries in my $PATH ?
What includes them here, are they required for something?
Can I remove them from my $PATH ? (at which level? at what cost?)

You can find my current single-file OS config at GitHub - bew/nixos-config: My NixOS configs ;), it’s quite straightforward, nothing weird I think that could import such kinds of binaries so it must come from the base system modules?

2 
$ type -p newgidmap newgidmap.real newgrp newgrp.real newuidmap newuidmap.real newusers
/run/wrappers/bin/newgidmap
/run/wrappers/bin/newgidmap.real
/run/wrappers/bin/newgrp
/run/wrappers/bin/newgrp.real
/run/wrappers/bin/newuidmap
/run/wrappers/bin/newuidmap.real
/run/current-system/sw/bin/newusers

$ head /run/wrappers/bin/{newgidmap,newgrp,newuidmap}.real
==> /run/wrappers/bin/newgidmap.real <==
/nix/store/...-shadow-.../bin/newgidmap
==> /run/wrappers/bin/newgrp.real <==
/nix/store/...-shadow-.../bin/newgrp
==> /run/wrappers/bin/newuidmap.real <==
/nix/store/...-shadow-.../bin/newuidmap

$ sudo grep -- -shadow- /run/wrappers/bin/*
/run/wrappers/bin/chsh.real:/nix/store/...-shadow-.../bin/chsh
/run/wrappers/bin/newgidmap.real:/nix/store/...-shadow-.../bin/newgidmap
/run/wrappers/bin/newgrp.real:/nix/store/...-shadow-.../bin/newgrp
/run/wrappers/bin/newuidmap.real:/nix/store/...-shadow-.../bin/newuidmap
/run/wrappers/bin/passwd.real:/nix/store/...-shadow-.../bin/passwd
/run/wrappers/bin/sg.real:/nix/store/...-shadow-.../bin/sg
/run/wrappers/bin/su.real:/nix/store/...-shadow-...-su/bin/su

$ readlink /run/current-system/sw/bin/newusers
/nix/store/...-shadow-.../bin/newusers

$ ls /nix/store/...-shadow-.../bin/
chage
chfn
chgpasswd
chpasswd
chsh
expiry
faillog
getsubids
gpasswd
groupadd
groupdel
groupmems
groupmod
grpck
grpconv
grpunconv
lastlog
login
logoutd
newgidmap
newgrp
newuidmap
newusers
nologin
passwd
pwck
pwconv
pwunconv
sg
useradd
userdel
usermod
vigr
vipw
3

Thanks for the deep dive and the commands :ok_hand:

I’ll play with that.

1 Like