The tilde in your PATH may not be your HOME
I was playing with the nono agent sandboxing tool and it greeted me with a warning: PATH entries the sandbox can write to: ~/.local/bin/ which looked suspicious.
In other words, doing this in your ~/.bashrc or ~/.zshrc:
will not expand the ~ (tilde) into the home path (or $HOME) as the tilde to home expansion happens only in unquoted inputs, as also the bash documentation says:
If a word begins with an unquoted tilde character (‘~’), all of the characters up to the first unquoted slash (…) are considered a tilde-prefix. (…)
Bash checks each variable assignment for unquoted tilde-prefixes immediately following a ‘:’ or the first ‘=’, and performs tilde expansion in these cases. (…)
So instead of having /home/
And to fix this, we can do this:
Note that the unquoted version export PATH=$PATH:~/.local/bin actually works in Bash and Zsh, because tilde expansion is also performed in variable assignments after = and after each :. But relying on that is fragile as for example, a whitespace will break the variable assignment.
The problem can also be seen here:
As we can see, the kek binary was found and executed from ./~/.local/bin/ — the home directory was never involved.
You can quickly check whether you have this problem with:
or, to see each entry on its own line:
If it prints anything, go fix your .bashrc/.zshrc/.profile and replace the ~ with $HOME :).
Btw, kudos to the nono tool for warning about this - even though the warning could be more verbose (PR incoming).