Comment 12 for bug 1659719

I'm very reluctant to reconfigure openssh for this; it feels like a layering violation, and a regression of all the work we did way back when to avoid having to change umpteen packages when we want to change the default command search path.

How about something like adding a pam_snap session module that would add itself to PATH in the PAM environment if needed, and plug that in via /usr/share/pam-configs/ ? You'd want to discuss that sort of thing with Steve Langasek, I expect, but it seems nicer than changing the configuration of individual PAM-using services.