The real path in both is /usr/sbin/ but /sbin works due to the magic of symlinks in usr images, if the goal is to block this functionality in amd64-generic shouldn't it directly check for a read-write /etc ?