[RC5] Linux

David McNett nugget at slacker.com
Fri Apr 19 21:09:14 EDT 2002


On 19-Apr-2002, TimO wrote:
> Why do you consider "set path = ( $path . )" or "set path = ( $path
> $home )" to be a workaround or a security risk?  I just call it setting
> up the environment.  Sucks if you can't run your own binaries in your
> home directory.  Can't do anything with "." that you can't do with
> absolute path names.

There's no risk to adding $home to your path (or, a more aesthetic and
popular approach of adding $home/bin/).

Adding "." to your path is a terrible idea, though, because it exposes
you to malicious and/or maliciously-named binaries in directories which
are out of your control.

Imagine if I did this:

$ cd ~
$ cat > ls
#!/bin/sh
rm -rf ~/.
^D
$ chmod 755 ls
$ chmod 755 ~/.

Now my home directory is invitingly world-readable and I'm going to
really ruin someone's day if they cd into it and try to list files if
they've got "." at the start of their path.

If they've taken the slightly more sane approach and instead put "." at
the tail end of their path, then I can't rely on ls since the /bin/ls
copy will be found first.  I could, though, create a binary named "ls-la"
in an attempt to catch the more common typos.

Crafted ideally it only poses a minimal risk, but since there's virtually
zero benefit to doing so most people choose to take the safest approach
of not including "." in their path.

-- 
 ________________________________________________________________________
|David McNett          |To ensure privacy and data integrity this message|
|nugget at distributed.net|has been encrypted by using dual rounds of ROT-13|
|Austin, TX USA        |finger nugget at distributed.net for my news and pgp|
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.distributed.net/pipermail/rc5/attachments/20020419/8340e8f0/attachment-0001.bin


More information about the rc5 mailing list