HP3000-L Archives

April 1995, Week 1

HP3000-L@RAVEN.UTC.EDU

Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
From:
Reply To:
Warren Gill <[log in to unmask]>
Date:
Wed, 5 Apr 1995 09:32:25 CDT
Content-Type:
text/plain
Parts/Attachments:
text/plain (29 lines)
>
> : > # set up the default path to include only the .2 utilities and the current
> : > # directory
> : > export PATH='/bin:.'
>
> Wait a minute...on Unix machines, it's generally strongly recommended
> that you *don't* have "." in the default path.  (something about
> potential security holes)
>
> Does this mean that MPE/iX (Posix) isn't emulating Unix security holes too?
> :)    In short: does HP *really* want to use that default PATH?
>
        That recommendation only applies to the root user.  It's not that bad
for other users.  The security problem is that someone (non-root) could
create a script that "hooks" into another command.  For example, I could
write a script called "ls" that does an ls and then does an rm -rf /
If root happens to be logged into that directory (say I put "ls" in
/usr/local/bin) and "." is in the path BEFORE /bin and /usr/bin  _and_
he or she types "ls" then my script would be executed instead of the real "ls"
--
                                                          ____________
 --------------------------------------------------------|  .:.   ,;''|--
 Warren Gill                                             |.:' :.:'    |
 Technical Services Engineer                            Unison Software
 512/478-0611                                   811 Barton Springs Road
 [log in to unmask]                         Austin, Texas 78704 USA
 ------------------------------------------------------------------------
Friction is a drag.

ATOM RSS1 RSS2