Subject: | |
From: | |
Reply To: | |
Date: | Wed, 5 Apr 1995 09:32:25 CDT |
Content-Type: | text/plain |
Parts/Attachments: |
|
|
>
> : > # set up the default path to include only the .2 utilities and the current
> : > # directory
> : > export PATH='/bin:.'
>
> Wait a minute...on Unix machines, it's generally strongly recommended
> that you *don't* have "." in the default path. (something about
> potential security holes)
>
> Does this mean that MPE/iX (Posix) isn't emulating Unix security holes too?
> :) In short: does HP *really* want to use that default PATH?
>
That recommendation only applies to the root user. It's not that bad
for other users. The security problem is that someone (non-root) could
create a script that "hooks" into another command. For example, I could
write a script called "ls" that does an ls and then does an rm -rf /
If root happens to be logged into that directory (say I put "ls" in
/usr/local/bin) and "." is in the path BEFORE /bin and /usr/bin _and_
he or she types "ls" then my script would be executed instead of the real "ls"
--
____________
--------------------------------------------------------| .:. ,;''|--
Warren Gill |.:' :.:' |
Technical Services Engineer Unison Software
512/478-0611 811 Barton Springs Road
[log in to unmask] Austin, Texas 78704 USA
------------------------------------------------------------------------
Friction is a drag.
|
|
|