Donna ponders:
> i've got a question about how i'm setting up my posix path.  in addition
> to what being defined in /etc/profile, in /etc/profile.local, there are
> two export statements...
>
> export PATH=$PATH:/usr/contrib/bin
> export PATH=$PATH:/usr/local/java/latest/bin
>
> ...but what's missing is '.'  the 'reason'(?) for this is the other
> bill&dave (hassell and totsch :-) most effectively convinced me (or at
> least gently led me down the rose garden path) that having dot in your
> path is a bad thing(tm).

Omitting '.' from the path is a good thing the same way that staying out of
a field full of land mines is a good thing.  Of course most of us would
probably not put up with living next to a field full of land mines and would
move to somewhere where this wasn't a problem.

I'm pretty confident that there is little danger from land mines in my area,
so I happily walk wherever I like without paying extra attention to where I
step, and I generally have '.' in my path because life is too short to type
'./' in front of everything.

If you add '.' to the *end* of your path, then you can't override any
executables that exist in standard locations on your PATH because they will
be found *before* any trojan horses that may have wandered in to your
working directory.

There may be other reasons to omit '.' from your path, but if you seriously
have to worry about your users leaving little land mines out for you then
I'd recommend getting some new users :-)

I think the more general problem is that programs run with the capabilities
of the user who runs them rather than with the permissions of the user who
created/installed them.  It would be interesting to have "SETUID" be the
default rather than the other way around.  In the trojan horse on the PATH
situation, a devious user only has to get you to run their program as root,
which can be done just as easily by *asking* you to run their program which
can then invisibly do something "bad".

G.

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *