Re: F11: Bug in sh-4.0 source build-in command

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Konstantin Svist wrote:
> John Cornelius wrote:
>> It's not a bug, it's supposed to work that way. The behavior can be
>> changed by:
>> sh-4.0# PATH=$PATH:.
>
> I used to do this because that's how Windows does it -- until I realized
> how bad of an idea it really is.
>
> Suppose you're root, looking around in a user-writable directory. And
> suppose that some user placed a malicious executable called "ls" in that
> directory (maybe as simple as echo "rm -rf /" >> ls; chmod 777 ls).
> Suddenly, you're executing "ls" - but not the one you think.

Well, not really, since /bin would be in PATH before '.'.  But still,
you're right that it's generally a pretty bad idea to put '.' into
PATH. :)

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
It is OK to let your mind go blank, but please turn off the sound.

Attachment: pgp5EM0NwETHi.pgp
Description: PGP signature

-- 
fedora-list mailing list
[email protected]
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux