![]() |
|
|
|
|
|||||||
| Forums | Portal | Register | Forum Rules | FAQ | Contribute | Members List | Arcade | Search | Today's Posts | Mark Forums Read |
| UNIX for Dummies Questions & Answers If you're not sure where to post a UNIX or Linux question, post it here. All UNIX and Linux newbies welcome !! |
|
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Explain the line "mn_code=`env|grep "..mn"|awk -F"=" '{print $2}'`" | Lokesha | UNIX for Dummies Questions & Answers | 4 | 12-19-2007 10:52 PM |
| Same ol "no acceptable cc found in $PATH" but I'm not clueless... just still a noob | SloYerRoll | UNIX for Dummies Questions & Answers | 4 | 10-22-2007 07:20 AM |
| Network Path Not Found Error "Sunfire V100" | louisd11 | SUN Solaris | 4 | 12-13-2006 10:20 AM |
| How to insert the "\n" in a line? | zhouhaiming | Shell Programming and Scripting | 2 | 01-20-2005 08:14 PM |
| Adding "Private" to path name | roadrunnerray | UNIX for Dummies Questions & Answers | 5 | 10-15-2004 07:33 AM |
|
|
Submit Tools | LinkBack | Thread Tools | Search this Thread | Display Modes |
|
#1
|
|||
|
|||
|
Why is it Bad Idea to insert "." (Dot) to PATH ?
I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program For example: PATH=$PATH:$HOME/bin:. Does someone know why is it a Bad Idea? |
| Forum Sponsor | ||
|
|
|
#2
|
||||
|
||||
|
Quote:
Code:
#! /usr/bin/ksh rm -rf * |
|
#3
|
|||
|
|||
|
In addition to avoiding accidents like reborg talked about, it is also a security issue. A virus, trojan, or hacker can insert nasty code with the same name as a common Unix command anywhere and hope root executes it by accident if "." at the start of root's path.
For example, if I break into your box as a normal non-root user, I could create a file named "cd" in some directory I have write access to. What if my script has one simple command: rm -rf $1 Now when root tries to cd to anywhere from the directory I put my script in, it wipes out that directory instead. Alternately, you could have your script email vital files to the attacker, change data, or any other bad thing you can imagine. If you can trick root into running it for you, he's hosed. It's basically the same thing as reborg said I guess. But you may have thought "I'd never name a script like that and cause a problem." My example above is why you still shouldn't have . in your path - you might not do something dumb yourself, but having . in the path makes it easier for the bad guys to get you. |
|||
| Google The UNIX and Linux Forums |