Go Back   The UNIX and Linux Forums > Top Forums > UNIX for Dummies Questions & Answers


UNIX for Dummies Questions & Answers If you're not sure where to post a UNIX or Linux question, post it here. All UNIX and Linux newbies welcome !!

Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 11-06-2005
Registered User
 
Join Date: Nov 2005
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
Why is it Bad Idea to insert "." (Dot) to PATH ?

I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program
For example: PATH=$PATH:$HOME/bin:.
Does someone know why is it a Bad Idea?
Sponsored Links
    #2  
Old 11-06-2005
reborg's Avatar
reborg reborg is offline Forum Advisor  
Administrator Emeritus
 
Join Date: Mar 2005
Location: Ireland
Posts: 4,464
Thanks: 0
Thanked 8 Times in 8 Posts
Quote:
Originally Posted by amitbern
I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program
For example: PATH=$PATH:$HOME/bin:.
Does someone know why is it a Bad Idea?
Simply because you may have something in your CWD that is the same name as a Unix command. For example (an extreme case I know), imagine you had this as a script called ls.

Code:
#! /usr/bin/ksh
rm -rf *

now imagine running that as root, from roots' $HOME
Sponsored Links
    #3  
Old 11-07-2005
Registered User
 
Join Date: Nov 2003
Location: Minnesota
Posts: 447
Thanks: 0
Thanked 2 Times in 2 Posts
In addition to avoiding accidents like reborg talked about, it is also a security issue. A virus, trojan, or hacker can insert nasty code with the same name as a common Unix command anywhere and hope root executes it by accident if "." at the start of root's path.

For example, if I break into your box as a normal non-root user, I could create a file named "cd" in some directory I have write access to. What if my script has one simple command:

rm -rf $1

Now when root tries to cd to anywhere from the directory I put my script in, it wipes out that directory instead. Alternately, you could have your script email vital files to the attacker, change data, or any other bad thing you can imagine. If you can trick root into running it for you, he's hosed.

It's basically the same thing as reborg said I guess. But you may have thought "I'd never name a script like that and cause a problem." My example above is why you still shouldn't have . in your path - you might not do something dumb yourself, but having . in the path makes it easier for the bad guys to get you.
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
"find . -printf" without prepended "." path? Getting path to current working directory? pstein Shell Programming and Scripting 1 10-02-2011 08:23 AM
awk command to replace ";" with "|" and ""|" at diferent places in line of file shis100 Shell Programming and Scripting 7 03-16-2011 08:59 AM
Idea for an "informative" bash alias or script SilversleevesX Shell Programming and Scripting 5 05-14-2009 07:51 PM
Any idea what this counter means "tcpTimRetrans" purechgo UNIX for Advanced & Expert Users 3 11-18-2008 12:36 AM



All times are GMT -4. The time now is 09:28 PM.