The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Top Forums > UNIX for Dummies Questions & Answers
.
google unix.com



UNIX for Dummies Questions & Answers If you're not sure where to post a UNIX or Linux question, post it here. All UNIX and Linux newbies welcome !!

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Explain the line "mn_code=`env|grep "..mn"|awk -F"=" '{print $2}'`" Lokesha UNIX for Dummies Questions & Answers 4 12-20-2007 01:52 AM
Same ol "no acceptable cc found in $PATH" but I'm not clueless... just still a noob SloYerRoll UNIX for Dummies Questions & Answers 4 10-22-2007 11:20 AM
Network Path Not Found Error "Sunfire V100" louisd11 SUN Solaris 4 12-13-2006 01:20 PM
How to insert the "\n" in a line? zhouhaiming Shell Programming and Scripting 2 01-20-2005 11:14 PM
Adding "Private" to path name roadrunnerray UNIX for Dummies Questions & Answers 5 10-15-2004 11:33 AM

Closed Thread
English Japanese Spanish French German Portuguese Italian Dutch Swedish Russian Norwegian Hungarian Hebrew Danish Bulgarian Greek Powered by Powered by Google
 
LinkBack Thread Tools Search this Thread Rate Thread Display Modes
  #1 (permalink)  
Old 11-06-2005
amitbern amitbern is offline
Registered User
  
 

Join Date: Nov 2005
Posts: 1
Why is it Bad Idea to insert "." (Dot) to PATH ?

I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program
For example: PATH=$PATH:$HOME/bin:.
Does someone know why is it a Bad Idea?
  #2 (permalink)  
Old 11-06-2005
reborg's Avatar
reborg reborg is offline Forum Staff  
Administrator
  
 

Join Date: Mar 2005
Location: Ireland
Posts: 4,246
Quote:
Originally Posted by amitbern
I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program
For example: PATH=$PATH:$HOME/bin:.
Does someone know why is it a Bad Idea?
Simply because you may have something in your CWD that is the same name as a Unix command. For example (an extreme case I know), imagine you had this as a script called ls.

Code:
#! /usr/bin/ksh
rm -rf *

now imagine running that as root, from roots' $HOME
  #3 (permalink)  
Old 11-07-2005
rhfrommn rhfrommn is offline Forum Advisor  
Registered User
  
 

Join Date: Nov 2003
Location: Minnesota
Posts: 424
In addition to avoiding accidents like reborg talked about, it is also a security issue. A virus, trojan, or hacker can insert nasty code with the same name as a common Unix command anywhere and hope root executes it by accident if "." at the start of root's path.

For example, if I break into your box as a normal non-root user, I could create a file named "cd" in some directory I have write access to. What if my script has one simple command:

rm -rf $1

Now when root tries to cd to anywhere from the directory I put my script in, it wipes out that directory instead. Alternately, you could have your script email vital files to the attacker, change data, or any other bad thing you can imagine. If you can trick root into running it for you, he's hosed.

It's basically the same thing as reborg said I guess. But you may have thought "I'd never name a script like that and cause a problem." My example above is why you still shouldn't have . in your path - you might not do something dumb yourself, but having . in the path makes it easier for the bad guys to get you.
Closed Thread

Bookmarks

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On




All times are GMT -4. The time now is 10:10 PM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited. Language Translations Powered by .
vBCredits v1.4 Copyright ©2007 - 2008, PixelFX Studios
The UNIX and Linux Forums Content Copyright ©1993-2009. All Rights Reserved.Ad Management by RedTyger

Content Relevant URLs by vBSEO 3.2.0