The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Top Forums > UNIX for Dummies Questions & Answers
Google UNIX.COM


UNIX for Dummies Questions & Answers If you're not sure where to post a UNIX or Linux question, post it here. All UNIX and Linux newbies welcome !!

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Explain the line "mn_code=`env|grep "..mn"|awk -F"=" '{print $2}'`" Lokesha UNIX for Dummies Questions & Answers 4 12-19-2007 09:52 PM
Same ol "no acceptable cc found in $PATH" but I'm not clueless... just still a noob SloYerRoll UNIX for Dummies Questions & Answers 4 10-22-2007 07:20 AM
Network Path Not Found Error "Sunfire V100" louisd11 SUN Solaris 4 12-13-2006 09:20 AM
How to insert the "\n" in a line? zhouhaiming Shell Programming and Scripting 2 01-20-2005 07:14 PM
Adding "Private" to path name roadrunnerray UNIX for Dummies Questions & Answers 5 10-15-2004 07:33 AM

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 11-06-2005
Registered User
 

Join Date: Nov 2005
Posts: 1
Why is it Bad Idea to insert "." (Dot) to PATH ?

I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program
For example: PATH=$PATH:$HOME/bin:.
Does someone know why is it a Bad Idea?
Reply With Quote
Forum Sponsor
  #2 (permalink)  
Old 11-06-2005
reborg's Avatar
Administrator
 
Join Date: Mar 2005
Location: Ireland
Posts: 3,502
Quote:
Originally Posted by amitbern
I was told that it's a Bad Idea (especially for root ) to Add To the Variable $PATH in unix the ":." (dot),
In order to execute programs in my current directory without typing ./program
For example: PATH=$PATH:$HOME/bin:.
Does someone know why is it a Bad Idea?
Simply because you may have something in your CWD that is the same name as a Unix command. For example (an extreme case I know), imagine you had this as a script called ls.
Code:
#! /usr/bin/ksh
rm -rf *
now imagine running that as root, from roots' $HOME
Reply With Quote
  #3 (permalink)  
Old 11-07-2005
Registered User
 

Join Date: Nov 2003
Location: Minnesota
Posts: 387
In addition to avoiding accidents like reborg talked about, it is also a security issue. A virus, trojan, or hacker can insert nasty code with the same name as a common Unix command anywhere and hope root executes it by accident if "." at the start of root's path.

For example, if I break into your box as a normal non-root user, I could create a file named "cd" in some directory I have write access to. What if my script has one simple command:

rm -rf $1

Now when root tries to cd to anywhere from the directory I put my script in, it wipes out that directory instead. Alternately, you could have your script email vital files to the attacker, change data, or any other bad thing you can imagine. If you can trick root into running it for you, he's hosed.

It's basically the same thing as reborg said I guess. But you may have thought "I'd never name a script like that and cause a problem." My example above is why you still shouldn't have . in your path - you might not do something dumb yourself, but having . in the path makes it easier for the bad guys to get you.
Reply With Quote
Google UNIX.COM
Reply

Thread Tools
Display Modes




All times are GMT -7. The time now is 07:35 PM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008 The CEP Blog All Rights Reserved -Ad Management by RedTyger Visit The Global Fact Book

Content Relevant URLs by vBSEO 3.2.0