🚀 go-pugleaf

In article <xak3dx9tvfs.fsf@par.univie.ac.at>, Alex Pozgaj
<alex@par.univie.ac.at> writes
>> > If you don't like the ./ in front of you're script_FileName make sure "." is 
>part
>> > of the PATH environment variable.
>> 
>> This is VERY bad advise. Having "." in your PATH env is a HUGE 
>security
>> risk.
>> 
>> It is far better to get into the habbit of using ./
>
>It is - if you are root. Otherwise it's OK.

No, it's not. It is still a BIG security problem, as an ordinary user
could run a program from someone else's directory rather than
run the system-wide program. eg: if I put:

chmod 777 ~$HOME/*  1&2>/dev/null
echo $LOGNAME permissions open >>.testrc
ls $*

as a script file in my home directory (or hid it in /etc) and someone
went in there and typed "ls" to look at my directory, it'd open their
file permissions wide open and include an entry in a .testrc file to
let me know.

It's far better to get into the habit of  using ./ to address the file
directly, rather than risk running something that could be hidden
elsewhere but still on my path. Too many security problems have
been caused by privileged users typing commands that are fine
for their ordinary login but potentially catastrophic during their
privileged login session. You can't compensate for bad practise!!

-- 
 
Linux: love it or loathe it, it's here to stay!!
(I need a service pack for my tagline)