🚀 go-pugleaf

In article <GzWg6.21$4w6.5444@burlma1-snr2>,
Barry Margolin <barmar@genuity.net> writes:
|> In article <3A837DE5.BA4726B4@none.for.me.com>,
|> bob  <bob@none.for.me.com> wrote:
|> >So, Barry, have you ever seen a sysadmin issue all commands with full
|> >paths?  Unfortunately, I've only worked one place since I started using
|> >Unix.  I've never seen it or heard of it.
|> 
|> No, I've never heard of a sysadmin doing this.  I've worked in two
|> Unix-based organizations, and been to LISA conferences and attended
|> security seminars, and never seen anyone suggest it before.  I thought I
|> implied all this when I referred to it as "extremely unusual".

I have seen it suggested.  I have even seen it tried.  It didn't
take long for reality to intrude.  Usually minutes or hours, but
occasionally a little longer.

In fact, the whole idea is more impractical than it might appear,
as there are a significant number of scripts and programs that are
shipped as part of an otherwise respectable vendors' system (and,
yes, I do mean ones like /usr/sbin/munge_network) that will not
work unless PATH is set up in the way they expect.

I have even seen scripts and programs that require to be supplied
command names in the short form, and the full path name will not
do.  I felt very ill on the discovery.


The SENSIBLE thing, of course, is to learn from the experience of
1960s and 1970s systems, and have proper environmental defaults
and constraints both per-user and per-program.  Such as a
configuration file that lists directories that are permitted to
be in root's path; any attempt to include others would be logged
and suppressed.  And the ability to bind an environment to a
program, so that it could not be confused by the caller.

A few Unices have a few of these features, but regrettably few,
and even fewer have a properly designed environment control scheme.


Regards,
Nick Maclaren,
University of Cambridge Computing Service,
New Museums Site, Pembroke Street, Cambridge CB2 3QG, England.
Email:  nmm1@cam.ac.uk
Tel.:  +44 1223 334761    Fax:  +44 1223 334679