From owner-cvs-gnu Sat Mar 18 09:07:49 1995 Return-Path: cvs-gnu-owner Received: (from majordom@localhost) by freefall.cdrom.com (8.6.10/8.6.6) id JAA10101 for cvs-gnu-outgoing; Sat, 18 Mar 1995 09:07:49 -0800 Received: from sequent.kiae.su (sequent.kiae.su [144.206.136.6]) by freefall.cdrom.com (8.6.10/8.6.6) with SMTP id JAA10089; Sat, 18 Mar 1995 09:07:40 -0800 Received: by sequent.kiae.su id AA01158 (5.65.kiae-2 ); Sat, 18 Mar 1995 20:03:22 +0300 Received: by sequent.KIAE.su (UUMAIL/2.0); Sat, 18 Mar 95 20:03:22 +0300 Received: (from ache@localhost) by astral.msk.su (8.6.8/8.6.6) id UAA00698; Sat, 18 Mar 1995 20:03:37 +0300 To: Joerg Wunsch Cc: CVS-commiters@freefall.cdrom.com, cvs-gnu@freefall.cdrom.com References: <199503181542.QAA28054@uriah.heep.sax.de> In-Reply-To: <199503181542.QAA28054@uriah.heep.sax.de>; from J Wunsch at Sat, 18 Mar 1995 16:42:11 +0100 (MET) Message-Id: Organization: Olahm Ha-Yetzirah Date: Sat, 18 Mar 1995 20:03:37 +0300 X-Mailer: Mail/@ [v2.32 FreeBSD] From: "Andrey A. Chernov, Black Mage" X-Class: Fast Subject: Re: cvs commit: src/gnu/usr.bin/man/catman catman.perl Lines: 22 Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Content-Length: 876 Sender: cvs-gnu-owner@freebsd.org Precedence: bulk In message <199503181542.QAA28054@uriah.heep.sax.de> J Wunsch writes: >As Andrew A. Chernov wrote: >> >> ache 95/03/17 18:19:26 >> >> Modified: gnu/usr.bin/man/catman catman.perl >> Log: >> Don't use user PATH into environment for sec reasons >What are your security concerns for catman? I think this is rather >pointless. It calls many pgms just by relative name, they can be found in user PATH, it is potential hole in putting pgms with same names in superuser's user PATH and similar things. Basic rule to avoid it is: don't use user PATH in system scripts. -- Andrey A. Chernov : And I rest so composedly, /Now, in my bed, ache@astral.msk.su : That any beholder /Might fancy me dead - FidoNet: 2:5020/230.3 : Might start at beholding me, /Thinking me dead. RELCOM Team,FreeBSD Team : E.A.Poe From "For Annie" 1849