Date: Wed, 24 Jul 1996 09:54:47 -0700 From: David McNab <mcnab@bayarea.net> To: dgy@rtd.com Cc: paradox@pegasus.rutgers.edu, freebsd-questions@freebsd.org Subject: Re: your mail Message-ID: <199607241654.JAA18900@baygate.bayarea.net> In-Reply-To: <199607241343.GAA15489@seagull.rtd.com> (message from Don Yuniskis on Wed, 24 Jul 1996 06:43:20 -0700 (MST))
next in thread | previous in thread | raw e-mail | index | archive | help
|> 2) if '.' appears as the very last entry in root's path is this
|> still considered a security risk? I'm not so lazy that I'm not
|> willing to type './command' as root--- just really curious about
|> this type of stuff!
|
|I think the point of *forcing* you to type the "./" is hopefully a
|reminder that you are executing an "alien" -- and potentially hostile
|-- program.
The only risk I can think of with "." at the end
of the path is where a particularly devious attacker
creates trojan horse "typos" and tries to catch you
out. For example "lss" for ls(1) or some such. Or I
suppose one could snoop through the administrator's
"regular" account dot files to find his favorite
aliases and shell functions, make trojan horse
executables of the same name, then deliberately create
a situation that would tempt the admin to use them. If
like many people he (wisely) did not use aliases or
shell functions as root, you might be able to catch him
using one of them them out of habit.
Neither of those seems very effective though, and
they would be really easy to spot. Is there a sneakier
scheme I'm not thinking of?
In any case, I usually keep "." out of root's path
and out of the system-wide defaults. But if a
particular user wants to put "." at the end of the
path, I really don't think it's a problem.
In fact one could argue that it's better to put
"." at the end of the default path for users, so that
they don't add it themselves and put it at the
beginning out of ignorance.
-- Dave McNab
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199607241654.JAA18900>