Am 11. Aug, 2003 schw=E4tzte Alan Dayley so:
> On Monday 11 August 2003 08:13 pm, der.hans wrote:
> > I always setup my $PATH to have all the sbin dirs. It's not a security
> > problem. Keep '.' out of your $PATH. If you have to have it in there ma=
ke
> > sure it's the last entry.
>
> Why is it not a security concern?
Do you mean s/not// on that sentence?
I'll presume so.
df
ps
uptime
The shell looks for commands in the directories in your $PATH, in the order
listed in $PATH.
If you have $PATH setup properly you'll (probably) end up with the followin=
g:
/bin/df
/bin/ps
/usr/bin/uptime
Now try 'fred'. For most of us that should end up in a command not being
found. Some of us might have a 'fred' in ~/bin or ~/lokal/bin.
Then there are people like me that have freds lying around all over the
place from one-off tests that didn't get deleted. If that one-off test
happened to be "rm -rf ~/" I won't be too happy about it going off.
Now what if you happen to be in someone else's directory and they have a df
something like the following.
$ cat /tmp/df
#!/bin/sh
touch /tmp/mybackdoor
chmod 7777 /tmp/mybackdoor
df "$@"
That'll create a file owned by you that is setuid and writable by anyone.
$ sh /tmp/df
Filesystem 1K-Bl=F6cke Benutzt Verf=FCgbar Ben% Eingeh=E4ngt au=
f
/dev/hda2 38811848 21367652 17444196 56% /
$ ls -l /tmp/mybackdoor
-rwsrwsrwt 1 lufthans lufthans 0 2003-08-11 22:19 /tmp/mybackdoor
It's actually not too dangerous for shell scripts because setuid is ignored=
,
but 'touch /tmp/mybackdoor' could easily be 'cp .hidden/mybackdoor
/tmp/mybackdoor', where mybackdoor is a small binary wrapper for something
else.
> Why have it as the last entry?
If dot is first you'll call ./df before calling /bin/df, which definitely
sets you up. At least with dot as the last entry you should only get nailed
on non-existent commands. Then again, how many people typo stuff on a
regular basis? :)
ciao,
der.hans
--=20
# https://www.LuftHans.com/ http://www.AZOTO.org/
# "Communications without intelligence is noise;
# Intelligence without communications is irrelevant."
# Gen. Alfred. M. Gray, USMC
(text/plain)