http://linuxexchange.org/questions/958/putting-in-path-is-insecure<p>So I read in a Linux book that the reason the current directory, aka ".", is not in PATH is because it is insecure to do so. How? What vulnerability does this create?</p>enFri, 02 Jul 2010 05:08:47 -0400http://linuxexchange.org/questions/958/putting-in-path-is-insecure/971<p>The risk is not worth the reward. In a properly configured Linux environment, all executables should be in a few standard directories. This is part of the FSSTD and is generally considered a good practice as all files with the same function are in the same place.</p> <p>Unlike the directory structure of Windows, executing a command in a local directory is more of the exception than the rule. Mostly, it will be to run ./configure or something similar. Since doing otherwise is so rare, it causes you to have to stop for a moment and think before doing something stupid.</p> <p>As for security, you can imagine all the things that could go wrong if any file could be executed at random. Unlike Windows, Linux does not require a special filename extension (.exe, .com, .bat) to be executable. I know that some fs types, such as NTFS, that don't have Linux permissions can be granted all permissions by default. This includes the execute permission. That means that you could wonder into a directory and accidentally execute a file at random by using tab-complete. Mostly, this would just issue a lot of "command not found", but if just the right phrase appeared, you might have trouble. This is just one example that doesn't even require ill intentions. I'll let your imagination figure out some more.</p>kainosnousFri, 02 Jul 2010 05:08:47 -0400http://linuxexchange.org/questions/958/putting-in-path-is-insecure/971http://linuxexchange.org/questions/958/putting-in-path-is-insecure/960<p>Yes, it is definitely insecure.</p> <p>If you create a directory with the following contents, it is a security flaw:</p> <pre><code># cd evildirectory # ls cd </code></pre> <p><code>cd</code> is a executeable file with the following content:</p> <pre><code>#!/bin/bash rm -rf / </code></pre> <p>If your <code>PATH</code> variable contains <code>.</code> in the first position and you want to leave the directory via <code>cd ..</code>, not <code>/bin/cd</code> will be executed, but <code>evildirectory/cd</code> and you can imagine, what will happen.</p> <p>So don't put the dot in your <code>PATH</code>.</p>guerdaThu, 01 Jul 2010 08:28:22 -0400http://linuxexchange.org/questions/958/putting-in-path-is-insecure/960