Path: ...!eternal-september.org!feeder3.eternal-september.org!news.eternal-september.org!eternal-september.org!.POSTED!not-for-mail
From: Janis Papanagnou <janis_papanagnou+ng@hotmail.com>
Newsgroups: comp.unix.shell
Subject: Re: Default PATH setting - reduce to something more sensible?
Date: Sun, 26 Jan 2025 14:49:16 +0100
Organization: A noiseless patient Spider
Lines: 43
Message-ID: <vn5egt$3qdn6$1@dont-email.me>
References: <vm5dei$2c7to$1@dont-email.me> <vmthmu$3bb88$1@news.xmission.com>
 <vmtrqk$92b$1@reader2.panix.com> <vmu94j$1q2lp$1@dont-email.me>
 <vn05ji$r20$1@reader2.panix.com> <vn0bpf$29qe6$1@dont-email.me>
 <871pwr6fe9.fsf@nosuchdomain.example.com> <vn2ier$2phv1$1@dont-email.me>
 <87ed0qba54.fsf@nosuchdomain.example.com> <20250125211146.219@kylheku.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Injection-Date: Sun, 26 Jan 2025 14:49:17 +0100 (CET)
Injection-Info: dont-email.me; posting-host="fece8858d7df8940b024ff5c279833b9";
	logging-data="4011750"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX18dPMgRnf5cCtkO8CVjnPem"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.8.0
Cancel-Lock: sha1:hnRAxwROwO2JnyJyxI8KpucFrHo=
X-Enigmail-Draft-Status: N1110
In-Reply-To: <20250125211146.219@kylheku.com>
Bytes: 3182

On 26.01.2025 06:26, Kaz Kylheku wrote:
> 
> It's a feature that (if used) leaks tildes into child processes via
> the environment variable. Path resultion in child processes, if it
> reaches a PATH element with a tilde, will somehow process that tilde.
> 
> I just tried this experiment. I made a directory named ~ and put ~:
> as the leading element of PATH. I put a program called "foo" that
> directory.
> 
> Surely enough, I can run "foo" from the parent directory above.
> 
> The exec functions treat ~ as an ordinary path component.
> 
> (I cannot do that out of Bash, which processes the tilde, but
> the 'p' family of the exec functions will find it!)
> 
> This is a problem similar to "." being in PATH.

[ Above context preserved for integrity. ]

> If someone has, say, "~/bin" in their PATH, ahead of /bin and /usr/bin,
> I can put a malicious program in some directory called "~/bin"
> somewhere in the filesystem, give that program the name of a common
> external utility, and trick the user into changing into that location
> where they will run this common command, resolving to my malicious
> program.

To my best knowledge using '/' as part of a file or directory name is
(as the '\0') prohibited by the operating system at a very low level.
So there would, IMO, not be a security hole (i.e. not because of that).

> 
> If we regard this as a security hole, that atually raises the priority
> and bolsters the argument that it ought to be removed even if it
> breaks some users, perhaps through a process of noisy deprecation.
> 
> Furhermore, the case can be made that the exec stuff in the Linux kernel
> or C libraries should be patched with a check against components with a
> leading tilde.

Janis