Re: help adding start and shutdown script

Hi Vic,

Vic wrote:
Don't do this...

Part of your security comes from the fact that all commands come from
known places in the filesystem, regardless of where you might currently
be sat. So if you were to pick up something nasty, it could not be
executed accidentally unless it manages to get into a directory on
$PATH; as these are often only writable by root, there's a strong chance
that won't happen.

As soon as you put "." on your path, the commands you type can be
overridden by malware, and strange and wonderful things can result
(although they're unlikely to be pleasant things).


I agree with that. I, personally, wouldn't do it on my own computer. But: If you put "." as the last entry into your $PATH variable, all other directories in your searchpath override executables that reside in the current directory. So the risk is not as big, as it seems at first.

But, to tell it once again: I do not recommend this, if you don't want malware to be theoretically able to override often used commands like "ls", "cd" etc. by placing an executalbe with the same name into a commonly used folder.

And: NEVER DO THAT TO THE ROOT ACCOUNT.

If you want your script to be in path, put it in path. Don't bend path
to meet your script. Copy it into, for example, /usr/local/bin/ and be
done with it.

My alternative: place a symlink in /usr/local/bin.


HTH

Vic.



Matthäus
.

Relevant Pages

  • Re: help adding start and shutdown script
    ... Part of your security comes from the fact that all commands come from ... as the last entry into your $PATH variable, all other directories in your searchpath override executables that reside in the current directory. ... But, to tell it once again: I do not recommend this, if you don't want malware to be theoretically able to override often used commands like "ls", "cd" etc. by placing an executalbe with the same name into a commonly used folder. ... The stop_net script will now execute without typing './'. ...
    (linux.redhat)
  • Re: Silent overriding of the command?
    ... He wrote in Russian Tcl mailing list very complete report of this ... Earlier today I've discovered that some new commands are available in Tk ... names which are quite easy to override, ... it wouldn't harm anybody if internal calls from library scripts ...
    (comp.lang.tcl)
  • Re: Process Idle Time
    ... > file in turn invokes several executables. ... > reflected in the ProcessTimes of the command prompt. ... it depends on what sorts of commands are used in the BAT or CMD file. ... then those external commands will run in separate prcoesses and ...
    (microsoft.public.win32.programmer.kernel)
  • Re: [PATCH 09/14] Blackfin SPI driver: Fix SPI driver to work with SPI flash ST25P16 on bf548
    ... Drivers can override it ... One would expect they only override _downwards_ but that's not ... it can't feed data as fast for some commands. ... We check it on Blackfin board. ...
    (Linux-Kernel)
  • Re: Process Idle Time
    ... I basically want to know if the prompt is busy in any way. ... >> file in turn invokes several executables. ... it depends on what sorts of commands are used in the BAT or CMD file. ...
    (microsoft.public.win32.programmer.kernel)