Re: Default PATH setting - reduce to something more sensible?

On 2025-01-26, Janis Papanagnou <janis_papanagnou+ng@hotmail.com> wrote:

To my best knowledge using '/' as part of a file or directory name is
(as the '\0') prohibited by the operating system at a very low level.
So there would, IMO, not be a security hole (i.e. not because of that).

The / is not part of a name; it is acting as the path component
separator. PATH allows relative paths with multiple components.
This is real!

  $ PATH='~/bin':$PATH
  $ cat '~/bin/cat'     # script I prepared
  #!/bin/sh
  echo BOO!
  $ cat                 # Bash in stock mode finds /bin/cat
  ^C
  !130!
  $ bash --posix        # Bash in --posix mode falls victim
  bash-4.4$ cat
  BOO!
  bash-4.4$

Someone who has literal ~/bin in their PATH so that their shell finds
utilities in their personal bin is about just as susceptible to an
attack as someone who has . in their PATH.

They might be even more susceptible. Here is why. Someone who has
~/bin in their PATH probably has a personal bin containing
custom programs with names distinct from standard utilities.
I have such things myself, such as "tagify".

The attack can be perpetrated using the name "tagify" regardless
of where the user has placed '~/bin' into PATH: first or last,
because that name is not found in any of the other locations
listed in PATH.

If we happen to have access to the user's ~/bin directory, we can set a
trap for each of the custom program names we find there.

Whereas the . exploit typically requires . to be ahead of
the standrad locations rather than as a fallback, and the trap is set
using some common utilities (ones not built into the user's shell).

--
TXR Programming Language: http://nongnu.org/txr
Cygnal: Cygwin Native Application Library: http://kylheku.com/cygnal
Mastodon: @Kazinator@mstdn.ca