Expanding _PATH_DEFPATH

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Expanding _PATH_DEFPATH

Jilles Tjoelker
In <paths.h> there is a #define _PATH_DEFPATH which is set to
/usr/bin:/bin. This does not include /sbin, /usr/sbin and ports
(/usr/local/bin and /usr/local/sbin) directories and is therefore often
insufficient.

This is rarely a problem because _PATH_DEFPATH is overridden by
/etc/login.conf, ~/.login_conf and/or shell startup files. _PATH_DEFPATH
is still used as a default by execlp(), execvp(), posix_spawnp() and sh
if PATH is not set, and by cron.

Especially the latter is a common trap (most recently in PR 204813). We
can fix it for 99% by changing _PATH_DEFPATH to
/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
This is the path in the default class in the default /etc/login.conf,
excluding ~/bin which would not be expanded properly in a string
constant.

For consistency, the _PATH_DEFPATH for RESCUE below and in 3 man pages
(exec.3, posix_spawn.3, crontab.5) need to be adjusted as well.

--
Jilles Tjoelker
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-arch
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Expanding _PATH_DEFPATH

Alfred Perlstein-2


On 12/24/15 3:13 PM, Jilles Tjoelker wrote:

> In <paths.h> there is a #define _PATH_DEFPATH which is set to
> /usr/bin:/bin. This does not include /sbin, /usr/sbin and ports
> (/usr/local/bin and /usr/local/sbin) directories and is therefore often
> insufficient.
>
> This is rarely a problem because _PATH_DEFPATH is overridden by
> /etc/login.conf, ~/.login_conf and/or shell startup files. _PATH_DEFPATH
> is still used as a default by execlp(), execvp(), posix_spawnp() and sh
> if PATH is not set, and by cron.
>
> Especially the latter is a common trap (most recently in PR 204813). We
> can fix it for 99% by changing _PATH_DEFPATH to
> /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
> This is the path in the default class in the default /etc/login.conf,
> excluding ~/bin which would not be expanded properly in a string
> constant.
>
> For consistency, the _PATH_DEFPATH for RESCUE below and in 3 man pages
> (exec.3, posix_spawn.3, crontab.5) need to be adjusted as well.
>
I have stubbed toes against this silly restricted path so many times
that this would be a welcome change.

However before changing the PATH please consult secteam to make sure
it's safe.

I might recommend for the time being going with the suggestion in the PR
which asks that a friendly note be added to files.  This would be more
"safe" until secteam can analyze.

-Alfred
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-arch
To unsubscribe, send any mail to "[hidden email]"