Subject: Re: /usr/local/bin (and /usr/local/sbin) in root's PATH
To: Magnus Eriksson <>
From: Greg A. Woods <>
List: netbsd-users
Date: 09/29/2007 16:37:16
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

At Sat, 29 Sep 2007 18:00:18 +0200 (CEST), Magnus Eriksson wrote:
Subject: /usr/local in PATH
> On Sat, 29 Sep 2007, Steven M. Bellovin wrote:
> > I do not agree that it's a hole.  I think it's correct to
> > include /usr/local in default paths -- /usr/local/bin for
>    I should probably explain the scenario I'm seeing here.  My concern is=
> that a bug in a suid program will allow the directory /usr/local/bin to b=
> created, with permissions such that a malicious user can put his own=20
> binaries there.  Then the next time root types "sl" instead of "ls" you'r=
> screwed.

I really can't see why you think that /usr/local/bin is in any way
special here.  It's no different, risk or threat-wise, than /bin or
/usr/bin or any other directory that already exists and is already
listed in root's default $PATH setting.

I.e. having /usr/local/bin exist as a directory by default (with the
appropriate ownership and permissions of course), and be listed in
root's default $PATH, is no more of a risk than having /usr/bin or /bin
(or /sbin or /usr/sbin) exist and be listed in root's default $PATH.

There is no new threat here, never mind any increased risk from one.

						Greg A. Woods

H:+1 416 218-0098 W:+1 416 489-5852 x122 VE3TCP RoboHack <>
Planix, Inc. <>       Secrets of the Weird <>

Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

Version: PGPfreeware 5.0i for non-commercial use
MessageID: daQfsgP2j7YckrrCPa5ElErVPuiFschG