pkg/25044: Bash has current working directory in PATH by default

[Christian Biere <christianbiere%gmx.de@localhost>]

>Number:         25044
>Category:       pkg
>Synopsis:       bash has current working in PATH by default
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    pkg-manager
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Sun Apr 04 00:01:01 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Christian Biere
>Release:        NetBSD 2.0B
>Organization:
>Environment:
System: NetBSD cyclonus 2.0B NetBSD 2.0B (STARSCREAM) #0: Wed Mar 31 19:33:12 
CEST 2004 bin@cyclonus:/usr/obj/sys/arch/i386/compile/STARSCREAM i386
>Description:

Bash (2.05b) sets the environment variable PATH to a hardcoded default if it's
not set by the configuration files or not already set before execution.
First of all, this default path is quite non-standard for NetBSD. Worse,
it contains a dot i.e., the current working directory.
This situation (PATH unset, no login files) seems rather unlikely to me, so
I'd not rate this as critical.

>How-To-Repeat:

 o mv $HOME/.{profile,bashrc,bash_login,bash_profile} backup/
 o unset PATH
 o /usr/pkg/bin/bash
 o echo $PATH
   /usr/gnu/bin:/usr/local/bin:/usr/ucb:/bin:/usr/bin:.

>Fix:

Use sysctl user.cs_path instead of hardcoding a default path
(PATH_DEFAULT_VALUE)or hardcode a saner default e.g.,
'/bin:/usr/bin:/sbin:/usr/sbin' or _PATH_DEFPATH from /usr/include/paths.h
as /bin/sh. [ Although, I prefer to not have /usr/pkg/bin in my PATH as
root. ] Another workaround for login shells is to modify /etc/profile like
this:

if [ x$PATH = x ]; then
  PATH=/bin:/usr/bin:/sbin:/usr/bin
  export PATH
fi

>Release-Note:
>Audit-Trail:
>Unformatted: