Re: sh(1) and ksh(1) default PATH

[David Holland <dholland-tech%netbsd.org@localhost>]

On Mon, Aug 15, 2022 at 08:28:28AM +0200, tlaronde%polynum.com@localhost wrote:
 > > (If there are no bins with duplicate names, it doesn't matter. If
 > > there are, it does. Argument 1: the point of installing something in
 > > /usr/local or /usr/pkg that's also in base is to replace the version
 > > in base, not for it to be inaccessible to ordinary use. Argument 2:
 > > the stuff in base is canonical and it's wrong for random whatnot to
 > > arbitrarily override it. I admit I don't fully understand argument 2
 > > and I suspect it may partly be a leftover response dating from System
 > > V installs with world-writable /usr/local.)
 > 
 > Argument 2.1: permissions on /usr/local may be relaxed and malicious
 > software could more easily install devious utilities there to precisely
 > override safer versions in base. So by default, base version should take
 > precedence.

Except that if you do that you have deliberately misconfigured your
system. I don't think there's any reason the default setup should
cater to this kind of inherently unsafe environment.

-- 
David A. Holland
dholland%netbsd.org@localhost