On 29 May 2018 at 10:37, Till Maas <opensource@xxxxxxxxx> wrote:
Hi,
On Tue, May 29, 2018 at 10:19:44AM +0100, Tomasz Kłoczko wrote:
> distribution binaries is extremely dangerous, and I'm really surprised that
> no one looks on those already discussed here issues (and few similar or
> related) as SERIOUS SECURITY TREAT to whole distribution.
IIRC enough people explained why these are not serious security threats.
This is nothing personal. Some people are unable to understand the subjects above some level of the complexity or sometimes some classes of the problems :(
Yes, I've already noticed that some people commenting in this thread really do not understand the treat, and because some of those people are sometimes responsible for making some crucial Fedora decisions this is nothing more than yet another small crack in whole distribution maintenance process.
Just for the record: security risk which I'm talking about is straightly related not with adding ~/.local/bin to $PATH, but with paths like /usr/local/bin and /usr/local/sbin which are already used in the $PATH. This connected with using env in many current packages adds next batch of possibilities. However, all those possibilities became *few years ago* suddenly opened/active only because what now is in the $PATH and because some distribution binaries or scripts allows use programs from outside of the distribution BEFORE using standard paths where executables are installed by all packages.
$ echo $PATH
/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin
Any compilation of the packages on the distro build systems, any execution of the program without full; path in ALL scripts (check /etc/profile can you find such programs called in script like this one) or most of the use execve() with above $PATH in env is affected as well by what is in the $PATH .. NOW!
Adding ~/.local/bin to the $PATH with the current level of the risk would be barely noticeable.
Just try to grep across /usr for /usr/local. This is not only about $PATH. Many scripts, programs or configuration files have HARDCODED checking availability of some resources or executables in /usr/local before start use those from /usr.
Something what started many decades ago (in U*nix epoch of the flint) in the time when people have' been installing additional programs in /usr/local prefix because they've been developing something or because distributions where very small almost always was necessary to install something now STILL is used without all those reasons.
kloczek
--
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH
Tomasz Kłoczko | LinkedIn: http://lnkd.in/
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx/message/5WFMTDCDJPQEEM64WZZ76CS23FWXQD4F/
