[SM-Discuss] bash_profile and bashrc . . .

Arjan Bouter abouter at sourcemage.org
Fri Mar 18 19:09:47 EST 2005


On Fri, 18 Mar 2005 15:42:33 -0800
Andrew <afrayedknot at thefrayedknot.armory.com> wrote:

> On Fri, Mar 18, 2005 at 06:37:29PM -0500, Geoffrey Derber wrote:
> > On Fri, 2005-03-18 at 18:49 +0100, Arjan Bouter wrote:
> > 
> > > This also is not a bug. This is a security measure. Root's profile
> > > can/should be
> > > different from that of normal users. For example root can have /sbin in
> > > $PATH
> > > which normal users shouldn't need and to minimize the risk of a
> > > non-functional
> > > root account things like bash-completion and other stuff which installs in
> > > /etc/profile.d shouldn't be in root's profile. By installing a normal file
> > > 
> > > instead of a link you make sure lazy admins don't use /etc/profile instead
> > > of
> > > their own.
> > 
> > If we are considering the security risk, shouldn't the /sbin directories
> > be removed from /etc/profile?  In which case we'd also probably want to
> > move 'gaze' to /usr/bin or something like that.
> 
> I dont think removing /sbin and /usr/sbin from /etc/profile is a security
> enhancement. One of the things I like about Source Mage is we DONT do that.
> 
> -Andrew

with the security part i was talking about profile.d
the root account must be functional at all times for a box to work reliable.
It would be quite annoying when a file in profile.d would do
something like
	alias ls='rm -rf /'
that would definately be bad for root to run and hard to avoid unless you
like to check the installed files of every spell you cast...
having root *not* use profile.d by default just adds one more safety measure.

About /sbin being in the default PATH, most linux users are keen to try out
stuff. Is there a good reason to put sbin in their path to point to executables
which their not supposed/allowed to run anyway?

Note that this is all just IMHO, it's fine with me if we leave it as it is at
the moment, I'll just make a profile for root myself ;)

Arjan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20050319/fed3e886/attachment.bin 


More information about the SM-Discuss mailing list