Public SourceMage Discussion List

[Arjan Bouter <abouter AT sourcemage.org>]

On Fri, 18 Mar 2005 15:42:33 -0800
Andrew <afrayedknot AT thefrayedknot.armory.com> wrote:

> On Fri, Mar 18, 2005 at 06:37:29PM -0500, Geoffrey Derber wrote:
> > On Fri, 2005-03-18 at 18:49 +0100, Arjan Bouter wrote:
> > 
> > > This also is not a bug. This is a security measure. Root's profile
> > > can/should be
> > > different from that of normal users. For example root can have /sbin in
> > > $PATH
> > > which normal users shouldn't need and to minimize the risk of a
> > > non-functional
> > > root account things like bash-completion and other stuff which installs 
> > > in
> > > /etc/profile.d shouldn't be in root's profile. By installing a normal 
> > > file
> > > 
> > > instead of a link you make sure lazy admins don't use /etc/profile 
> > > instead
> > > of
> > > their own.
> > 
> > If we are considering the security risk, shouldn't the /sbin directories
> > be removed from /etc/profile?  In which case we'd also probably want to
> > move 'gaze' to /usr/bin or something like that.
> 
> I dont think removing /sbin and /usr/sbin from /etc/profile is a security
> enhancement. One of the things I like about Source Mage is we DONT do that.
> 
> -Andrew

with the security part i was talking about profile.d
the root account must be functional at all times for a box to work reliable.
It would be quite annoying when a file in profile.d would do
something like
        alias ls='rm -rf /'
that would definately be bad for root to run and hard to avoid unless you
like to check the installed files of every spell you cast...
having root *not* use profile.d by default just adds one more safety measure.

About /sbin being in the default PATH, most linux users are keen to try out
stuff. Is there a good reason to put sbin in their path to point to 
executables
which their not supposed/allowed to run anyway?

Note that this is all just IMHO, it's fine with me if we leave it as it is at
the moment, I'll just make a profile for root myself ;)

Arjan

Attachment: pgpyfta4fryIC.pgp
Description: PGP signature