Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] bash_profile and bashrc . . .

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Arjan Bouter <abouter AT sourcemage.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] bash_profile and bashrc . . .
  • Date: Sat, 19 Mar 2005 01:09:47 +0100

On Fri, 18 Mar 2005 15:42:33 -0800
Andrew <afrayedknot AT thefrayedknot.armory.com> wrote:

> On Fri, Mar 18, 2005 at 06:37:29PM -0500, Geoffrey Derber wrote:
> > On Fri, 2005-03-18 at 18:49 +0100, Arjan Bouter wrote:
> >
> > > This also is not a bug. This is a security measure. Root's profile
> > > can/should be
> > > different from that of normal users. For example root can have /sbin in
> > > $PATH
> > > which normal users shouldn't need and to minimize the risk of a
> > > non-functional
> > > root account things like bash-completion and other stuff which installs
> > > in
> > > /etc/profile.d shouldn't be in root's profile. By installing a normal
> > > file
> > >
> > > instead of a link you make sure lazy admins don't use /etc/profile
> > > instead
> > > of
> > > their own.
> >
> > If we are considering the security risk, shouldn't the /sbin directories
> > be removed from /etc/profile? In which case we'd also probably want to
> > move 'gaze' to /usr/bin or something like that.
>
> I dont think removing /sbin and /usr/sbin from /etc/profile is a security
> enhancement. One of the things I like about Source Mage is we DONT do that.
>
> -Andrew

with the security part i was talking about profile.d
the root account must be functional at all times for a box to work reliable.
It would be quite annoying when a file in profile.d would do
something like
alias ls='rm -rf /'
that would definately be bad for root to run and hard to avoid unless you
like to check the installed files of every spell you cast...
having root *not* use profile.d by default just adds one more safety measure.

About /sbin being in the default PATH, most linux users are keen to try out
stuff. Is there a good reason to put sbin in their path to point to
executables
which their not supposed/allowed to run anyway?

Note that this is all just IMHO, it's fine with me if we leave it as it is at
the moment, I'll just make a profile for root myself ;)

Arjan

Attachment: pgpyfta4fryIC.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page