Re: Unable to start program

1998-04-08 Thread Torsten Hilbrich
Daniel Martin at cush [EMAIL PROTECTED] writes:

 I should point out that it is considered a bad security idea to put
 . (or in fact any directory name that doesn't begin with /) in
 root's PATH.  If you're just wanting to do something one time, it
 might be ok to do 'PATH=$PATH:.' as above but I wouldn't put that into
 root's initialization files, or into the system-wide path.  (I should
 qualify this with the statement that I don't completely understand why 
 this is a security hole when it's done as the last component of the
 PATH, but...)

Quite simple, think of a command named sl put in some users home
directory and root which tries to type ls but accidently typed sl.  If
cwd is that directory the program sl is executed with root priviledge
:-(.

Torsten


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]


Re: Unable to start program

1998-04-08 Thread Daniel Martin at cush
Torsten Hilbrich [EMAIL PROTECTED] writes:

 Daniel Martin at cush [EMAIL PROTECTED] writes:
SNIP
  root's initialization files, or into the system-wide path.  (I should
  qualify this with the statement that I don't completely understand why 
  this is a security hole when it's done as the last component of the
  PATH, but...)
 
 Quite simple, think of a command named sl put in some users home
 directory and root which tries to type ls but accidently typed sl.  If
 cwd is that directory the program sl is executed with root priviledge
 :-(.

Fair enough; I was thinking that no one would be careless enough to
allow typos into command lines typed in a root shell.  (I know that I, 
for one, am painstakingly careful about what I type as root after
hosing a slackware system three years back with an accidental 
'rm -r /lib' - I had meant to do 'rm -r /lib/pbmcompat/' but on that
keyboard the '/' and return were just too close together...)


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]


Unable to start program

1998-04-07 Thread Gabrie van Zanten
Hi,

Sometimes I see a program (I think) but I can't run it, even though I'm
using root. Like this one:
-rwxr-xr-x  XF86_S3V   2043768

I thought I could at least run it and get an error, but Linux says: command
not found. I had this too when installing fortune. After logging in as a
user I could run fortune, but not before as root (fortune was in the users
PATH, does it matter?).

Gabrie



--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]


Re: Unable to start program

1998-04-07 Thread Bradley Bell
Gabrie van Zanten wrote:
 Sometimes I see a program (I think) but I can't run it, even though I'm
 using root. Like this one:
 -rwxr-xr-x  XF86_S3V   2043768
 
 I thought I could at least run it and get an error, but Linux says: command
 not found. I had this too when installing fortune. After logging in as a
 user I could run fortune, but not before as root (fortune was in the users
 PATH, does it matter?).

the root user does not have /usr/games (the location of 'fortune') or
. (the current directory) in it's PATH environment variable.  to use
them, you have to state the path explicitly.  e.g.:
/usr/games/fortune
or
./XF86_S3V

-brad


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]


Re: Unable to start program

1998-04-07 Thread Joost Kooij
On Tue, 7 Apr 1998, Gabrie van Zanten wrote:

 Hi,
 
 Sometimes I see a program (I think) but I can't run it, even though I'm
 using root. Like this one:
 -rwxr-xr-x  XF86_S3V   2043768
 
 I thought I could at least run it and get an error, but Linux says: command
 not found. I had this too when installing fortune. After logging in as a
 user I could run fortune, but not before as root (fortune was in the users
 PATH, does it matter?).

If its not in your $PATH, the shell won't find it. Unix, unlike dos, does
not automatically consider the current directory ( $PWD ) to be part of
$PATH, unless you explicitly set it so ( eg. add a dot to $PATH like so: 
export PATH=$PATH:. )

If you type ./commandname that will always work, because the shell sees an
absolute path prepended to the command, just like as if you had typed
/home/userx/somedir/command

Of course, the commandname file must have the execution bit set ( chmod +x
commandname )

Cheers,


Joost


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]


Re: Unable to start program

1998-04-07 Thread Daniel Martin at cush
Joost Kooij [EMAIL PROTECTED] writes:

 On Tue, 7 Apr 1998, Gabrie van Zanten wrote:
 
  Hi,
  
  Sometimes I see a program (I think) but I can't run it, even though I'm
  using root. Like this one:
  -rwxr-xr-x  XF86_S3V   2043768
  
  I thought I could at least run it and get an error, but Linux says: command
  not found. I had this too when installing fortune. After logging in as a
  user I could run fortune, but not before as root (fortune was in the users
  PATH, does it matter?).
 
 If its not in your $PATH, the shell won't find it. Unix, unlike dos, does
 not automatically consider the current directory ( $PWD ) to be part of
 $PATH, unless you explicitly set it so ( eg. add a dot to $PATH like so: 
 export PATH=$PATH:. )
 
 If you type ./commandname that will always work, because the shell sees an
 absolute path prepended to the command, just like as if you had typed
 /home/userx/somedir/command
SNIP

I should point out that it is considered a bad security idea to put
. (or in fact any directory name that doesn't begin with /) in
root's PATH.  If you're just wanting to do something one time, it
might be ok to do 'PATH=$PATH:.' as above but I wouldn't put that into
root's initialization files, or into the system-wide path.  (I should
qualify this with the statement that I don't completely understand why 
this is a security hole when it's done as the last component of the
PATH, but...)


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]