On Sun, May 29, 2005 at 01:42:32PM -0700, Dennis Peterson said:
> You could try a trivial example by creating a cron job that will fail.
> This can be done by requesting execution of a process that doesn't exist.
> 
> * * * * * /tmp/junk 2>$1 |/usr/bin/mail -s "this is a test" [EMAIL PROTECTED]
> 
> If you were to do this professionally you should include the full path to
> mail as well as your executable. It's a security thing and failure to do
> so it seen as a rookie mistake.  Otherwise it will find the first example
> of either somewhere in the system path. It can be real embarrasing when 
> somebody has created a script that contains "echo > /etc/passwd" in it and
> your cron process finds it because you've not used a fully qualified path.

First, you advise someone to receive 4 empty emails an hour, then you
redirect stderr to the last match in a regular expression, and then you
have a world-writable root $PATH.  Then you finish up with comments
about 'rookie mistakes' and an insult towards someone trying to help the
OP.

Those who live in glass houses and so forth.  Can we try to keep a
civil tongue, at least when you have your foot in your mouth?
-- 
 --------------------------------------------------------------------------
|  Stephen Gran                  | <tausq> Q. What's the difference        |
|  [EMAIL PROTECTED]             | between Batman and Bill Gates? <tausq>  |
|  http://www.lobefin.net/~steve | A. When Batman fought the Penguin, he   |
|                                | won.                                    |
 --------------------------------------------------------------------------

Attachment: pgp1H46BEwtWF.pgp
Description: PGP signature

_______________________________________________
http://lurker.clamav.net/list/clamav-users.html

Reply via email to