Debian Bug report logs - #781367
bash may set a PATH including "." under certain circumstances

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Christoph Anton Mitterer <calestyo@scientia.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: bash may set a PATH including "." under certain circumstances

Date: Sat, 28 Mar 2015 07:56:01 +0100

Package: bash
Version: 4.3-12
Severity: important
Tags: security


Hi.

I've raised the severity a bit, since this may have security
implications.

When bash is started as a login or non-login shell from an environment
that doesn't a reasonable PATH already set and when either --noprofile
respectively --norc are used (or some other forms like run as "sh" or in
posxi mode, I guess) or when the profile/bashrc files don't set a PATH
(which they in principle shouldn't need to) then bash apparently sets
some hardcoded default for root and non-root users.

In both cases this contains "." as PATH directory, which is generally
undesired and typically not recommended to be set per default for
security reasons.


E.g.
$ id -u
1000

$ unset PATH
$ /bin/bash --norc
$ echo $PATH
/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:.

or

$ unset PATH
$ /bin/bash --noprofile --login
$ echo $PATH
/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:.

and so on.


It seems that this is a Debian speciallity, at least on e.g. centos a
sane path is then set.


Cheers,
Chris.

Message #16 received at 781367@bugs.debian.org (full text, mbox, reply):

From: Chris Hofstaedtler <zeha@debian.org>

To: Christoph Anton Mitterer <calestyo@scientia.net>, 781367@bugs.debian.org

Subject: Re: Bug#781367: bash may set a PATH including "." under certain circumstances

Date: Tue, 14 May 2024 11:08:50 +0200

Control: tags -1 + upstream

On Sat, Mar 28, 2015 at 07:56:01AM +0100, Christoph Anton Mitterer wrote:
[..]
> $ unset PATH
> $ /bin/bash --norc
> $ echo $PATH
> /usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:.
[..]
> It seems that this is a Debian speciallity, at least on e.g. centos a
> sane path is then set.

This is upstream's default, see also:
https://git.savannah.gnu.org/cgit/bash.git/tree/config-top.h#n63
(config-top.h define DEFAULT_PATH_VALUE)

Fedora overrides DEFAULT_PATH_VALUE like this:
  -DDEFAULT_PATH_VALUE='\"/usr/local/bin:/usr/bin\"'

Chris

Send a report that this bug log contains spam.