[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Bash should reset OLDPWD upon login, *only*.

From: L A Walsh
Subject: Bash should reset OLDPWD upon login, *only*.
Date: Sun, 01 Oct 2017 16:30:40 -0700
User-agent: Thunderbird

Mikulas Patocka wrote:
The problem occurs even in non-login shells -

the chrome browser is started from a bash script, on some distributions firefox is also started from a bash script, mail daemon may start a script specified in user's ".forward" file. And these scripts also poke $OLDPWD and delay startup.
It **seemed** to me that the main complaint was when a new shell was started and OLDPWD was reset. I really doubt that people are relying on the value of OLDPWD when a browser or deamon is launched. However -- whatever launches the background process (chrome or the daemon) SHOULD take responsibility for setting the environment correctly for the new process (i.e. bash try to correct anything that the launch processes (the ones that launch chrome or the daemon) are not correcting. Only the launching process will know that OLDPWD won't make a difference for new program. So in those cases, the launcher should be fixed --
not bash.

In the case of a user starting a new shell -- OLDPWD has to remain whatever the
user set it to before they launched a new shell.  If the OLDPWD points to
/hang, the user should clear out OLDPWD before they launch a new shell.

Only in the case of login -- they user CAN'T set it before they login, but
someone **could** have changed the system /etc/profile script to set OLDPWD
to /hang (i.e. someone is behaving "maliciously"). In the case of login, bash is the first point-of-contact for the user and it should be started in a "SAFE" manner. Suppose you had a file-system that controlled system operations (like "/sys or /proc), where reading from a directory or file might influence the state of the system. I can show an example of this by doing a 'find' command
through /proc/sys in cygwin on a Win machine (as an admin).  It will cause
my win machine to blue-screen and reboot.

That would be *bad*.

So that's why I say that bash should create a safe-"environment" to log in with. If bash doesn't do it, someone could set OLDPWD to whatever file is read by 'find' that causes the reboot and the person could be locked out of their system.

Yes it needs console access, so likelihood is small, but consequences are "troublesome". So it should be prevented if possible.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]