Why is it bad to add '.' to PATH?

Question

I've read one explanation saying it can allow malicious executables that are in the cwd to run in place of similarly named built-ins and core utilities.

For something to wreak true havoc, wouldn't this only apply to root? And in any case, if '.' were appended to PATH instead of prepended, shouldn't that circumvent this "replacement" attack, since PATH's directories are scanned in order? (Aren't they scanned in order?)

Are there any other issues besides this one?

Answer 1

It depends on what you define as havoc. If you consider loss of all of your personal files havoc, then I would say yes, even if you have a backup.

As far as appending, yes that is safer, but unless your typing is a lot better than mine, typos can cause the same trouble.

Answer 2

Yes path variables are processed in order and your solution would ensure known executables were processed first.

However you still leave room for malicious executables being run. For example if I stuck a bash script somewhere which ran 'rm -fr ~/' or something even nastier and then called the executable 'sl' (a common typo for 'ls') you could find yourself in all sorts of trouble!

Don't tell me you never run typo'd commands ;)

Answer 3

Having "." in the path leads to commands magically appearing and disappearing. cd somewhere and your command starts or stops working. It is obviuous that you were running out of "." if the command is "./doit" than if the command is "doit". The same problem applies to ".." and any paths starting with "./" or "../" and any other relative paths.

For personal commands I recommend $HOME/bin. From there they may migrate to /usr/local/bin if they are useful enough.

EDIT: As alluded to in the accepted answer, executable files (programs) in the current directory can do terrible things to your system. If they have the same name as a commonly used command, it is relatively easy for them to be triggered by changing to the directory containing them. Malicious people have been known to write such programs with the intent of causing harm. Accidental execution of such programs can be mitigated by putting the relative path entry at the end of the PATH list. Programs named with common misspellings of common commands may still be triggered.

Answer 4

Its easy to just type ./sl which is quite specific stating "I want to execute the file named "sl" in the CWD. There is no mistake to make there due to $PATH. :-)