From: Anders Kaseorg <andersk@mit.edu>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
To: alvherre@alvh.no-ip.org
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: [PATCH] Prefer getenv("HOME") to find the UNIX home directory
Date: Tue, 19 Oct 2021 02:44:03 -0700
Message-ID: <5d675cbe-7837-e9ae-961d-be7d03201f3b@mit.edu> (raw)
In-Reply-To: <20211019.173422.706584612464055211.horikyota.ntt@gmail.com>
References: <1634252654444.90107@mit.edu>
<202110182223.zeze33l55qa5@alvherre.pgsql>
<20211019.173422.706584612464055211.horikyota.ntt@gmail.com>
On 10/19/21 01:34, Kyotaro Horiguchi wrote:
> I tend to agree to this, but seeing ssh ignoring $HOME, I'm not sure
> it's safe that we follow the variable at least when accessing
> confidentiality(?) files. Since I don't understand the exact
> reasoning for the ssh's behavior so it's just my humbole opinion.
According to https://bugzilla.mindrot.org/show_bug.cgi?id=3048#c1, it
used to be supported to install the ssh binary as setuid. A
setuid/setgid binary needs to treat all environment variables with
suspicion: if it can be convinced to write a file to $HOME with root
privileges, then a user who modifies $HOME before invoking the binary
could cause it to write to a file that the user normally couldn’t.
There’s no such concern for a binary that isn’t setuid/setgid. Anyone
with the ability to modify $HOME can be assumed to already have full
control of the user account.
Anders
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: andersk@mit.edu, horikyota.ntt@gmail.com, alvherre@alvh.no-ip.org, pgsql-hackers@lists.postgresql.org
Subject: Re: [PATCH] Prefer getenv("HOME") to find the UNIX home directory
In-Reply-To: <5d675cbe-7837-e9ae-961d-be7d03201f3b@mit.edu>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox