On Fri, Jun 22, 2018 at 05:01:38PM +0100, Tomasz Kłoczko wrote:
If Fedora maintainers will decide to put ~/.local/bin over /usr/bin
on
the $PATH it will be possible to control over ~/.local/bin/id (and/or
many more similar commands) what happens on begin of the user login
session. None of the packages updates (except that one which will
remove ~/.local/bin/ from the $PATH) would be able to stop damage ones
done.
It does seem like /etc/profile and others should be updated to use full
paths for these commands.
I don't think this particularly expands the attack surface in any
meaningful way, though.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader