Re: functions/Completion/Linux/_modutils

[Peter Stephenson <pws@csr.com>]

On Thu, 15 May 2008 18:00:35 +0100
Peter Stephenson <pws@csr.com> wrote:
> "Bart Schaefer" wrote:
> > On Thu, May 15, 2008 at 5:16 AM, Clint Adams <schizo@debian.org> wrote:
> > >
> > > zstyle ':completion:*:sudo:*' command-path /usr/local/sbin /usr/local/bin \
> > >                             /usr/sbin /usr/bin /sbin /bin /usr/X11R6/bin
> > 
> > OK, so maybe the right thing is to ignore my patch and have _sudo grab
> > the value of *that* style and export it.
> 
> Sounds pretty sensible, but we definitely want to document that this
> happens for security reasons.

Thinking more, security surely isn't an issue after all.  Nothing is
actually being run here as superuser, and you're only using the
command-path (as the current user) that the current user has explicitly
told you it's OK to use.  So there's no more problem with Trojans than with
any other use of paths by the shell.

-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070