~/.profile should append, rather than prepend $HOME/bin
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
bash (Ubuntu) |
Invalid
|
Low
|
Dustin Kirkland |
Bug Description
Binary package hint: bash
Currently, skel.profile prepends $HOME/bin to PATH.
Although some people may prefer $HOME/bin on the front of $PATH so as to override various system binaries, this is not a good idea in if we're going to follow a secure-default philosophy. The ability to override something like "ls" with "~/bin/ls" could really wreak havoc on a user's experience. There are certainly other ways for a malicious user/process to accomplish this (with, say "alias", or "export PATH=...."), but few are more trivial than simply putting an executable in ~/bin.
It is arguably slightly more secure, but definitely more conservative to instead *append* ~/bin onto PATH. By default, this would give users access to their own local programs without overriding any system programs.
In the event that a more knowledgeable user wants to consciously override system programs with their own in ~/bin, it is trivial for such users to edit their own ~/.profile (or other shell mechanisms) for modifying the PATH. We are simply trying to avoid making this the default behavior.
:-Dustin
I'm working on a patch. Assigning to myself, low proirity.
:-Dustin