From: hpa@merle.acns.nwu.edu (H. Peter Anvin N9ITP) Subject: Re: question about setuid Date: Sun, 4 Apr 1993 21:13:46 GMT
In article <1p9ns6$p31@nz12.rz.uni-karlsruhe.de> of comp.os.linux,
ig25@fg30.rz.uni-karlsruhe.de (Thomas Koenig) writes:
>
> According to the "Posix Programmer's Guide" by Don Lewine, the exec*()
> family of functions also looks in the environment variable PATH if
> the program to be executed cannot be found in the current directory.
> This is indeed implemented this way in Linux (or was, the last time
> I looked, around 0.99pl5); programs which use exec* are still vulnerable
> if they don't contain an explicit path (say execve("/bin/ls",...)
This is only true for the "p" subclass of exec (execvpe() for example).
/hpa
-- INTERNET: hpa@nwu.edu FINGER: hpa@eecs.nwu.edu BITNET: HPA@NUACC IBM MAIL: 36073 at IBMX400 HAM RADIO: N9ITP, SM4TKN NeXTMAIL: hpa@speedy.acns.nwu.edu while ( 1 ) ; cp /dev/zero /dev/null & end