From: "Zed A. Shaw" <zedshaw@...>
Date: 2005-12-05T02:47:15+09:00
Subject: Re: "disallow sticky world writable directory in PATH": Why?

I didn't write it or have anything to do with it, but it's done because
*anybody* can inject Ruby code into your program.  I really can't think
of a valid reason why you'd put a library file into such a directory
and include that directory in your PATH.

Looking at your examples below you've basically opened the
gates of hell by putting /tmp in your PATH.  Simply don't do this.

I mean seriously, you can't be bothered to create a new directory for
your stuff that only you own?  And, if the file needs to be shared, why
aren't you installing it properly in the ruby library standard way?
If it is a situation where you don't have control of the system
and need to install for a group of people, then I suggest you find the
sysadmin and beat him until he agrees to install your stuff.  Tell him
to setup sudo such that you can at least run gem and your problems are
solved.

Finally, if you absolutely *must* share a PATH directory with other
people then at least be smart:  get a group created and set the
directory writable *only* by this group, not the whole world.

Anyway, the way you're doing things is going to cause you major
problems.

Zed A. Shaw
http://www.zedshaw.com/


On Mon, 5 Dec 2005 00:47:32 +0900
Erik Veenstra <pan@erikveen.dds.nl> wrote:

> Found in ChangeLog-1.8.3:
> 
>  Wed Sep 21 02:44:09 2005  Yukihiro Matsumoto  <matz@ruby-lang.org>
>  file.c (path_check_0): disallow sticky world writable directory in
> PATH (and $LOAD_PATH). [ruby-dev:27226]
> 
> Why is this changed in Ruby 1.8.3?
> 
> And how can I work around this check? It's annyoing...
> 
> I added a simple test below.
> 
> Thanks.
> 
> gegroet,
> Erik V. - http://www.erikveen.dds.nl/
> 
> ----------------------------------------------------------------
> 
>  $ cat /tmp/test/test1.rb
>  ENV
> 
>  $ cat /tmp/test/test2.rb
>  ENV["PATH"]
> 
> ----------------------------------------------------------------
> 
>  $ useruby182
>  ruby 1.8.2 (2004-12-24) [i686-linux]
> 
>  $ PATH=$PATH:/tmp/test ruby /tmp/test/test1.rb
> 
>  $ PATH=$PATH:/tmp/test ruby /tmp/test/test2.rb
> 
> ----------------------------------------------------------------
> 
>  $ useruby183
>  ruby 1.8.3 (2005-09-21) [i686-linux]
> 
>  $ PATH=$PATH:/tmp/test ruby /tmp/test/test1.rb
> 
>  $ PATH=$PATH:/tmp/test ruby /tmp/test/test2.rb
>  /tmp/test/test2.rb:1: warning: Insecure world writable dir /tmp,
> mode 041777
> 
> ----------------------------------------------------------------
> 
>