Security and $PATH

[gwyn at brl-vld]

From:      Doug Gwyn (VLD/VMB) <gwyn at brl-vld>

I don't see any security problem with PATH=:/bin:/usr/bin etc.
since only the user having programs with the same name as standard
utilities in his current directory would be affected.  However,
the incautious super-user could get in trouble while rummaging
around in other peoples' directories (serves him right).  At BRL
we set a different path like PATH=/etc:/bin:/usr/bin for su and
super-user sh to avoid possible problems.

It would generally be more efficient to have the system directories
first in the search $PATH, since most commands are not found in the
current directory.  Less confusing, too.

I think everybody ought to have a $PATH set in his .profile so he
can do what he wants in this regard.