[4570] in RedHat Linux List
Official RH Response? Re: Is Perl Broken?
daemon@ATHENA.MIT.EDU (Kyle Ferrio)
Fri Nov 15 14:35:44 1996
Date: Fri, 15 Nov 1996 14:21:41 -0500 (EST)
From: Kyle Ferrio <kbf@phy.duke.edu>
To: Chris <yeo@broadwaynet.com>
cc: redhat-list@redhat.com
In-Reply-To: <Pine.LNX.3.95.961115004214.17138A-100000@Zeppelin.broadwaynet.com>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
Thanks, Chris. The reason I ask is that under Perl 4 a number of Larry
Wall's own suid script examples used something like
@INC = @INC[$#INC - 1];
to ensure that -only- the standard library was in the include path.
This nominally prevents a "clever" user from calling an evil *.pl with
the same name as something in PERLLIB, since the paths in @INC are
searched first to last. One could argue that relying on the compiled-in
path to be safe is also inherently insecure, but if someone has enough
access to your box to recompile suidperl or rewrite the standard perl
libs, you've got bigger problems anyway.
Mostly I'd like to know if the behavior I'm seeing in the RH compile is
canonical with Mr. Wall's blessing, or if the Red Hat guys close this
scheme. And if so, what other non-portable features are lurking. I feel
very strongly that burying the standard lib between non-standard (?) paths
goes against at least two of the Three Virtues, vis a vis portability.
Could Team Red Hat please comment on this?
I'm still waiting for the 2nd edition of the camel to arrive. :(
Kyle
On Fri, 15 Nov 1996, Chris wrote:
> On Fri, 15 Nov 1996, Kyle Ferrio wrote:
>
> > While I have your attention, does anyone know if the convention for @INC
> > has been changed in Perl 5? The version precompiled by Redhat effectively
> > has the particularly ugly
> >
> > @INC = ("/usr/lib/perl5/i386-linux/5.003", "/usr/lib/perl5",
> > "/usr/lib/perl5/site_perl/i586-linux",
> > " /usr/lib/perl5/site_perl")
>
> Kyle,
>
> I can't say for sure... I just use the normal perl libraries (ie nothing
> external) for most things, and if I use a perl library then I assign it
> like this:
>
> require "/home/yeo/web/cgi-bin/cgi-lib.pl";
>
> And that gets the one library that I use aside from the internal ones...
> btw, this message (of yours) didn't get sent to the redhat list so you
> might want to repost it... someone else might be able to help you.
>
> Cya
>
> Chris
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
