X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=-2.4 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,T_TO_NO_BRKTS_FREEMAIL
X-Spam-Check-By:	sourceware.org
MIME-Version:	1.0
In-Reply-To:	<20110318162340.GC10633@jethro.local.lan>
References:	<4D828E8E DOT 6020607 AT alice DOT it> <4D829D52 DOT 3040706 AT laposte DOT net> <20110318134646 DOT GA10633 AT jethro DOT local DOT lan> <AANLkTimo-39nG8_LjpY-vL5w65Pc8_t10gtc+TdQ0n7N AT mail DOT gmail DOT com> <20110318162340 DOT GC10633 AT jethro DOT local DOT lan>
Date:	Fri, 18 Mar 2011 16:41:49 +0000
Message-ID:	<AANLkTinMnCP3xSrH=SjEyJCgXyqgJSNubqPY4KzMi3Pd@mail.gmail.com>
Subject:	Re: Problems with the new base-files-4.0-5?
From:	Andy Koppe <andy DOT koppe AT gmail DOT com>
To:	cygwin AT cygwin DOT com
X-IsSubscribed:	yes
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Unsubscribe:	<mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

On 18 March 2011 16:23, David Sastre wrote:
> On Fri, Mar 18, 2011 at 02:17:14PM +0000, Andy Koppe wrote:
>> On 18 March 2011 13:46, David Sastre wrote:
>> > All [[, have been changed to a portable [ test.
>> > I've changed `test -a' for a portable `test -e', and the -a operator
>> > in the user's home ownership test to a chained test:
>> >
>> > elif [ ! -O "${HOME}" ] && [ "${HOME#/home/}" != "${HOME}" ]; then ...
>>
>> Even though that home ownership test was partly my idea, I think it
>> should simply be dropped, because it doesn't actually address the
>> security issue it was supposed to address and the warning is likely to
>> cause unnecessary alarm to users with unusual yet legitimate setups.
>
> IIRC, the point was that some apps expect $HOME to be owned by the
> user in order to operate correctly.

Originally at least it was supposed to address this:

http://www.cygwin.com/ml/cygwin-developers/2010-09/msg00007.html

The $HOME warning doesn't address this because for example a
maliciously prepared /home/$USER/.bash_profile would still get
sourced.

I can't remember other reasons.

Andy

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -