X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; q=dns; s=default; b=nLaNM8
	nw5CEPx5IK0eJIhdokVKg8AJpGEP+PdlZMrYgZGbtqec7isKSvcbkIHZJck57Rch
	V7N3ySceDBKyQvZsXXqCvccxb5LcOdvXCKRZVLuyCXY1vBVyJ4Ti07vR5cIX9+sp
	9sUtEEPEXGFxxycOS9MydKY4GkNnv+z57cliw=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; s=default; bh=sd2PuNNSI0fE
	dtwG2s/5fFRlVnI=; b=NbLeOaT0UvWoMiqL9cRHOTXSQRd4hSKCm0ydqLb9ND7k
	qZnDp38DQpkhUaMUq4BbTJlaw7gIcwlEUJx10Am+HwUx0TRCYxe+DropQa6+k+50
	Otl6n4+E0IpGhdiFarmxWFRyUlvq2kaTAJt0oGFjwJHIgCeOZ57YYsGFHxmnU7o=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-2.1 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham version=3.3.2
X-HELO:	mx1.redhat.com
Message-ID:	<54369ADE.7060201@redhat.com>
Date:	Thu, 09 Oct 2014 08:25:34 -0600
From:	Eric Blake <eblake AT redhat DOT com>
User-Agent:	Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.1
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: Cannot exec() program outside of /bin if PATH is unset
References:	<54135451 DOT 3060902 AT t-online DOT de> <601154762 DOT 20140913012935 AT yandex DOT ru> <541378C4 DOT 6030705 AT t-online DOT de> <54137BDE DOT 6040907 AT redhat DOT com> <54137C7F DOT 1040507 AT redhat DOT com> <541415B1 DOT 8090500 AT t-online DOT de> <541698CC DOT 7090802 AT lysator DOT liu DOT se> <5416F946 DOT 7010905 AT t-online DOT de> <20141008134106 DOT GF29235 AT calimero DOT vinschen DOT de> <5435714D DOT 6060206 AT t-online DOT de> <20141009100317 DOT GI29235 AT calimero DOT vinschen DOT de>
In-Reply-To:	<20141009100317.GI29235@calimero.vinschen.de>
OpenPGP:	url=http://people.redhat.com/eblake/eblake.gpg
X-IsSubscribed:	yes

--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 10/09/2014 04:03 AM, Corinna Vinschen wrote:

> Ok.  Or... hmm.  The fact that using SetDllDirectory disallows searching
> the CWD got me thinking twice.  Security-wise it would really be the
> right thing to do.  Usually DLLs are in defined search paths:
>=20
> - Application dir
> - Application defined dirs
> - System dirs
>=20
> So, what scenario would actually break by removing CWD from the search
> path?  Running tests in an libtoolized project dir, perhaps?  Is that a
> valid concern or did libtool already take care of this?

Running a libtool project is probably unimpacted - libtool builds
in-tree dlls into a subdirectory, which is not usually the CWD.

--=20
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Public key at http://people.redhat.com/eblake/eblake.gpg

iQEcBAEBCAAGBQJUNpreAAoJEKeha0olJ0NqwOkIAKjRkP9yeYB5/fbCPpI/Zc9Z
Dfuj8qrW+tlftZ52RaP7sZJAal0sUCQ4SRuwM2+qqR2rRvcqbXg3ggFOdCI1iOT3
uLKF6/9GQHe4xatDoR3zPLWKjwL/adVCDwFgs+IuX7j76PpZuUGo8Fbx75/2YiKK
82/30DQdlsCKrpP/fzlqlOE/izhel5f7+bGRMaVM1BG7h/T/0BHUs1hyQAo79x7e
i0qfzoNPqO7mFoioGPvsWpicnVKi/kaJ9Tihcz1taj7XerH3Vuh/ouRTYWKK4paX
thpXdrOFsI9GqsVPgErWWunLw4Mu1K2BDQCHEHzEnye7KUnbeq4pFuzPbe1GHeM=
=qlPx
-----END PGP SIGNATURE-----

--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB--

- Raw text -