DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; q=dns; s=default; b=nLaNM8
	nw5CEPx5IK0eJIhdokVKg8AJpGEP+PdlZMrYgZGbtqec7isKSvcbkIHZJck57Rch
	V7N3ySceDBKyQvZsXXqCvccxb5LcOdvXCKRZVLuyCXY1vBVyJ4Ti07vR5cIX9+sp
	9sUtEEPEXGFxxycOS9MydKY4GkNnv+z57cliw=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Message-ID: <54369ADE.7060201@redhat.com>
Date: Thu, 09 Oct 2014 08:25:34 -0600
From: Eric Blake <eblake@redhat.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.1
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: Cannot exec() program outside of /bin if PATH is unset
References: <54135451.3060902@t-online.de> <601154762.20140913012935@yandex.ru> <541378C4.6030705@t-online.de> <54137BDE.6040907@redhat.com> <54137C7F.1040507@redhat.com> <541415B1.8090500@t-online.de> <541698CC.7090802@lysator.liu.se> <5416F946.7010905@t-online.de> <20141008134106.GF29235@calimero.vinschen.de> <5435714D.6060206@t-online.de> <20141009100317.GI29235@calimero.vinschen.de>
In-Reply-To: <20141009100317.GI29235@calimero.vinschen.de>
OpenPGP: url=http://people.redhat.com/eblake/eblake.gpg
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB"

--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 10/09/2014 04:03 AM, Corinna Vinschen wrote:

> Ok.  Or... hmm.  The fact that using SetDllDirectory disallows searching
> the CWD got me thinking twice.  Security-wise it would really be the
> right thing to do.  Usually DLLs are in defined search paths:
>=20
> - Application dir
> - Application defined dirs
> - System dirs
>=20
> So, what scenario would actually break by removing CWD from the search
> path?  Running tests in an libtoolized project dir, perhaps?  Is that a
> valid concern or did libtool already take care of this?

Running a libtool project is probably unimpacted - libtool builds
in-tree dlls into a subdirectory, which is not usually the CWD.

--=20
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Public key at http://people.redhat.com/eblake/eblake.gpg

iQEcBAEBCAAGBQJUNpreAAoJEKeha0olJ0NqwOkIAKjRkP9yeYB5/fbCPpI/Zc9Z
Dfuj8qrW+tlftZ52RaP7sZJAal0sUCQ4SRuwM2+qqR2rRvcqbXg3ggFOdCI1iOT3
uLKF6/9GQHe4xatDoR3zPLWKjwL/adVCDwFgs+IuX7j76PpZuUGo8Fbx75/2YiKK
82/30DQdlsCKrpP/fzlqlOE/izhel5f7+bGRMaVM1BG7h/T/0BHUs1hyQAo79x7e
i0qfzoNPqO7mFoioGPvsWpicnVKi/kaJ9Tihcz1taj7XerH3Vuh/ouRTYWKK4paX
thpXdrOFsI9GqsVPgErWWunLw4Mu1K2BDQCHEHzEnye7KUnbeq4pFuzPbe1GHeM=
=qlPx
-----END PGP SIGNATURE-----

--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB--