X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-2.4 required=5.0	tests=AWL,BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,T_TO_NO_BRKTS_FREEMAIL
X-Spam-Check-By: sourceware.org
MIME-Version: 1.0
In-Reply-To: <20110318162340.GC10633@jethro.local.lan>
References: <4D828E8E DOT 6020607 AT alice DOT it>	<4D829D52 DOT 3040706 AT laposte DOT net>	<20110318134646 DOT GA10633 AT jethro DOT local DOT lan>	<AANLkTimo-39nG8_LjpY-vL5w65Pc8_t10gtc+TdQ0n7N AT mail DOT gmail DOT com>	<20110318162340 DOT GC10633 AT jethro DOT local DOT lan>
Date: Fri, 18 Mar 2011 16:41:49 +0000
Message-ID: <AANLkTinMnCP3xSrH=SjEyJCgXyqgJSNubqPY4KzMi3Pd@mail.gmail.com>
Subject: Re: Problems with the new base-files-4.0-5?
From: Andy Koppe <andy DOT koppe AT gmail DOT com>
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset=UTF-8
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On 18 March 2011 16:23, David Sastre wrote:
> On Fri, Mar 18, 2011 at 02:17:14PM +0000, Andy Koppe wrote:
>> On 18 March 2011 13:46, David Sastre wrote:
>> > All [[, have been changed to a portable [ test.
>> > I've changed `test -a' for a portable `test -e', and the -a operator
>> > in the user's home ownership test to a chained test:
>> >
>> > elif [ ! -O "${HOME}" ] && [ "${HOME#/home/}" != "${HOME}" ]; then ...
>>
>> Even though that home ownership test was partly my idea, I think it
>> should simply be dropped, because it doesn't actually address the
>> security issue it was supposed to address and the warning is likely to
>> cause unnecessary alarm to users with unusual yet legitimate setups.
>
> IIRC, the point was that some apps expect $HOME to be owned by the
> user in order to operate correctly.

Originally at least it was supposed to address this:

http://www.cygwin.com/ml/cygwin-developers/2010-09/msg00007.html

The $HOME warning doesn't address this because for example a
maliciously prepared /home/$USER/.bash_profile would still get
sourced.

I can't remember other reasons.

Andy

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple