X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; q=dns; s=default; b=nLaNM8
	nw5CEPx5IK0eJIhdokVKg8AJpGEP+PdlZMrYgZGbtqec7isKSvcbkIHZJck57Rch
	V7N3ySceDBKyQvZsXXqCvccxb5LcOdvXCKRZVLuyCXY1vBVyJ4Ti07vR5cIX9+sp
	9sUtEEPEXGFxxycOS9MydKY4GkNnv+z57cliw=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; s=default; bh=sd2PuNNSI0fE
	dtwG2s/5fFRlVnI=; b=NbLeOaT0UvWoMiqL9cRHOTXSQRd4hSKCm0ydqLb9ND7k
	qZnDp38DQpkhUaMUq4BbTJlaw7gIcwlEUJx10Am+HwUx0TRCYxe+DropQa6+k+50
	Otl6n4+E0IpGhdiFarmxWFRyUlvq2kaTAJt0oGFjwJHIgCeOZ57YYsGFHxmnU7o=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-2.1 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham version=3.3.2
X-HELO: mx1.redhat.com
Message-ID: <54369ADE.7060201@redhat.com>
Date: Thu, 09 Oct 2014 08:25:34 -0600
From: Eric Blake <eblake AT redhat DOT com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.1
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: Cannot exec() program outside of /bin if PATH is unset
References: <54135451 DOT 3060902 AT t-online DOT de> <601154762 DOT 20140913012935 AT yandex DOT ru> <541378C4 DOT 6030705 AT t-online DOT de> <54137BDE DOT 6040907 AT redhat DOT com> <54137C7F DOT 1040507 AT redhat DOT com> <541415B1 DOT 8090500 AT t-online DOT de> <541698CC DOT 7090802 AT lysator DOT liu DOT se> <5416F946 DOT 7010905 AT t-online DOT de> <20141008134106 DOT GF29235 AT calimero DOT vinschen DOT de> <5435714D DOT 6060206 AT t-online DOT de> <20141009100317 DOT GI29235 AT calimero DOT vinschen DOT de>
In-Reply-To: <20141009100317.GI29235@calimero.vinschen.de>
OpenPGP: url=http://people.redhat.com/eblake/eblake.gpg
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB"
X-IsSubscribed: yes

--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 10/09/2014 04:03 AM, Corinna Vinschen wrote:

> Ok.  Or... hmm.  The fact that using SetDllDirectory disallows searching
> the CWD got me thinking twice.  Security-wise it would really be the
> right thing to do.  Usually DLLs are in defined search paths:
>=20
> - Application dir
> - Application defined dirs
> - System dirs
>=20
> So, what scenario would actually break by removing CWD from the search
> path?  Running tests in an libtoolized project dir, perhaps?  Is that a
> valid concern or did libtool already take care of this?

Running a libtool project is probably unimpacted - libtool builds
in-tree dlls into a subdirectory, which is not usually the CWD.

--=20
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Public key at http://people.redhat.com/eblake/eblake.gpg

iQEcBAEBCAAGBQJUNpreAAoJEKeha0olJ0NqwOkIAKjRkP9yeYB5/fbCPpI/Zc9Z
Dfuj8qrW+tlftZ52RaP7sZJAal0sUCQ4SRuwM2+qqR2rRvcqbXg3ggFOdCI1iOT3
uLKF6/9GQHe4xatDoR3zPLWKjwL/adVCDwFgs+IuX7j76PpZuUGo8Fbx75/2YiKK
82/30DQdlsCKrpP/fzlqlOE/izhel5f7+bGRMaVM1BG7h/T/0BHUs1hyQAo79x7e
i0qfzoNPqO7mFoioGPvsWpicnVKi/kaJ9Tihcz1taj7XerH3Vuh/ouRTYWKK4paX
thpXdrOFsI9GqsVPgErWWunLw4Mu1K2BDQCHEHzEnye7KUnbeq4pFuzPbe1GHeM=
=qlPx
-----END PGP SIGNATURE-----

--645okRuiB5jvRfv8nqKpnjtGnHKbxbnTB--