Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've seen people mention in other answers that it's a bad idea to include the current working directory ('.') in your $PATH environment variable, but haven't been able to find a question specifically addressing the issue.

So, why shouldn't I add . to my path? And if despite all warnings I do it anyway, what do I have to watch out for? Is it safer to add it to the end than to the the start?

share|improve this question
add comment

2 Answers

up vote 9 down vote accepted

If you're the only user on the machine it's OK, as long as you know what's you're doing. The general concern is that by having your current directory in PATH, you cannot see commands as a constant list. If you need to run script/program from your current directory, you can always explicitly run it by prepending ./ to its name (you saying the system "I want to run this file from my current directory").

Say, now you have all this little scripts all over your filesystem; one day you'll run the wrong one for sure. So, having your PATH as a predefined list of static paths is all about order and saving oneself from a potential problem.

However, if you're going to add . to your PATH, I suggest you to append it to the end of list (export PATH=$PATH:.). At least you won't override system-wide binaries this way.

If you're a root on the system and have system exposed to other users' accounts, having . in PATH is a huge security risk: you can cd to some user's directory, and non-intentionally run malicious script there only because you mistyped a thing or script has the same name as a system-wide binary.

share|improve this answer
    
+Accept for the underlying theory and for mentioning that the problems can still exist even when you're the only user on the system. Both answers bring up excellent points. I'll add that any time you share directories with another user, there is increased risk, whether you're root or not. –  Jander Feb 25 '13 at 14:48
add comment

The risk is someone put a malicious executable in the directory that happen to be your current one.

The worst case happen when:

  • you are logged as root as the malicious command has unlimited damage power
  • . is at the beginning of your PATH as standard commands can be overridden without you noticing it (typically an ls which could hide itself from the list).

The risk is much lower if you are logged as a regular user and have the . at the end of your PATH but it still exists:

  • someone might find out you frequently mistype a command and install a matching one
  • someone might install a fake command with the name of one that is not installed.

Note that in any case, the risk is still there even if you are the only user of the machine. Malicious software would be installed if, for example, you happen to extract an archive downloaded from a compromised site.

share|improve this answer
5  
Install sl to see how often point 3 happens. –  jordanm Feb 22 '13 at 6:19
    
or alias l=`ls`. –  Anko Mar 31 at 11:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.