[RFC] User Accesable Filesystem Hierarchy Standard

[Doncho N. Gunchev]

On Monday 05 April 2004 17:17, Michael A. Peters wrote:
> ...
> I personally don't like the idea.
> If I want a bin directory in my home directory - export PATH=~/bin:$PATH
> 
> The problem I see is security. A virus can not alter binaries it does
> not have permission to alter, and that is why binaries, config files,
> default templates, etc. should be installed with root ownership by the
> root user.
    A virus/worm can damage only files owned by the user, so with
or without binaries owned by the user who has run the virus/worm
in her/his home, it can make the same damage. A virus/worm can make
~/.bin and also export PATH="~/.bin:$PATH" from your ~/.bashrc.
What's the diference? The only way to stop the user from running
untrusted applications is to mount /home and /tmp with noexec,
which breaks some applications (rpmbuild, mc) :(

> ...

-- 
Regards,
  Doncho N. Gunchev    Registered Linux User #291323 at counter.li.org
  GPG-Key-ID: 1024D/DA454F79
  Key fingerprint = 684F 688B C508 C609 0371  5E0F A089 CB15 DA45 4F79