path problem in plugin

[Marc Powell]

On Oct 13, 2009, at 8:44 AM, Leonardo Carneiro wrote:

> This is the return when executed from the command line:
>
>    $ echo `whoami` $PATH
>    nagios
>    /usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/ 
> jdk1.5.0_11/bin:/home/user/bin:/database/replicacao/bin:/home/nagios/ 
> bin
>
> And this is the return when the script is called by the nagios  
> process:
>
>    nagios /sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin
>
> Why the PATH variable is not the same in the command line and inside  
> the
> nagios process?

$PATH is inherited from a parent process or set by the shell (/bin/ 
bash for example). In the case of a daemon started by init, the daemon  
inherits the minimal $PATH provided by the init process. In the case  
of your login shell, you inherit the path provided by that shell,  
additionally modified by any settings in that shell's configuration  
files (/etc/profile or .bashrc, for example).

I do not believe that Nagios modifies the $PATH variable in any way  
but you can look through the source code if you like.

I expect you may be able to change the $PATH environment in the nagios  
init script before it's started. There are many examples of this in / 
etc/init.d/. You can also modify the path within your script.

The better, more secure solution is to not rely on $PATH in your  
script at all and to hard-code all paths to external programs and  
files. If you rely on $PATH, it can be trivial for $HACKER to create a  
file or program of the same name of the program you call that is  
evaluated earlier in the PATH and executed instead of your desired  
program.

--
Marc


------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
Nagios-users mailing list
Nagios-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nagios-users
::: Please include Nagios version, plugin version (-v) and OS when reporting any issue. 
::: Messages without supporting info will risk being sent to /dev/null