Re: .exrc file security risks

From: Darren J Moffat (Darren.Moffat_at_Sun.COM)
Date: 05/01/03

  • Next message: Benjamin A. Okopnik: "Re: .exrc file security risks" 
    Date: Thu, 1 May 2003 10:46:59 -0700 (PDT)
To: "Benjamin A. Okopnik" <ben@callahans.org>

    On Tue, 29 Apr 2003, Benjamin A. Okopnik wrote:

    > tar xvzf evil.tgz
    > fun_game/foo
    > fun_game/bar # This is a fun game - really!
    > fun_game/gzot
    > html/.exrc # WHOOPS...
    >
    > Now, whenever Joe runs "vi" in the "html" subdirectory, he will be
    > sourcing all the macros, etc. specified in "html/.exrc". I won't show
    > any specific examples, but macros in "vi" can execute shell commands -
    > and any keystroke can be tied to a macro.
    >
    > The autoloading of the per-directory .exrc files (and shell escape/write
    > commands in them) can be disabled by invoking the "secure" command in
    > "/etc/exrc". However, it can be cancelled with a "nosecure" line in a
    > user's "~/.exrc" or even per-invocation:

    There is no such option in in /usr/bin/vi on Solaris, and no support for
    such a file.

    The way to "lock this down" for the root user is to create a ~root/.exrc
    file with the line "set noexrc" in it. Also remember to do /bin/su -
    rather than just /bin/su (so that $EXINIT isn't passed alone). 

    -- 
Darren J Moffat
  • Next message: Benjamin A. Okopnik: "Re: .exrc file security risks"

    Relevant Pages

    • Re: "OVR" indicator in status bar
      ... I misspoke, I did not create a macro, I just assigned keystrokes (I guess I ... different keystroke commands to toggle between overtype and insert mode. ... But, if at all possible, you're going to fare better by assigning the ...
      (microsoft.public.word.customization.menustoolbars)
    • Re: Word Macro Problem
      ... Private Sub GetNames ... Create a method for calling this macro, ... similarly if i press +L...it would retrieve data whose names ... when i create one macro with keystroke other keystroke doesn't work. ...
      (microsoft.public.word.vba.beginners)
    • Re: "OVR" indicator in status bar
      ... I'm still puzzled as to why you're using a macro. ... But, if OverType works when assigned to the Insert key, it should be working when assigned to any other key combination, as well. ... Sometimes, you really have to jump through hoops to get things to work correctly, including running such macros indirectly, by creating a middle-man macro to run the macro, and then assigning *that* macro the desired keystroke. ... Prior to installing Office 2003, the little "OVR" indicator would toggle between black or grayed-out depending on the state of the command, and would do so immediately upon toggling. ...
      (microsoft.public.word.customization.menustoolbars)
    • Re: Is there a default (a keystroke, a button) to paste "Date and Time"?
      ... Is there a default (a keystroke, a button) for the "Date & Time ... then invent a keyboard shortcut for that. ... correct format string and turn it into plain text in one fell swoop. ... (small break for playing about with the macro recorder thingy) ...
      (microsoft.public.mac.office.word)
    • Re: Shortcut to toggle line spacing (leading?)
      ... I agree there's a need for more clearly written Help ... you get the basic code for this by recording a macro. ... >> SpaceBeforeToggle, then perform the action you want, such as making ... Now you just need to assign a keystroke. ...
      (microsoft.public.word.newusers)