During an audit you find a shell startup file containing export PATH="$PATH:". A user in /tmp types report and an executable file named report in /tmp runs, even though no directory named in PATH holds such a file. Why?
LPIC-1 Exam 102-500, objective 105. Shells and shell scripting hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct The trailing colon leaves an empty entry in PATH, and an empty entry means the current directory
Correct. A zero-length directory name in PATH stands for the current working directory, and it can appear as a leading colon, a trailing colon or two adjacent colons.
Not correct Bash always searches the current directory last if no match is found elsewhere
Wrong. Bash never falls back to the current directory. Without a matching entry in PATH the shell reports command not found, which is why ./script is normally required.
Not correct The trailing colon is ignored, and the file ran because /tmp is on the default path
Wrong on both counts. The empty field is significant, not ignored, and /tmp has never been part of a default search path.
Not correct Executable files in a world-writable directory such as /tmp are always searched
Wrong. The mode of the directory has no bearing on command lookup. Being world-writable is precisely what makes this behaviour dangerous, but it is not what triggers it.
Why
An empty field in PATH is a legacy notation for the current directory, so a leading colon, a trailing colon or a doubled colon quietly puts the working directory into the search path. Combined with a shared or world-writable directory this is a classic privilege-escalation route: an attacker drops a file named after a common command and waits for someone to run it there. Remove the empty field, and if the current directory really must be searched, write it explicitly and put it last.
Where this comes from
- Cited
- manual page bash(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 105 and space the ones you get wrong.
More questions on this objective
- A user logs in at a text console, and bash starts as an interactive login shell. Which file in that user's home directory is read by bash itself as part of login startup? machine-checked
- You are already logged in to a graphical desktop and open a new terminal window, so bash starts as an interactive shell that is not a login shell. Which per-user file does bash read in that case? machine-checked
- An executable script contains only the line `export EDITOR=vim`. After running it as `./setenv.sh`, `echo $EDITOR` in the calling shell prints nothing. What explains this? machine-checked
- In bash, what is the effect of `export MYVAR`? machine-checked
- At a bash prompt you run `alias ll='ls -l'` and it works for the rest of that session, but a terminal window opened afterwards does not recognise `ll`. Which statement explains this and gives the standard remedy? machine-checked
- A command finishes and the shell reports an exit status of 0. What does that mean, and which parameter reports it? machine-checked