Dollar expansion (Was: Registry editor)

Martijn Klingens klingens at kde.org
Sun Apr 28 15:18:21 BST 2002


On Sunday 28 April 2002 13:56, Chris Howells wrote:
> I'm just wondering for e.g. KMail -- if it wanted to grab the real name out
> of /etc/passwd -- e.g. the "Chris Howells" in the following line:
>
> chris:x:1000:1000:Chris Howells,,,:/home/chris:/bin/bash
>
> Is there anyway to do that via KConfig? Or would you need to write some
> kind of scrip to extract the name, stick it into a shell variable, and then
> get the variable expanded as you described above?

Add a [$b] to allow expanding backticks as in

Name[$be]=`grep "^${USER}:" /etc/passwd | cut -d: -f5`

?

Thinking of this a bit more... I think there's a small security issue with 
Waldo's new options.

Waldo, suppose a sysadmin put the following in a config file in the global 
$KDEDIR:

Hostname[$ie]=$HOSTNAME

then what happens if the user runs 'HOSTNAME=some-other-host KMyApp' ? I guess 
the variable should be queried from kdeinit to make it not reflect a possibly 
customized environment. That is, if kdeinit cannot be restarted, which it 
currently can...

I know you shouldn't allow a user shell access in a truly locked down setup, 
but I think there are occasions where a full lockdown is not needed, but a 
partial lockdown is. In which case the above is definitely a problem.

Same btw for the user overriding $KDEDIRS from the shell, hence possibly 
bypassing the KConfig immutable flags. Or am I chasing ghosts here?

Martijn





More information about the kde-core-devel mailing list