Dollar expansion (Was: Registry editor)
Martijn Klingens
klingens at kde.org
Sun Apr 28 15:18:21 BST 2002
On Sunday 28 April 2002 13:56, Chris Howells wrote:
> I'm just wondering for e.g. KMail -- if it wanted to grab the real name out
> of /etc/passwd -- e.g. the "Chris Howells" in the following line:
>
> chris:x:1000:1000:Chris Howells,,,:/home/chris:/bin/bash
>
> Is there anyway to do that via KConfig? Or would you need to write some
> kind of scrip to extract the name, stick it into a shell variable, and then
> get the variable expanded as you described above?
Add a [$b] to allow expanding backticks as in
Name[$be]=`grep "^${USER}:" /etc/passwd | cut -d: -f5`
?
Thinking of this a bit more... I think there's a small security issue with
Waldo's new options.
Waldo, suppose a sysadmin put the following in a config file in the global
$KDEDIR:
Hostname[$ie]=$HOSTNAME
then what happens if the user runs 'HOSTNAME=some-other-host KMyApp' ? I guess
the variable should be queried from kdeinit to make it not reflect a possibly
customized environment. That is, if kdeinit cannot be restarted, which it
currently can...
I know you shouldn't allow a user shell access in a truly locked down setup,
but I think there are occasions where a full lockdown is not needed, but a
partial lockdown is. In which case the above is definitely a problem.
Same btw for the user overriding $KDEDIRS from the shell, hence possibly
bypassing the KConfig immutable flags. Or am I chasing ghosts here?
Martijn
More information about the kde-core-devel
mailing list