[packagekit] PATH missing in backends

[David Zeuthen]

On Mon, 2008-01-07 at 18:12 +0000, Richard Hughes wrote:
> On Mon, 2008-01-07 at 14:03 +0000, Thomas Wood wrote:
> > > IIRC, all the env vars are unset by pk_spawn for security's sake.
> > I guess that sort of makes sense, but unfortunately I have just
> > discovered the reason Ipkg needs PATH is because it spawns wget to
> > download packages...
> 
> Well, in src/pk-main.c we do clearenv - we don't need to - but it
> prevents packagekitd being run differently when being run system
> activated and when being run manually.
> 
> In src/pk-spawn.c we do a g_spawn_async_with_pipes with no environment,
> which Ken is correct is for security. This is the sort of security from
> the "I don't know what is unsafe, so pass nothing" school, and can
> certainly be improved by someone who knows better than me.

Typically in security sensitive apps, you don't so much care about an
empty environment; you care more about one that is well-known. So
typically, after clearenv(), you set PATH to something reasonable, e.g. 

    setenv ("PATH", "/usr/sbin:/usr/bin:/sbin:/bin", 1);

     David