Search code examples
linuxperl

Insecure $ENV{PATH} while running with - T switch


I'm trying to check services in linux with the command status. However I get this error:

Insecure $ENV{PATH} while running with - T switch at checkservices line 3.

In the line I have this:

my @services = `status\;

Whats the problem here?

#!/usr/bin/perl
use strict;
my @services = `status`;
foreach my $service(@services){
    if (! (service =~ /{running|UP} /)) {
        print "up";
    }  
}

Solution

  • From perlsec:

    For "Insecure $ENV{PATH} " messages, you need to set $ENV{'PATH'} to a known value, and each directory in the path must be absolute and non-writable by others than its owner and group. You may be surprised to get this message even if the pathname to your executable is fully qualified. This is not generated because you didn't supply a full path to the program; instead, it's generated because you never set your PATH environment variable, or you didn't set it to something that was safe. Because Perl can't guarantee that the executable in question isn't itself going to turn around and execute some other program that is dependent on your PATH, it makes sure you set the PATH.

    Perl does not call the shell to expand wild cards when you pass system and exec explicit parameter lists instead of strings with possible shell wildcards in them. Unfortunately, the open, glob, and backtick functions provide no such alternate calling convention, so more subterfuge will be required.