[Bug 900496] Re: dovecot-core installation fails because "start" is used from PATH

[Clint Byrum]

Thanks for the bug report! We really appreciate you taking the time to
file it and help us make Ubuntu better.

Definitely not a security problem. dpkg intentionally runs as root, so
if you let somebody mess with root's PATH, that is a conscious decision.

Also using things out of the path is necessary and flexible. If we
directed it to use /sbin/start users couldn't override that.

I'd suggest making sure you understand what the ramifications are when
overriding any piece of the global PATH namespace, and also consider
clearing out the environment when running things as root. PATH should be
sanitized by sudo.. so if you're running dpkg/apt with some other tool,
consider just using sudo.

Closing as Invalid. If you have further information that clarifies why
this may still be a bug, please feel free to re-open this bug by setting
it back to New, or opening a new bug.



** Changed in: dovecot (Ubuntu)
       Status: New => Invalid

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to dovecot in Ubuntu.
https://bugs.launchpad.net/bugs/900496

Title:
  dovecot-core installation fails because "start" is used from PATH

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dovecot/+bug/900496/+subscriptions