The '.' at the head of the default sys.path

Kenneth Manheimer (klm@nist.gov)
Tue, 14 Jun 1994 20:44:53 GMT

This is a proposal for a peripheral policy change...

I think there's a serious problem with having a '.' at the head of the
default sys.path, and that it would be better to leave it to the user
to add it, via $PYTHONPATH, instead of including it by default.

There are two reasons:

- the current sys.path logistics are only conducive, at the user
level, to adding elements, not to inhibiting default ones.

- there are some situations where it is truly risky (due to prospects
of trojan horses) to have it on the path. what if i run a python
script as root? (1)

While many people might want '.' on their load path, some users will
*need* to not have it there, and may not even realize it is 'til too
late. Though somewhat less convenient for many, i think it needs to
be the prerogative of the user to elect for it, via $PYTHONPATH,
instead being a (difficult to override) default behavior.

Perhaps there's another option. I'm game, i just think some
refinement of this needs to be made.

In case this does make sense, here's the patch that i believe would
implement the policy change. There may be document changes or build
or operational things that depend on the '.', but i haven't noticed
any problems running this way.

Ken
ken.manheimer@nist.gov, 301 975-3539

(1 the old crack-the-super-secure-system-challenge-story has a
competitor asking the monitors about a missing file in the
competitors home directory, or something. The competitor neglects
to mentioning that they have a special script named 'ls' in their
home dir. the monitors inadvertantly use the doctored 'ls' when
they look to examine the supposed problem, and the script sets up a
back door for the competitor. taa dah.

while the scenario would have to be different with python, there is
a real risk here.)

*** 1.1 1994/06/14 20:26:24
--- Modules/Setup.in 1994/06/14 20:27:29
***************
*** 56,62 ****
# Enable this if stdwin installed
#STDWINPATH=:$(DESTLIB)/stdwin

! PYTHONPATH=.:$(DESTLIB)$(TESTPATH)$(ARCHPATH)$(STDWINPATH)


# Modules that should always be present (non UNIX dependent)
--- 56,62 ----
# Enable this if stdwin installed
#STDWINPATH=:$(DESTLIB)/stdwin

! PYTHONPATH=$(DESTLIB)$(TESTPATH)$(ARCHPATH)$(STDWINPATH)


# Modules that should always be present (non UNIX dependent)