Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I bet > 66% of these are something to do with databases. :-)

My story (though I wasn't directly responsible): we were delivering our software to an obscure government agency. Based on our recommendation, they had ordered a couple of SGI boxes. I wrote the installation script, which copied stuff off the CD, etc. Being a tcsh afficianado, I decided to write it in tcsh with the shebang line

   #!/usr/local/bin/tcsh
Anyways: we send them the CD. Some dude on the other side logs in as root, mounts the CD, and tries to run "installme.csh". "command not found" comes the response. So he peeks at the script, and sees that it's a shell script. He knows enough of unix that "shell == bash". So he runs "bash installme.csh" . A few minutes go by, and lots of errors. So he reboots; now the system won't come up. The genius that he is, he decides to try the CD on the second SGI box. Same results.

In the script, the first few lines were something like:

    set HOME = "/some/location"
    /bin/rm -rf $HOME/*
Hint: IRIX didn't ship with /usr/local/bin/tcsh. And guess what's the value of "HOME" in bash?


'And guess what's the value of "HOME" in bash?'

In the rm line of the snippet above, "/some/location". Magic variables in bash tend to lose their magic once set.


I assume `set HOME = /some/location` is the tcsh syntax to set a variable.

In Bash, it doesn't do anything useful.


  > In Bash, it doesn't do anything useful.
In sh and derived shells, it sets the arguments ($1, $2, and so on). In this case you end up with $1 being ‘HOME’, $2 being ‘=’, and $3 being ‘/some/location’.


Ah, right, duh.


nope. try it: set HOME; echo $HOME.

on IRIX, $HOME for root is almost certainly root. So the resulting command is rm -rf /


I missed that set HOME doesn't set HOME (I was pre-coffee).

What I said about un-magic-ing is true for sure. "HOME=foo; echo $HOME" will print "foo".

Interestingly, it's propagated. "HOME=foo sh -c 'echo $HOME'" will also print "foo".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: