2010-03-21 20:50:51 +00:00
In order to cope with having to use Windows at work I run Cygwin. My shell of choice is zsh. For whatever reason the Cygwin package of zsh installs with a series of directories that the zsh completion system deems to be insecure and it makes sure you know this. Each time a new shell is opened (in my case through a Windows native rxvt terminal) I would receive the following warning:
2010-03-11 20:30:27 +00:00
2010-03-21 20:50:51 +00:00
Ignore insecure directories and continue [ny]?
2010-03-11 20:30:27 +00:00
Pressing 'y' becomes a bit tedious after a while so I decided to track down these insecure directories and fix them.
2010-03-21 20:50:51 +00:00
2010-03-11 20:30:27 +00:00
<!-- more -->
< tt > man zshcompsys< / tt > reveals the following about the security check:
2010-03-21 20:50:51 +00:00
> For security reasons compinit also checks if the completion system
> would use files not owned by root or by the current user, or files in
> directories that are world- or group-writable or that are not owned by
> root or by the current user. If such files or directories are found,
> compinit will ask if the completion system should really be used. To
> avoid these tests and make all files found be used without asking, use
> the option -u, and to make compinit silently ignore all insecure files
> and directories use the option -i. This security check is skipped
> entirely when the -C option is given.
>
> The security check can be retried at any time by running the function
> compaudit.
2010-03-11 20:30:27 +00:00
Running compaudit revealed the following:
2010-03-21 20:50:51 +00:00
% compaudit
There are insecure directories:
/usr/share/zsh/site-functions
/usr/share/zsh/4.3.4/functions
/usr/share/zsh
/usr/share/zsh/4.3.4
2010-03-11 20:30:27 +00:00
Examining the permissions on these directories showed they were all group writable.
2010-03-21 20:50:51 +00:00
% ls -ld /usr/share/zsh/site-functions
drwxrwx---+ 2 wmoore mkgroup-l-d 0 Sep 4 10:54 /usr/share/zsh/site-functions
2010-03-11 20:30:27 +00:00
Stripping them of the group write permission fixed the problem and made starting a new shell a little more pleasant.
2010-03-21 20:50:51 +00:00
% chmod g-w /usr/share/zsh/site-functions /usr/share/zsh/4.3.4/functions /usr/share/zsh /usr/share/zsh/4.3.4
% compaudit
%
**Update:** _kylexlau_ provides this one line solution for correcting to permissions on each of the directories that compaudit returns:
2010-03-11 20:30:27 +00:00
2010-03-21 20:50:51 +00:00
compaudit | xargs chmod g-w
