The UNIX and Linux SysAdm Handbook: Why are cached man pages a "security risk"?
28
votes
6
answers
5654
views
The *UNIX and Linux System Administration Handbook* says:
> man maintains a cache of formatted pages in /var/cache/man or
> /usr/share/man if the appropriate directories are writable; however,
> this is a security risk. Most systems preformat the man pages once at
> installation time (see catman) or not at all.
What is the "security risk(s)" here?
There is the obvious security risk that someone can alter the man pages to trick a (novice) user into running something undesirable, as pointed out by [Ulrich Schwartz in their answer](https://unix.stackexchange.com/a/652326/) , but I am looking for other ways this could be exploited. Thanks!
Asked by puwlah
(529 rep)
Jun 1, 2021, 11:16 AM
Last activity: Apr 2, 2025, 11:33 AM
Last activity: Apr 2, 2025, 11:33 AM