system.3: Mention PATH explicitly in discussion of system and set-UID programs

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

diff --git a/man3/system.3 b/man3/system.3
index eba51ac90de7898e6154599bce0a11caf04b7ef1..eaa7f9c331d065e3c9866676ea9c65ae71b98950 100644 (file)
--- a/man3/system.3
+++ b/man3/system.3
@@ -207,12 +207,19 @@ Do not use
 from a program with set-user-ID or set-group-ID privileges,
 because strange values for some environment variables
 might be used to subvert system integrity.
+For example,
+.BR PATH
+could be manipulated so that an arbitrary program
+is executed with privilege.
 Use the
 .BR exec (3)
 family of functions instead, but not
 .BR execlp (3)
 or
-.BR execvp (3).
+.BR execvp (3)
+(which also use the
+.B PATH
+environment variable to search for an executable).
 .BR system ()
 will not, in fact, work properly from programs with set-user-ID or
 set-group-ID privileges on systems on which