Insecure $PATH in runit-2.1.2-runsvdir-path-cleanup.patch

[davidsainty]

The patch sets the $PATH to:

PATH=:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin

This means that the current working directory is the first directory looked in for any command executed by a service started by runit. That's a very counter-intuitive default, and is unlikely to be expected or secured against by all services running via runit.

Unfortunately this has made its way into package repositories like RedHat.