I can't help you fix this problem without seeing your code, but the problem
is pretty straight forward and the warning message is not something that
should be taken lightly. This warning occurs when your PATH contains
something that is world writable and your Ruby code calls something like
system(cmd) or other method whose behavior is impacted by PATH.  If PATH
contains a world writable location and the command that you are trying to
execute can be found in that world writable location before its legitimate,
(hopefully) non-world-writable location, your ruby code will end up
executing potentially malicious code.

Take this very simple example. I have a directory ~/test that is world
writable (777):

$ ls -ld .
drwxrwxrwx 2 jhart jhart 4096 Jul 23 10:00 .

In it are two scripts, test1 and test2.  The former prints the output of
the date command whereas the later prints Time.now:

$ ls -l test*
-rwxr-xr-x 1 jhart jhart 36 Jul 23 09:54 test1
-rwxr-xr-x 1 jhart jhart 35 Jul 23 09:54 test2
$ cat test1
#!/usr/bin/env ruby

system('date')
$ cat test2
#!/usr/bin/env ruby

puts Time.now


With my normal, "secure" PATH, both work OK and don't warn:

$ ./test1
Wed Jul 23 10:04:29 PDT 2014
$ ./test2
2014-07-23 10:04:31 -0700

If I modify PATH to include this world writable, unsafe directory, I see
the warnings for test1 because it uses system but not for test2 because
PATH doesn't impact any of the Ruby code (but yes, it can effect what Ruby
executable is run, but ...):

$ PATH=$PATH:. ./test1
./test1:3: warning: Insecure world writable dir /home/jhart/test/. in PATH,
mode 040777
Wed Jul 23 10:06:39 PDT 2014
$ PATH=$PATH:. ./test2
2014-07-23 10:06:43 -0700

If I throw caution to the wind and put the current working directory
earlier in my PATH and this directory contains an executable matching what
I want to execute, it will execute this (potentially) untrusted/malicious
executable instead:

$ ls -l date
-rwxr-xr-x 1 jhart jhart 13 Jul 23 09:55 date
$ cat date
#!/bin/sh
id
2014/07/23 10:09:55 jhart@jhart-laptop ~/test
$ PATH=.:$PATH ./test1
./test1:3: warning: Insecure world writable dir /home/jhart/test/. in PATH,
mode 040777
uid=1000(jhart) gid=1000(jhart) groups=1000(jhart)
$ PATH=.:$PATH ./test2
2014-07-23 10:10:04 -0700

Notice how test1 now ended up running the "other" date command which simply
invokes 'id' for demonstration purposes.

Again, the fix largely depends on your code but likely involves some
combination of setting a secure PATH in the first place, correcting the
permissions on /local_vol1_nobackup (this sounds like a problem all by
itself) and perhaps reevaluating your use of system/etc.

-jon








On Wed, Jul 23, 2014 at 9:35 AM, Eric MSP Veith <eveith / wwweb-library.net>
wrote:

> On Tuesday 22 July 2014, 07:41:12, Luo, Sidney wrote:
> > Is anyone have idea about this issue? Thanks very much.
>
> Are you spawning a zsh instance with oh-my-zsh?
>
>                         --- Eric
>