Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > gnu.bash.bug > #11427

Re: remaking bash, trying static, glibc refuses static...?

Show key headers only | View raw

Dave Rutherford wrote:
> There are loadable builtins but I don't believe it is true that they
> can magically self-load as you describe. 
---
Magically self load? Right...

Installed by the tooth fairy no doubt?

Anything that's setup to load has to be configured by
*someone*...whether it is 'you', or 'someone else' , 
whether or not it is with or without your knowledge,
and how 'transparent' it is to some generic 'end' user.

Example.  how many generic end users of bash would know that
some bash versions in some distro's like opensuse, have full
session auditing and logging added in to their build?

Now if they happen to store that in a special version of glibc,
and update glibc -- I magically get the new keyboard logging features
w/summaries sent to "whoever".  But, if I have a static build, that
I put together -- and I'm "reasonable" satisfied that it's not
communicating my behaviors out on the net, I can feel someone safe
that an update to one of the 100's of loadable libraries won't
compromise the security on that single program.

Of course there are lots of other ways -- kernel loadable device modules
that are closed source.  (The plugins I was talking about -- like
ones samba can use talk in *text*).


> Did the rest of your message have anything to do with bash?
> You were trying to build a static version... you've been told how...
> was there more?


----
Naw... builtin key-stroke loggers in ... well suse does get many
of their patches from Redhat, upstream....  absolutely nothing to do
with bash... you can go back to sleep now.

:-)

Back to gnu.bash.bug | Previous | Next | Find similar

Thread

Re: remaking bash, trying static, glibc refuses static...? Linda Walsh <bash@tlinx.org> - 2015-08-22 15:39 -0700

csiph-web