Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > gnu.bash.bug > #12015

Re: SHELLOPTS=xtrace security hardening

Show key headers only | View raw

Quoting "Stephane Chazelas" <stephane.chazelas@gmail.com>:

I understand what you're saying.
As much as we would like, there's no way of stopping all attack  
vectors by only hardening bash, not only that, but also taking away  
its useful features.
Though I still believe PS4 shouldn't be imported from the environment.

> Should we also block SHELLOPTS=history
> HISTFILE=/some/file like /proc/$pid/fd/$fd and
> TZ=/proc/$pid/fd/$fd (like for your /bin/date command) as that
> allows DoS on other processes (like where those fds are for
> pipes).

Mind explaining this one?
I can't seem to write to HISTFILE in a non-interactive shell, or am i  
missing something?

Thanks.


----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Back to gnu.bash.bug | Previous | Next | Find similar

Thread

Re: SHELLOPTS=xtrace security hardening up201407890@alunos.dcc.fc.up.pt - 2015-12-15 00:30 +0100

csiph-web