Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Aug 2013 15:59:08 +1000
From: Michael Samuel <>
Subject: Re: [PATCH] implement privmode support in dash

On 23 August 2013 15:42, Seth Arnold <> wrote:

> Regardless of the answer, it is probably worth using bash's mitigation
> in dash, but I'm curious if we'll make discovering future bugs in setuid
> programs more difficult to spot by happenstance by doing so.

I know of one instance where this has fooled a developer into thinking that
'nice' drops privileges (because they were executing a shell script through

One could argue that the developer is at fault and that programs that use
suid bits require extra-special care - but it's often not the developer
that needs protecting.

Could an alert (via stderr or syslog) be presented when the mitigation is
activated implicitly?

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.