5 ms·
It wouldn't just be shell scripts that need replacement - the command line is generally also a shell with the same problems, so that needs replacement too The
by unilynx 8y ago
It wouldn't just be shell scripts that need replacement - the command line is generally also a shell with the same problems, so that needs replacement too
The chances of getting the kernel to outright ban some of the more dangerous filenames seem a lot higher than simply eliminating sh/bash...
- dwheeler 8y agoI think the best would be to create an LSM module. I created one a while back but have not had time to complete it. I called it safename: https://github.com/david-a-wheeler/linux/blob/squelch-1/security/safename/safename_lsm.c https://github.com/david-a-wheeler/linux/blob/squelch-1/secu...
- geofft 8y agoUnfortunately this wouldn't catch names from network filesystems, removable media, etc., which comes up fairly frequently. (Or, more generally, from existing disks.) Is there a place in the Linux kernel you can intervene on existing filesystems to escape bad names from existing filesystems and refuse the creation of new, unescaped bad names? Could this be something unionfs-ish?