3 ms·
Not really. Realistically you can set PATH to an empty string, and block execution everything that isn't invoked using a hardcoded path.
by sp1rit 3y ago
Not really. Realistically you can set PATH to an empty string, and block execution everything that isn't invoked using a hardcoded path.
- jameshart 3y agoYeah, I thought about that, but this would kill even directly invoked executables, right?
- sp1rit 3y agoYes, this is certainly more "far-reaching" than other env vars. But If you have the ability to wreak havoc even if ld-linux wouldn't check for this (obv. PATH being the prime example, but unsetting HOME will almost certainly break some software written by novices (not falling back to the home specified in /etc/passwd)). And I also could imagine that tools that allow setting arbitrary env vars might filter common troublemakers like PATH, but almost certainly not niche env vars that change the bahviour of ld-linux.