3 ms·
It's not general knowledge among people who only sometimes drop down to root (such as me). Although it is mentioned in an early paragraph of the man page, it's
by gpvos 3y ago
It's not general knowledge among people who only sometimes drop down to root (such as me). Although it is mentioned in an early paragraph of the man page, it's easy to miss. It could use an attention-drawing "IMPORTANT SECURITY NOTICE" there.
- mananaysiempre 3y agoCan’t resist mentioned the funny, but perhaps less than adequately prominent note to “beware of gift horses” on the Plan 9 manual page for bundle(1) [pack files into a self-extracting shell script, more or less equivalent to shar(1) on a normal Unix]. https://9p.io/magic/man2html/1/bundle https://9p.io/magic/man2html/1/bundle
- IshKebab 3y agoThat's the wrong way to solve this. You have to assume people don't read the manual, especially for security issues. The correct solution is that `ldd` should be safe by default, and require a `--allow-unsafe-execution` flag if it needs to actually execute code. I think this is pretty well known these days but probably not well known enough!
- gpvos 3y agoToo backwards incompatible maybe, although you could add a check on whether the output is a tty, like ls does; I don't know how often ldd is used in scripts.