3 ms·
OK - so assuming that there isn't going to be a single patch which fixes all possible / related bugs any time soon. Options? - Change /bin/sh to something els
by deckiedan 12y ago
OK - so assuming that there isn't going to be a single patch which fixes all possible / related bugs any time soon.
Options?
- Change /bin/sh to something else. (CentOS has BASH as default, alas...)
- Filter out unknown, or suspicious looking HTTP vars / env vars at varnish/apache/nginx level, somehow... (doesn't stop other services)
- Figure out some clever SELinux configuration that blocks it.
I wonder how much would fail on switching out BASH as default sh?
- rmc 12y agoI wonder how much would fail on switching out BASH as default sh? Ubuntu did that years ago, to speed up booting.
- justincormack 12y agoYes, and in doing so they (well, Debian) upstreamed a lot of fixes for bashisms, so most system stuff is ok. Apparently a lot of node.js stuff uses #!/bin/bash explicitly in scripts, so removing bash entirely might be difficult if you use node, or otehr stuff.
- papaf 12y agoI just followed the following instructions on Arch for replacing bash with dash: https://wiki.archlinux.org/index.php/Dash https://wiki.archlinux.org/index.php/Dash The technique is applicable to other distributions as well. Note: on my Arch install the checks showed there were no scripts relying on /bin/sh being bash. Edit: direct link to checkbashisms.pl - http://anonscm.debian.org/cgit/collab-maint/devscripts.git/plain/scripts/checkbashisms.pl http://anonscm.debian.org/cgit/collab-maint/devscripts.git/p...
- deleted 12y ago[deleted]
- delfinom 12y agoYou want to actually remove bash god forbid something calls /bin/bash directly instead of using the /bin/sh link.
- wiredfool 12y agoUbuntu 10.04LTS has dash as the default shell, as does Debian Squeeze (oldstable).
- ClashTheBunny 12y agoThe default /bin/sh, but NOT the default login shell. Those are two very different things.
- deleted 12y ago[deleted]