Re: Healing the bash fork

[Martin Carpenter <martin.carpenter () gmail com>]

On Tue, 2014-09-30 at 08:08 -0700, Tavis Ormandy wrote:
> > system("date");
>
> Keep going, eventually you're going to have to stop blacklisting
> variables and use execve ;-)

... and beware what you whitelist:

OpenSolaris/on-src/usr/src/cmd/date/date.c:
295     /* correct the kernel's "gmt_lag" and the PC's RTC */
296     (void) system("/usr/sbin/rtc -c > /dev/null 2>&1");

[wryly noticed some time in the last week]