Re: Re: Healing the bash fork

["Todd C. Miller" <Todd.Miller () courtesan com>]

On Mon, 29 Sep 2014 09:59:47 -0600, Eric Blake wrote:

> 'at' is already broken, independently of bash.  For example:
>
> https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00300.html
>
> echo pwd | env "/tmp/exploit=me" at tomorrow
>
> produces a shell script with these lines:
>
> #!/bin/sh
> ...
> /tmp/exploit=me; export /tmp/exploit
>
> So even on Debian, where /bin/sh is dash, this script attempts to
> execute the file named /tmp/exploit=me, possibly under the privileges
> of 'at' rather than as the user that created the file.  No bash needed.

At the very least, at should use the "export foo=bar" form which
will allow it to fail closed in the presence of environment variables
that are not valid shell identifiers.  I've just committed such a
change to OpenBSD's at(1) which shares a common lineage.  However,
the atrun file format should really be changed to be more robust
and not simply be fed to /bin/sh.

 - todd