Package: bash Version: 4.3-11+b1 Followup-For: Bug #496740 Dear Maintainer,
I have similar bug. /bin/bash <firefox> fails. (cannot execute binary file of type ELF64) as a result firejail of <firefox> fails. launching firejail qupzilla succeeds, so its not a firejail issue. ../<firefox> succeeds seems to be indicative of a noexec bug where bash wants to copy the file into temp space and run it. This is a NO-NO. ESPECIALLY on web browsers and anything accessing the net.Files need to be ran where they are. This presents a vulnerability were temp spaces set exec.Malicious code can then run. We dont want this. Since we cant turn debian into cubes, surely we should have as much protection as possible. if I invoke /bin/bash directly, it stalls and does nothing until I kill it. IIRC, it should spawn a new shell(X console). -- System Information: Debian Release: 8.3 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.4.0-0.bpo.1-amd64 (SMP w/8 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages bash depends on: ii base-files 8+deb8u3 ii dash 0.5.7-4+b1 ii debianutils 4.4+b1 ii libc6 2.19-18+deb8u3 ii libncurses5 5.9+20140913-1+b1 ii libtinfo5 5.9+20140913-1+b1 Versions of packages bash recommends: ii bash-completion 1:2.1-4 Versions of packages bash suggests: pn bash-doc <none> -- no debconf information
