CVSROOT: /cvs
Module name: src
Changes by: dera...@cvs.openbsd.org 2015/10/14 14:57:28
Modified files:
bin/pax : ar_io.c
Log message:
Use a strict $PATH of "/usr/bin:/usr/local/bin" to run the (de)compressors
(gzip, compress, bzip2) rather than following the user's path. This
seems easier than hardcoding the paths elsewhere and using basename().
pax/tar is pledged itself, but it can spawn one of these programs if
asked. The three found at the strict path use pledge "stdio" very early
during startup, providing a warm fuzzy pledge->exec->no-pledge->pledge
interlock. For bzip2, this assumes use of the ports/packages version
installed to /usr/local/bin, which has been pledged by sthen@.
Doing a 'tar tvfz hostile.tgz' becomes a bit safer, since an attacker
finding a buffer overflow or use after free has significantly fewer
system calls available (only pledge "stdio" in the decompressor).
ok millert sthen
