On Fri, 06 May 2011 14:22:05 BST, Stuart Henderson wrote: > If you have something which handles ENV (i.e. an interactive shell), > isn't it already the case that you can run arbitrary commands?
I suppose it is not as bad as BASH_ENV (which is used for non-interactive shells). I'm still not comfortable adding this to env_keep, it has been on the environment variable blacklist since 1996. The shell itself ignores ENV when it is run setuid, which is similar to running the shell via sudo. - todd
