Re: $ENV handling depends on defined(linux), why??

[Denys Vlasenko <vda.linux@xxxxxxxxxxxxxx>]

On Wed, Oct 13, 2021 at 11:56 AM Harald van Dijk <harald@xxxxxxxxxxx> wrote:
> On 13/10/2021 10:39, Denys Vlasenko wrote:
> >                      Who in their right mind would have a *setuid*
> > shell executable on any system where security matters?
>
> I suspect this was originally not for the benefit of setuid shell
> executables, but setuid shell scripts. Linux does not support those, so
> the check is considered unnecessary on Linux.
>
> However, actually, doing something along those lines is useful even on
> Linux when setuid applications can be tricked to launch shell processes
> in insecure ways.

Not sourcing $ENV is nowhere near enough to ploug this hole,
so doing it is still pointless.

> bash implements "privileged mode" which drops shell
> privileges except when the setuid application specifically requests
> keeping them

*That* would solve the problem. The code I talk about does not
solve that problem.

I propose to delete entire #ifndef/#endif block.