[Bug 1070171] Review Request: tlssled - An evaluation tool for SSL/TLS (HTTPS) web server implementations

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.redhat.com/show_bug.cgi?id=1070171



--- Comment #3 from Michael Schwendt <bugs.michael@xxxxxxx> ---
There are mixed feelings about /usr/bin/env.

/usr/bin/env as the dependency is less correct than a strict dependency on
/usr/bin/bash (being the bash provided by Fedora). And if someone puts "bash"
in a customised $PATH before /usr/bin, this may break the program and/or even
make it insecure in case it's a vulnerable old bash.

This also affects other script interpreters, see e.g.
http://fedoraproject.org/wiki/Features/SystemPythonExecutablesUseSystemPython

An old attempt at prohibiting /usr/bin/env in shebang:
https://fedoraproject.org/wiki/Script_Interpreters_%28draft%29

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
_______________________________________________
package-review mailing list
package-review@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/package-review





[Index of Archives]     [Fedora Legacy]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]     [Fedora Tools]