On Wed, 2004-08-25 at 09:54, Jeff Johnson wrote: > That's the point. Lua is embedded, would be run by rpm, and no re-exec > because of internal state. Ok. And the lua "program" would still be extracted from the (possibly untrustworthy) package contents, as with current helpers like glibc_post_upgrade? So a package can carry arbitrary malicious lua code and get it executed by rpm? -- Stephen Smalley <sds@xxxxxxxxxxxxxx> National Security Agency
