Re: [PATCH] implement privmode support in dash

[Michael Samuel <mik () miknet net>]

On 23 August 2013 15:42, Seth Arnold <seth.arnold () canonical com> wrote:

> Regardless of the answer, it is probably worth using bash's mitigation
> in dash, but I'm curious if we'll make discovering future bugs in setuid
> programs more difficult to spot by happenstance by doing so.

I know of one instance where this has fooled a developer into thinking that
'nice' drops privileges (because they were executing a shell script through
nice).

One could argue that the developer is at fault and that programs that use
suid bits require extra-special care - but it's often not the developer
that needs protecting.

Could an alert (via stderr or syslog) be presented when the mitigation is
activated implicitly?