summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2010-05-18 00:25:24 +0000
committerKarl Berry <karl@freefriends.org>2010-05-18 00:25:24 +0000
commit0de5925b154dd85f9d701210476ebcf1c58baa41 (patch)
treeb2249d23f96893dc731236631f597f54003479bc
parent9c5b9d531f78961181749c72b8ca7a295b97196e (diff)
enable restricted shell escapes (again)
git-svn-id: svn://tug.org/texlive/trunk@18321 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/kpathsea/ChangeLog5
-rw-r--r--Build/source/texk/kpathsea/texmf.cnf22
2 files changed, 14 insertions, 13 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index 7e09056af5f..d7fcb074502 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,5 +1,10 @@
2010-05-18 Karl Berry <karl@tug.org>
+ * texmf.cnf (shell_escape): set to p. Trying restricted shells again.
+ (shell_escape_commands): bibtex, bibtex8,
+ kpsewhich, makeindex, repstopdf. Don't plan to add anything
+ else for TL'10.
+
* NEWS,
* kpsewhich.c (read_command_line),
* texmf.cnf (TEXMFCONFIG, TEXMFVAR): 2010.
diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf
index cba3213dfc3..61ee6340b73 100644
--- a/Build/source/texk/kpathsea/texmf.cnf
+++ b/Build/source/texk/kpathsea/texmf.cnf
@@ -496,7 +496,7 @@ try_std_extension_first = t
% commands listed in shell_escape_commands are allowed. Although this
% is not fully secure either, it is much better, and so useful that we
% enable it for everything but bare tex.
-shell_escape = f
+shell_escape = p
% No spaces in this command list. These programs either do not write
% any output files, respect openout_any, or have hard-coded restrictions similar
@@ -506,28 +506,24 @@ shell_escape = f
% Unfortunately we found too many problems with shell_escape=p, so it
% should be treated as though it were just as dangerous as shell_escape=t.
shell_escape_commands = \
-false
-
-% These programs are our first goal when we can enable it.
-%kpsewhich,fc-match,\
-%repstopdf,\
+bibtex,bibtex8,\
+kpsewhich,\
+makeindex,\
+repstopdf,\
% we'd like to allow:
% dvips - but external commands can be executed, need at least -R1.
% epspdf, ps2pdf, pstopdf - need to respect openout_any,
-% and we need to make sure -dSAFER is used and no injection is possible.
+% and gs -dSAFER must be used and check for shell injection with filenames.
% (img)convert (ImageMagick) - delegates.mgk possible misconfig, besides,
% without Unix convert it hardly seems worth it, and Windows convert
-% is something completely different that destroys filesystems, so
-% skip it.
+% is something completely different that destroys filesystems, so skip.
% pygmentize - but is the filter feature insecure?
% ps4pdf - but it calls an unrestricted latex.
+% rpdfcrop - maybe ok, but let's get experience with repstopdf first.
% texindy,xindy - but is the module feature insecure?
% ulqda - but requires optional SHA1.pm, so why bother.
-% tex, latex, etc. - but need to forbid --shell-escape, and inherit openout_any
-%
-% repstopdf, rpdfcrop - maybe ok
-% bibtex,bibtex8,makeindex - maybe ok
+% tex, latex, etc. - need to forbid --shell-escape, and inherit openout_any.
% plain TeX should remain unenhanced.
shell_escape.tex = f