Vlákno názorů k článku Postřehy z bezpečnosti: hamburger za všechny vaše peníze od jirib - Tak p7zip v OpenBSD by asi "spadnul", pac...

Tak p7zip v OpenBSD by asi "spadnul", pac pledge sandboxing zakazuje programu delat exec().

cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_Bundles_SFXCon_SfxCon_cpp:+  if (pledge("stdio rpath wpath cpath fattr tty", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_Bundles_SFXCon_SfxCon_cpp:+  if (pledge("stdio rpath wpath cpath fattr tty", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+  if (pledge("stdio rpath wpath cpath fattr tty ps", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+  if (pledge("stdio rpath wpath cpath fattr tty ps", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+  if (pledge("stdio", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+  if (pledge("stdio ps", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+          if (pledge("stdio rpath tty", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+  if (pledge("stdio rpath tty", NULL) == -1) {
cvs/openbsd-ports/archivers/p7zip/patches/patch-CPP_7zip_UI_Console_Main_cpp:+  if (pledge("stdio rpath", NULL) == -1) {

Nojo, jenomže má povoleno zapisovat do souborů. Takže může ten rootkit zapsat třeba do ~/.bashrc nechat ho spustit při dalším přihlášení uživatele.