Mercurial > vim
changeset 27509:ef32ea9fbe6c v8.2.4282
patch 8.2.4282: restricted mode requires the -Z command line option
Commit: https://github.com/vim/vim/commit/adbb1bf21dad5697cd82d46d9dd9e8e8d0f647e6
Author: matveyt <matthewtarasov@gmail.com>
Date: Tue Feb 1 17:26:12 2022 +0000
patch 8.2.4282: restricted mode requires the -Z command line option
Problem: Restricted mode requires the -Z command line option.
Solution: Use restricted mode when $SHELL ends in "nologin" or "false".
(closes #9681)
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Tue, 01 Feb 2022 18:30:05 +0100 |
| parents | 6708c3906c35 |
| children | c1171e0022e2 |
| files | runtime/doc/starting.txt src/option.c src/testdir/test_restricted.vim src/version.c |
| diffstat | 4 files changed, 23 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/runtime/doc/starting.txt +++ b/runtime/doc/starting.txt @@ -256,6 +256,8 @@ a slash. Thus "-R" means recovery and " Interfaces, such as Python, Ruby and Lua, are also disabled, since they could be used to execute shell commands. Perl uses the Safe module. + For Unix restricted mode is used when the last part of $SHELL + is "nologin" or "false". Note that the user may still find a loophole to execute a shell command, it has only been made difficult.
--- a/src/option.c +++ b/src/option.c @@ -307,6 +307,17 @@ set_init_1(int clean_arg) */ set_options_default(0); +#ifdef UNIX + // Force restricted-mode on for "nologin" or "false" $SHELL + p = get_isolated_shell_name(); + if (p != NULL) + { + if (fnamecmp(p, "nologin") == 0 || fnamecmp(p, "false") == 0) + restricted = TRUE; + vim_free(p); + } +#endif + #ifdef CLEAN_RUNTIMEPATH if (clean_arg) {
--- a/src/testdir/test_restricted.vim +++ b/src/testdir/test_restricted.vim @@ -105,6 +105,14 @@ func Test_restricted_mode() if RunVim([], [], '-Z --clean -S Xrestricted') call assert_equal([], readfile('Xresult')) endif + call delete('Xresult') + if has('unix') && RunVimPiped([], [], '--clean -S Xrestricted', 'SHELL=/bin/false ') + call assert_equal([], readfile('Xresult')) + endif + call delete('Xresult') + if has('unix') && RunVimPiped([], [], '--clean -S Xrestricted', 'SHELL=/sbin/nologin') + call assert_equal([], readfile('Xresult')) + endif call delete('Xrestricted') call delete('Xresult')