A related issue is with adding the nameref attribute to a readonly variable. Not sure if that should be allowed, as it can be used to change the meaning of the variable, even for variables that bash is using internally:
$ TIMEFORMAT='%R' $ time bash -c 'readonly TMOUT=5; read'5.007 $ time bash -c 'readonly TMOUT=5; ref=$TMOUT; declare -n ref; ref=10; declare -n TMOUT; read'10.004 The same technique works for circumventing PATH in a restricted shell: $ PATH='/restricted/bin' $BASH -r -c 'type sed; ref=$PATH; declare -n ref; ref=/usr/bin; declare -n PATH; type sed' bash bash: line 0: type: sed: not found sed is /usr/bin/sed
