Roland Mainz wrote: > Darren J Moffat wrote: > [snip] >> On the other hand given that you already have to modify the code to have >> pfexec used it doesn't seem unreasonable to make it work as the user >> expects. I'd be happy to work with you offline to investigate how much >> code change it would be to have the appropriate subset of builtins >> disabled when running as pfksh93. I'd be happy to contribute the code >> changes. > > Yes, but disabling the builtins is not that easy. My main concern is > that such a change must not - in any case - cause the test suite to > fail, which quickly leads to the question/problem which builtins should > be disabled and which not (for example the "test" builtin cannot be > disabled unless we make the /usr/bin/test utility aware of the
[snip] > Ahhggrll... ;-( > I really like to avoid a "TCR" here and work in peace on a solution. > This seems to be more complex and rushing any solution without propper > investigation may lead to something which may even be worse than the > current status (which is at least predictable and controlable for the > developers of scripts). > Another issue is that I don't know much about RBAC (and AFAIK neither > David&Glenn do)... I first have to learn how it works in detail and > which side-effects it has... Given this I HIGHLY recommend that this case does NOT introduce pfksh93. It will be a requirement on the future case that makes the ksh93 code base /usr/bin/ksh to have this issue resolved - how that should be done can be taken offline and may not, depending on other OpenSolaris projects, require any change to ksh93 code at all. -- Darren J Moffat
