On 2011/05/06 08:49, Todd C. Miller wrote:
> On Fri, 06 May 2011 11:37:53 BST, Stuart Henderson wrote:
>
> > I'm not entirely convinced it's safe to add ENV to env_keep by
> > default but the only other workaround I've found (i.e. ln -s
> > /usr/bin/{vi,not_emacs} and setting VISUAL=/usr/bin/not_emacs)
> > is messy and annoying to do on multiple machines.
>
> It most certainly is not safe as it allows one to run arbitrary
> commands.
If you have something which handles ENV (i.e. an interactive shell),
isn't it already the case that you can run arbitrary commands?
