File bash-4.3-extra-import-func.patch of Package bash.12495
---
builtins/shopt.def | 2 ++
doc/bash.1 | 7 +++++++
shell.c | 2 ++
variables.c | 8 +++++++-
4 files changed, 18 insertions(+), 1 deletion(-)
--- builtins/shopt.def
+++ builtins/shopt.def 2016-09-14 08:57:33.723885627 +0000
@@ -90,6 +90,7 @@ extern int autocd;
extern int glob_star;
extern int glob_asciirange;
extern int lastpipe_opt;
+extern int import_functions;
extern int inherit_errexit;
#if defined (EXTENDED_GLOB)
@@ -200,6 +201,7 @@ static struct {
{ "hostcomplete", &perform_hostname_completion, shopt_enable_hostname_completion },
#endif
{ "huponexit", &hup_on_exit, (shopt_set_func_t *)NULL },
+ { "import-functions", &import_functions, (shopt_set_func_t *)NULL },
{ "inherit_errexit", &inherit_errexit, (shopt_set_func_t *)NULL },
{ "interactive_comments", &interactive_comments, set_shellopts_after_change },
{ "lastpipe", &lastpipe_opt, (shopt_set_func_t *)NULL },
--- doc/bash.1
+++ doc/bash.1 2016-09-14 08:57:33.723885627 +0000
@@ -244,6 +244,13 @@ The shell becomes restricted (see
.B "RESTRICTED SHELL"
below).
.TP
+.B \-\-import\-functions
+This shell is patched in such a way that shell functions in the inported environment
+will not be expanded due several security issues (e.g. CVE\-2014\-6271). This option
+can be used to enable this. It is also possible to use the
+.B shopt
+builtin to do this.
+.TP
.B \-\-verbose
Equivalent to \fB\-v\fP.
.TP
--- shell.c
+++ shell.c 2016-09-14 08:57:33.723885627 +0000
@@ -238,6 +238,7 @@ int posixly_correct = 1; /* Non-zero mea
#else
int posixly_correct = 0; /* Non-zero means posix.2 superset. */
#endif
+int import_functions = IMPORT_FUNCTIONS_DEF; /* Import functions from environment */
/* Some long-winded argument names. These are obviously new. */
#define Int 1
@@ -257,6 +258,7 @@ static const struct {
{ "help", Int, &want_initial_help, (char **)0x0 },
{ "init-file", Charp, (int *)0x0, &bashrc_file },
{ "login", Int, &make_login_shell, (char **)0x0 },
+ { "import-functions", Int, &import_functions, (char **)0x0 },
{ "noediting", Int, &no_line_editing, (char **)0x0 },
{ "noprofile", Int, &no_profile, (char **)0x0 },
{ "norc", Int, &no_rc, (char **)0x0 },
--- variables.c
+++ variables.c 2016-09-14 08:57:33.723885627 +0000
@@ -115,6 +115,7 @@ extern time_t shell_start_time;
extern int assigning_in_environment;
extern int executing_builtin;
extern int funcnest_max;
+extern int import_functions;
#if defined (READLINE)
extern int no_line_editing;
@@ -378,6 +379,11 @@ initialize_shell_variables (env, privmod
tname = name + BASHFUNC_PREFLEN; /* start of func name */
tname[namelen] = '\0'; /* now tname == func name */
+ if (!import_functions && !interactive_shell) {
+ report_error (_("Skipping importing function definition for `%s': --import-functions required."), tname);
+ goto reval;
+ }
+
string_length = strlen (string);
temp_string = (char *)xmalloc (namelen + string_length + 2);
@@ -392,7 +398,7 @@ initialize_shell_variables (env, privmod
parse_and_execute (temp_string, tname, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD);
else
free (temp_string); /* parse_and_execute does this */
-
+ reval:
if (temp_var = find_function (tname))
{
VSETATTR (temp_var, (att_exported|att_imported));