Re: file forks vs. xattr (was: xattr names for unprivileged stacking?)

Theodore Y. Ts'o
2020-08-28T14:47:20Z

On Fri, Aug 28, 2020 at 11:11:15AM +0200, Christian Schoenebeck wrote:
>
> Built-in path resolution would be nice, but it won't be a show stopper for
> such common utils if not. For instance on Solaris there is:
>
> runat <filename> <cmd> ...
>
> which works something like fchdir(); execv(); you loose some flexibility, but
> in practice still OK.

And we know from the Solaris experience that it was used *much* more
by malware authors (since most Unix security scanners didn't know
about forks) than any legitmate users.

Which is another way of saying, it's a bad idea --- unless you are a
malware author.

- Ted