Re: security alerts in busybox

On Sun, Apr 26, 2026 at 10:42:53AM +0200, Roberto A. Foglietta wrote:
> On Sat, 25 Apr 2026 at 21:46, Ladislav Michl <[email protected]> wrote:
> >
> > On Fri, Apr 24, 2026 at 04:40:47PM +0200, Roberto A. Foglietta via busybox wrote:
> > > Hi,
> ...
> > > These are trivial alerts, therefore I faced it first to provide an
> > > example. And the second main question is straightforward: does this
> > > fix worth 177 bytes? In relative terms it is 150 ppm compared with the
> > > full size footprint. In terms of certifications is a solid step
> > > towards peace of mind.
> >
> > These are not trivial alerts, but pure garbage. Adding even single
> > byte to 'fix' non-existant bug does not make any sense.
> >
> 
> It doesn't make any sense for you, but for busybox as a single binary
> self-contained is a must to have.
> 
> The core technical point: Busybox is not pthread-safe by design, but a
> self-contained binary must be. Therefore static-analysis alerts that
> are 99.9% false-positive in multi-process Busybox become mandatory
> fixes in single-binary deployment. This is a genuine architectural
> distinction that bureaucratic tool-wrangling would miss.

Out of curiosity, since you missed or ignored question [*]. How does
OS handle statically allocated data according your understanding?

[*] let's repeat it here for the sake of completeness:
On Sat, Apr 25, 2026 at 09:46:02PM +0200, Ladislav Michl via busybox wrote:
> Could you provide a short insight how that happends given these are
> separate processes?

	L.