[Bug 297394] Default shell changing from csh to sh has unexpected fallout

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297394

--- Comment #11 from Jeremy Chadwick <[email protected]> ---
Everyone is focused on ENV env var.  That is not the sole problem.  I'm at
least glad Helge read the rest and noticed the PATH variance.

Again: perl taint mode is being used in SpamAssassin no matter what shell you
use.  But clearly when used from sh, existence of ENV causes problems with
sa-update, and god only knows what is going on with PATH and sa-compile (that
is one I do not care to dig into).  I'm an old Perl guy (started in 1994) so
I'm familiar with taint mode and these nuances.  Keep in mind sa-compile nor
sa-update are setuid nor setgid perl scripts.

But again, the root point here: migrating from csh to sh is fine (I have wanted
this since 1997!), but it is clear that those who made this decision did not
stop and think about the full ramifications.  (I've known for decades, for
example, replacing root shell would break parts of ports infra.  I imagine by
now that's been addressed, but third-party impact is going to be a lot more
widespread.)

Case in point: many Linux distros use either bash or dash.  If we focus on dash
(e.g. on Debian/Ubuntu), we find the same ENV "gotcha" per the sh/dash man page
(it's identical to FreeBSD sh in this manner actually).  However, on Linux, ENV
is not set anywhere.  The addition of ENV to /root/.profile -- or more
specifically, part of skel -- was added 27 years ago.  It may be time to
re-visit that.

I am certain that this change will not be the only "surprise" or "gotcha" that
comes up.  It's just a matter of time -- time of mine which was already taken
up by 1) trying to figure out why this problem happened to begin with, and 2)
filing the bug report.

Thanks to those digging in -- appreciated.

-- 
You are receiving this mail because:
You are the assignee for the bug.