Re: Command injection in /etc/rc.d/netif

Hi,

There are two separate paths:

1. rc.conf / ifconfig_* values Yes — if someone can edit those, they
already have root-level trust. I agree that is not a new privilege boundary.

2. Command-line interface name, including a glob touch '/tmp/;id;' service
netif start '/tmp/*'

Here nothing in /etc is modified. A crafted filename is expanded into an
"interface name" and later hits:

eval ${IFCONFIG_CMD} $1 ${ifconfig_args}

so the metacharacters run as root. That is the part that looks
unintentional: privileged scripts normally should not eval unquoted values
that can come from the command line or the filesystem this way.

Colin has already framed this as a robustness issue rather than a
security-boundary issue in base. I agree with that classification. The
practical fix is still to drop the unnecessary eval and quote the interface
name.

Best regards, Nami Arjmandi


On Sun, Aug 9, 2026 at 5:40 PM <[email protected]> wrote:

> hello why is this a security issue, if an unauthenticated user has
> permission to modify an rc script then that's on the sysadmin that gave
> such permission,not on the system,and i don't see any realistically
> possible scenario where without explicit consent from the root user to
> modify a rc script as such someone would maliciously be able to be modify
> as such, and if someone is explicitly allowed to modify a rc script as such
> then at that point that's not an issue about how the rc script is written
> it's about trust as you can make a shell script that launches at boot do
> anything, so clarify please what's wrong with the rc script?
>