Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
HooksArea: what it touches
ImprovementsKind: in v2.1.246,
ImprovementsSection of the release
What
The resolver that decides whether a hook or configured command points at a program you could tamper with got three new checks, so more commands are conservatively treated as unresolved or in reach rather than trusted.
Details
A file with more than one hard link is treated as reachable unless its first four bytes are a genuine ELF or Mach-O magic number.
env is only honoured at the literal paths /usr/bin/env and /bin/env, and its argument may not contain a slash.
Following #! interpreter lines is now depth-limited, with a final check that the target really is a script.
Evidence
program_unresolved
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
