Under the hood
Useful2 Signal3
More hook and command programs are conservatively treated as tamperable rather than trusted.
What's wrong with this entry?
Anonymous. No account, no email.
What
The resolver that decides whether a hook or configured command points at a program you could tamper with got three new checks, so more commands are conservatively treated as unresolved or in reach rather than trusted.
Details
- A file with more than one hard link is treated as reachable unless its first four bytes are a genuine ELF or Mach-O magic number.
envis only honoured at the literal paths/usr/bin/envand/bin/env, and its argument may not contain a slash.- Following
#!interpreter lines is now depth-limited, with a final check that the target really is a script.
Evidence
program_unresolved
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
SessionEnd hooks lose the
bypass_permissions_disabledreasonBoth mention hook
-
v2.1.236
Hooks and Ctrl-C go quiet once shutdown has started
Both mention hook
-
v2.1.236
Shutdown seals transcript writes and gives SessionEnd hooks more time
Both mention hook