{"version":"2.1.246","anchor":"stricter-check-on-whether-a-command-s-program-sits-in-a-writ","canonical_anchor":"stricter-check-on-whether-a-command-s-program-sits-in-a-writ","heading":"Stricter check on whether a command's program sits in a writable location","tier":"internal","area":"Hooks","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246\/e\/stricter-check-on-whether-a-command-s-program-sits-in-a-writ","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246","markdown":"### Stricter check on whether a command's program sits in a writable location\n\nMore hook and command programs are conservatively treated as tamperable rather than trusted.\n\n**What**\n\nThe resolver that decides whether a hook or configured command points at a program you could tamper with got three new checks, so more commands are conservatively treated as unresolved or in reach rather than trusted.\n\n**Details**\n\n- A file with more than one hard link is treated as reachable unless its first four bytes are a genuine ELF or Mach-O magic number.\n- `env` is only honoured at the literal paths `\/usr\/bin\/env` and `\/bin\/env`, and its argument may not contain a slash.\n- Following `#!` interpreter lines is now depth-limited, with a final check that the target really is a script.\n\n**Evidence**\n\n`program_unresolved`\n\n- Area: Hooks\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}