Re: .exrc file security risks

On Tue, 29 Apr 2003, Benjamin A. Okopnik wrote:

> tar xvzf evil.tgz

There is no such option in in /usr/bin/vi on Solaris, and no support for such a file.

The way to "lock this down" for the root user is to create a ~root/.exrc file with the line "set noexrc" in it. Also remember to do /bin/su - rather than just /bin/su (so that $EXINIT isn't passed alone).

-- 
Darren J Moffat