GREP_OPTIONS is evil
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
mysql-5.1 (Ubuntu) |
Invalid
|
Low
|
Unassigned |
Bug Description
Binary package hint: mysql-server-5.0
If you wish to prevent mysql from starting up, put this in your shell's startup files:
export GREP_OPTIONS='-E'
Why does this cause problems? Because when you run the init.d files, you get:
grep: conflicting matchers specified
And then the server doesn't start up.
Personally, I think GREP_OPTIONS is evil and am in the process of removing it from my shell start up scripts.
This could be a potential security hole since just setting this environment variable can make shell scripts and their like to take the wrong actions. True, it's probably not easily open to malicious usage, but I could craft a script that would behave correctly unless a certain GREP flag was set, at which point it would do the exact opposite that it was expected to do.
Ciao!
Changed in mysql-dfsg-5.0: | |
status: | Incomplete → Triaged |
affects: | mysql-dfsg-5.0 (Ubuntu) → mysql-dfsg-5.1 (Ubuntu) |
affects: | mysql-dfsg-5.1 (Ubuntu) → mysql-5.1 (Ubuntu) |
Thanks for the report!
Anyone with the access to start/stop system services generally has a very large ability to disrupt the operation of the system, so I'm going to unflag this as a security issue.
Currently sudo will preserve the environment if you can have full privs, otherwise the environment is cleaned. If you want to force a clean env at all times, you can add:
Defaults env_reset
to your /etc/sudoers.