Re: execution policy for shells

[Thor Lancelot Simon <tls%panix.com@localhost>]

On Thu, Sep 23, 2010 at 09:22:21PM +0930, Brett Lymn wrote:
> On Thu, Sep 23, 2010 at 07:35:14AM -0400, Thor Lancelot Simon wrote:
> > 
> > It's "possible via veriexec" inasmuch as you can allow only the one
> > true blessed shell to run, and implement whatever policy you care to
> > in that shell.  This is how the VMS dynamic linker protected the rest
> > of the system from bad shared objects...
> 
> actually, veriexec can be more subtle than that.  You can bless
> certain shell scripts but deny the direct invocation of the shell
> interpreter.  That means that #!/bin/powershell at the top of the

In which case you can't even have an emergency login shell on your
system.  Not 100% sure what I think about that one.

Thor