Skip to content

feat: added zmodload and sudo-rs #4143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 17 commits into from
Jun 29, 2025
Merged

Conversation

Xhoenix
Copy link
Member

@Xhoenix Xhoenix commented May 23, 2025

No description provided.

Copy link
Contributor

github-actions bot commented May 23, 2025

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

@Xhoenix Xhoenix requested a review from a team May 23, 2025 10:30
@Xhoenix Xhoenix added the release:new-detection In this PR we introduce a new detection label May 25, 2025
Copy link
Member

@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some more (for a new PR maybe):

  • bin/builtin
  • bin/done
  • bin/endif
  • bin/endsw
  • bin/esac
  • bin/fi
  • bin/foreach
  • bin/function
  • bin/history
  • bin/hup
  • bin/repeat
  • bin/set
  • bin/setenv

Some others are builtins, but also exist as separated binaries so we cannot remove:

  • bin/echo
  • bin/local
  • bin/printenv

And maybe we also want to add sudo-rs? reference

Copy link
Member

@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to add sudo-rs also? Does it live in bin/, right?

@Xhoenix
Copy link
Member Author

Xhoenix commented May 26, 2025

Do we want to add sudo-rs also? Does it live in bin/, right?

Looks like sudo-rs does: apt-file search sudo-rs | grep bin/sudo-rs

@Xhoenix Xhoenix changed the title feat: added zmodload feat: added zmodload and sudo-rs May 26, 2025
@theseion
Copy link
Contributor

Why did you remove the builtins?

I just realised that pmFromFile can take multiple files as input. So I think it could make more sense to create a separate file for aliases, variables, and builtins. That should make maintenance a bit simpler.

@Xhoenix
Copy link
Member Author

Xhoenix commented May 28, 2025

Why did you remove the builtins?

Sorry if I'm mistaken, but doesn't adding pointless entries, that doesn't exist in real systems, bad for performance? Also, not sure most entries without the bin/ path added to them will be safe for FPs.

@theseion
Copy link
Contributor

In general, yes, but they do exist. If you manage to execute a shell, you can call zmodload, which, incidentally, was the entire point of this PR. zmodload is a built-in just like the others.

@fzipi
Copy link
Member

fzipi commented Jun 3, 2025

@Xhoenix can you fix the conflict so we merge this one? thanks!

@fzipi
Copy link
Member

fzipi commented Jun 19, 2025

What else do we need here @theseion @Xhoenix ?

@Xhoenix
Copy link
Member Author

Xhoenix commented Jun 26, 2025

Everything looks good. @theseion waiting for approval.

@fzipi fzipi requested a review from theseion June 28, 2025 15:01
Copy link
Member

@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM now.

@Xhoenix Xhoenix enabled auto-merge June 29, 2025 12:37
@Xhoenix
Copy link
Member Author

Xhoenix commented Jun 29, 2025

@theseion need your approval.

@Xhoenix Xhoenix added this pull request to the merge queue Jun 29, 2025
Merged via the queue into coreruleset:main with commit 4aea599 Jun 29, 2025
6 checks passed
@Xhoenix Xhoenix deleted the add-zmodload branch June 29, 2025 14:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release:new-detection In this PR we introduce a new detection
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants