shellenv: prefer lsof to ps to read the command for a process #21157
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently,
shellenv.shis frequently run as part of a user's~/.zprofile,which includes the following line:
HOMEBREW_SHELL_NAME="$(/bin/ps -p "${PPID}" -c -o comm=)"Indeed, if I run the following from
zsh, this reportszsh(or-zsh), as expected:$ bash -c '/bin/ps -p "${PPID}" -c -o comm=' -zshThough
/bin/psis a setuid binary:$ stat -f "%Sp" /bin/ps -rwsr-xr-xWhich means that it cannot be run under macOS Seatbelt unless explicit support
is added to the Seatbelt policy to run it outside of the sandbox:
Though this is somewhat undesirable because
/bin/psmakes it possible todump environment variables from processes, which often includes sensitive
information such as API keys.
By comparison,
/usr/sbin/lsofis not setuid:$ stat -f "%Sp" /usr/sbin/lsof -rwxr-xr-xAnd the proposed change yields the same information (without the leading hyphen):
$ bash -c '/usr/sbin/lsof -p "$PPID" -a -d cwd -Fc | /usr/bin/sed -n "s/^c//p"' zshOverall, this would make it possible to invoke
zsh -lcunder Seatbelt forusers who run
shellenv.shin their~/.zprofilewithout having to use a lessrestrictive Seatbelt policy.