<div dir="ltr">On 4 October 2017 at 07:20, Andrej Valek <span dir="ltr"><<a href="mailto:andrej.valek@siemens.com" target="_blank">andrej.valek@siemens.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">I have compared no/suid links between these versions. So, I was trying<br>
to enable the same applets like in older version and do not enable the<br>
new one. Some applets could not be disabled (they are automatically<br>
enabled) due to dependencies.<br>
<br>
For this version of defconfig the new applets are:<br>
chrt<br>
cttyhack<br>
init<br>
lzcat<br>
mdev<br>
nproc<br>
setsid<br>
xzcat<br>
partprobe</blockquote><div><br></div><div>This doesn't quite match what I'm seeing by comparing old and new links in the postinst:</div><div><br></div><div><div>$ diff then now</div><div>44c44,45</div><div>< update-alternatives --install /bin/sh sh /bin/busybox.nosuid 50</div><div>---</div><div>> update-alternatives --install /bin/sh sh /bin/busybox.suid 50</div><div>> update-alternatives --install /bin/sh sh /bin/busybox.suid 50</div><div>122a124</div><div>> update-alternatives --install /usr/bin/lzcat lzcat /bin/busybox.nosuid 50</div><div>128a131</div><div>> update-alternatives --install /usr/bin/nproc nproc /bin/busybox.nosuid 50</div><div>167a171</div><div>> update-alternatives --install /usr/bin/xzcat xzcat /bin/busybox.nosuid 50</div></div><div><br></div><div>Note the two lines installing an alternative of /bin/sh to busybox.suid.</div><div><br></div><div>Assuming they should have alternative links installed, the following applets are still disabled too:</div><div><br></div><div> chrt</div><div> cttyhack</div><div> init</div><div> mdev</div><div> setsid</div><div> partprobe</div><div><br></div><div>Ross</div></div></div></div>