[RFC] system.3: Document bug when the command name starts with a hypen

[RFC] system.3: Document bug when the command name starts with a hypen

[Alejandro Colomar]

man-pages bug: 211029
 https://bugzilla.kernel.org/show_bug.cgi?id=211029

glibc bug: 27143
 https://sourceware.org/bugzilla/show_bug.cgi?id=27143

When a command name starts with a hyphen (which is a valid one),
the shell's '-c' option interprets the command name as antoher
option.  This can be workarounded by prepending the command name
with a space, as Ciprian pointed out in his bug report.

Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
---

Hi Ciprian,

If you report a bug to the Austin Group,
please CC linux-man@vger.kernel.org,
so that we can add the URL and update the BUGS section
if it is ever fixed.

 man3/system.3 | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/man3/system.3 b/man3/system.3
index aef40417a..5a9318dec 100644
--- a/man3/system.3
+++ b/man3/system.3
@@ -250,6 +250,39 @@ are not executed.
 Such risks are especially grave when using
 .BR system ()
 from a privileged program.
+.SH BUGS
+./" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
+./" [glibc 27143](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
+If the command name starts with a hyphen,
+.BR sh (1)
+interprets the command name as an option,
+and the behavior is undefined
+(See the
+.B \-c
+option in
+.BR sh (1).).
+This behavior is mandated by POSIX.
+To work around this problem,
+prepend the command with a space as below:
+.PP
+.RS 4
+.EX
+/* system_hyphen.c */
+
+#include <stdlib.h>
+
+int
+main(void)
+{
+    system(" -echo Hello world!");
+    exit(EXIT_SUCCESS);
+}
+.PP
+.RB "$" " sudo ln \-s \-T /usr/bin/echo /usr/bin/\-echo;"
+.RB "$" " cc \-o system_hyphen system_hyphen.c;"
+.RB "$" " ./system_hyphen;"
+Hello world!
+.EE
+.RE
 .SH SEE ALSO
 .BR sh (1),
 .BR execve (2),
-- 
2.29.2

Re: [RFC] system.3: Document bug when the command name starts with a hypen

[Ciprian Dorin Craciun]

On Mon, Jan 4, 2021 at 5:18 PM Alejandro Colomar <alx.manpages@gmail.com> wrote:
> If you report a bug to the Austin Group,
> please CC linux-man@vger.kernel.org,
> so that we can add the URL and update the BUGS section
> if it is ever fixed.


As notified on the glibc and man-pages issue tracker (sorry for the
duplicate notifications), the POSIX issue has been opened at:

  https://www.austingroupbugs.net/view.php?id=1440

Thanks,
Ciprian.

[PATCH] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar]

man-pages bug: 211029
 https://bugzilla.kernel.org/show_bug.cgi?id=211029

Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
---
 man3/system.3 | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/man3/system.3 b/man3/system.3
index aef40417a..0310d9a04 100644
--- a/man3/system.3
+++ b/man3/system.3
@@ -250,6 +250,40 @@ are not executed.
 Such risks are especially grave when using
 .BR system ()
 from a privileged program.
+.SH BUGS
+./" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
+./" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
+./" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
+If the command name starts with a hyphen,
+.BR sh (1)
+interprets the command name as an option,
+and the behavior is undefined
+(See the
+.B \-c
+option in
+.BR sh (1).).
+To work around this problem,
+prepend the command with a space as below:
+.PP
+.RS 4
+.EX
+/* system_hyphen.c */
+
+#include <stdlib.h>
+
+int
+main(void)
+{
+    system(" -echo Hello world!");
+    exit(EXIT_SUCCESS);
+}
+.PP
+.RB "$" " sudo ln \-s \-T /usr/bin/echo /usr/bin/\-echo;"
+.RB "$" " cc \-o system_hyphen system_hyphen.c;"
+.RB "$" " ./system_hyphen;"
+Hello world!
+.EE
+.RE
 .SH SEE ALSO
 .BR sh (1),
 .BR execve (2),
-- 
2.29.2

Re: [PATCH] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar (man-pages)]

Hi Michael,

See a few corrections below.

Cheers,

Alex

On 1/4/21 7:04 PM, Alejandro Colomar wrote:
> man-pages bug: 211029
>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
> 
> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
> Cc: Florian Weimer <fweimer@redhat.com>
> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
> ---
>  man3/system.3 | 34 ++++++++++++++++++++++++++++++++++
>  1 file changed, 34 insertions(+)
> 
> diff --git a/man3/system.3 b/man3/system.3
> index aef40417a..0310d9a04 100644
> --- a/man3/system.3
> +++ b/man3/system.3
> @@ -250,6 +250,40 @@ are not executed.
>  Such risks are especially grave when using
>  .BR system ()
>  from a privileged program.
> +.SH BUGS
> +./" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
> +./" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
> +./" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
> +If the command name starts with a hyphen,
> +.BR sh (1)
> +interprets the command name as an option,
> +and the behavior is undefined
> +(See the
> +.B \-c
> +option in

option to

> +.BR sh (1).).
> +To work around this problem,
> +prepend the command with a space as below:
> +.PP
> +.RS 4
> +.EX
> +/* system_hyphen.c */
> +
> +#include <stdlib.h>
> +
> +int
> +main(void)
> +{
> +    system(" -echo Hello world!");

\-echo

> +    exit(EXIT_SUCCESS);
> +}
> +.PP
> +.RB "$" " sudo ln \-s \-T /usr/bin/echo /usr/bin/\-echo;"
> +.RB "$" " cc \-o system_hyphen system_hyphen.c;"
> +.RB "$" " ./system_hyphen;"
> +Hello world!
> +.EE
> +.RE
>  .SH SEE ALSO
>  .BR sh (1),
>  .BR execve (2),
> 

-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Re: [PATCH] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar (man-pages)]

D'oh

On 1/4/21 7:32 PM, Alejandro Colomar (man-pages) wrote:
> Hi Michael,
> 
> See a few corrections below.
> 
> Cheers,
> 
> Alex
> 
> On 1/4/21 7:04 PM, Alejandro Colomar wrote:
>> man-pages bug: 211029
>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>
>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>> Cc: Florian Weimer <fweimer@redhat.com>
>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>> ---
>>  man3/system.3 | 34 ++++++++++++++++++++++++++++++++++
>>  1 file changed, 34 insertions(+)
>>
>> diff --git a/man3/system.3 b/man3/system.3
>> index aef40417a..0310d9a04 100644
>> --- a/man3/system.3
>> +++ b/man3/system.3
>> @@ -250,6 +250,40 @@ are not executed.
>>  Such risks are especially grave when using
>>  .BR system ()
>>  from a privileged program.
>> +.SH BUGS
>> +./" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>> +./" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>> +./" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)

s%/%\\%

>> +If the command name starts with a hyphen,
>> +.BR sh (1)
>> +interprets the command name as an option,
>> +and the behavior is undefined
>> +(See the
>> +.B \-c
>> +option in
> 
> option to
> 
>> +.BR sh (1).).
>> +To work around this problem,
>> +prepend the command with a space as below:
>> +.PP
>> +.RS 4
>> +.EX
>> +/* system_hyphen.c */
>> +
>> +#include <stdlib.h>
>> +
>> +int
>> +main(void)
>> +{
>> +    system(" -echo Hello world!");
> 
> \-echo
> 
>> +    exit(EXIT_SUCCESS);
>> +}
>> +.PP
>> +.RB "$" " sudo ln \-s \-T /usr/bin/echo /usr/bin/\-echo;"
>> +.RB "$" " cc \-o system_hyphen system_hyphen.c;"
>> +.RB "$" " ./system_hyphen;"
>> +Hello world!
>> +.EE
>> +.RE
>>  .SH SEE ALSO
>>  .BR sh (1),
>>  .BR execve (2),
>>
> 

-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Re: [RFC] system.3: Document bug when the command name starts with a hypen

[Michael Kerrisk (man-pages)]

Hi Alex,

On 1/4/21 4:13 PM, Alejandro Colomar wrote:
> man-pages bug: 211029
>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
> 
> glibc bug: 27143
>  https://sourceware.org/bugzilla/show_bug.cgi?id=27143
> 
> When a command name starts with a hyphen (which is a valid one),
> the shell's '-c' option interprets the command name as antoher
> option.  This can be workarounded by prepending the command name
> with a space, as Ciprian pointed out in his bug report.

Huh! Well that's weird, of course. So, I think
something should be said in the manual page, but perhaps
a little less than below. Having a command name that starts
with a '-' is a weird corner case, and it's unsurprising
(if unfortunate) that it buys you trouble.

> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
> Cc: Florian Weimer <fweimer@redhat.com>
> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
> ---
> 
> Hi Ciprian,
> 
> If you report a bug to the Austin Group,
> please CC linux-man@vger.kernel.org,
> so that we can add the URL and update the BUGS section
> if it is ever fixed.
> 
>  man3/system.3 | 33 +++++++++++++++++++++++++++++++++
>  1 file changed, 33 insertions(+)
> 
> diff --git a/man3/system.3 b/man3/system.3
> index aef40417a..5a9318dec 100644
> --- a/man3/system.3
> +++ b/man3/system.3
> @@ -250,6 +250,39 @@ are not executed.
>  Such risks are especially grave when using
>  .BR system ()
>  from a privileged program.
> +.SH BUGS
> +./" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
> +./" [glibc 27143](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)

Better add the Austin bug URL mnow.

> +If the command name starts with a hyphen,
> +.BR sh (1)
> +interprets the command name as an option,
> +and the behavior is undefined
> +(See the
> +.B \-c
> +option in
> +.BR sh (1).).

s/.)./.)/

> +This behavior is mandated by POSIX.
> +To work around this problem,
> +prepend the command with a space as below:

It's a funny workaround :-). But it seems to work
in bash, dash, and zsh. Interestingly. (t)csh doesn't
even have the problem.

I don't think we need the example below in the manual page 
(see my comments above), although you could include it in 
the commit message.

Thanks,

Michael

> +.PP
> +.RS 4
> +.EX
> +/* system_hyphen.c */
> +
> +#include <stdlib.h>
> +
> +int
> +main(void)
> +{
> +    system(" -echo Hello world!");
> +    exit(EXIT_SUCCESS);
> +}
> +.PP
> +.RB "$" " sudo ln \-s \-T /usr/bin/echo /usr/bin/\-echo;"
> +.RB "$" " cc \-o system_hyphen system_hyphen.c;"
> +.RB "$" " ./system_hyphen;"
> +Hello world!
> +.EE
> +.RE
>  .SH SEE ALSO
>  .BR sh (1),
>  .BR execve (2),
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

[PATCH v2] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar]

man-pages bug: 211029
 https://bugzilla.kernel.org/show_bug.cgi?id=211029

Complete workaround
(it was too long for the page, but it may be useful here):

......

$ sudo ln \-s \-T /usr/bin/echo /usr/bin/\-echo;
$ cc -o system_hyphen -x c - ;

int
main(void)
{
    system(" -echo Hello world!");
    exit(EXIT_SUCCESS);
}

$ ./system_hyphen;
Hello world!

Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
---
 man3/system.3 | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/man3/system.3 b/man3/system.3
index 753d46f7d..ead35ab30 100644
--- a/man3/system.3
+++ b/man3/system.3
@@ -255,6 +255,26 @@ are not executed.
 Such risks are especially grave when using
 .BR system ()
 from a privileged program.
+.SH BUGS
+.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
+.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
+.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
+If the command name starts with a hyphen,
+.BR sh (1)
+interprets the command name as an option,
+and the behavior is undefined.
+(See the
+.B \-c
+option to
+.BR sh (1).)
+To work around this problem,
+prepend the command with a space as in the following call:
+.PP
+.RS 4
+.EX
+    system(" \-unfortunate\-command\-name");
+.EE
+.RE
 .SH SEE ALSO
 .BR sh (1),
 .BR execve (2),
-- 
2.29.2

[PATCH v3] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar]

man-pages bug: 211029
 https://bugzilla.kernel.org/show_bug.cgi?id=211029

Complete workaround
(it was too long for the page, but it may be useful here):

......

$ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
$ cc -o system_hyphen -x c - ;

int
main(void)
{
    system(" -echo Hello world!");
    exit(EXIT_SUCCESS);
}

$ ./system_hyphen;
Hello world!

Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
---

Hi Michael,

I forgot to remove some escapings in the commit message in v2.
I hope it arrives in time :)

Cheers,

Alex

 man3/system.3 | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/man3/system.3 b/man3/system.3
index 753d46f7d..ead35ab30 100644
--- a/man3/system.3
+++ b/man3/system.3
@@ -255,6 +255,26 @@ are not executed.
 Such risks are especially grave when using
 .BR system ()
 from a privileged program.
+.SH BUGS
+.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
+.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
+.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
+If the command name starts with a hyphen,
+.BR sh (1)
+interprets the command name as an option,
+and the behavior is undefined.
+(See the
+.B \-c
+option to
+.BR sh (1).)
+To work around this problem,
+prepend the command with a space as in the following call:
+.PP
+.RS 4
+.EX
+    system(" \-unfortunate\-command\-name");
+.EE
+.RE
 .SH SEE ALSO
 .BR sh (1),
 .BR execve (2),
-- 
2.29.2

[PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar]

man-pages bug: 211029
 https://bugzilla.kernel.org/show_bug.cgi?id=211029

Complete workaround
(it was too long for the page, but it may be useful here):

......

$ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
$ cc -o system_hyphen -x c - ;
#include <stdlib.h>

int
main(void)
{
    system(" -echo Hello world!");
    exit(EXIT_SUCCESS);
}

$ ./system_hyphen;
Hello world!

Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
Cc: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
---

D'oh!

 man3/system.3 | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/man3/system.3 b/man3/system.3
index 753d46f7d..ead35ab30 100644
--- a/man3/system.3
+++ b/man3/system.3
@@ -255,6 +255,26 @@ are not executed.
 Such risks are especially grave when using
 .BR system ()
 from a privileged program.
+.SH BUGS
+.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
+.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
+.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
+If the command name starts with a hyphen,
+.BR sh (1)
+interprets the command name as an option,
+and the behavior is undefined.
+(See the
+.B \-c
+option to
+.BR sh (1).)
+To work around this problem,
+prepend the command with a space as in the following call:
+.PP
+.RS 4
+.EX
+    system(" \-unfortunate\-command\-name");
+.EE
+.RE
 .SH SEE ALSO
 .BR sh (1),
 .BR execve (2),
-- 
2.29.2

Re: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar (man-pages)]

On 1/8/21 3:22 PM, Alejandro Colomar wrote:
> man-pages bug: 211029
>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
> 
> Complete workaround

Maybe a bit more readable:
Complete workaround example


> (it was too long for the page, but it may be useful here):
> 
> ......
> 
> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
> $ cc -o system_hyphen -x c - ;
> #include <stdlib.h>
> 
> int
> main(void)
> {
>     system(" -echo Hello world!");
>     exit(EXIT_SUCCESS);
> }
> 
> $ ./system_hyphen;
> Hello world!
> 
> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
> Cc: Florian Weimer <fweimer@redhat.com>
> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
> ---
> 
> D'oh!
> 
>  man3/system.3 | 20 ++++++++++++++++++++
>  1 file changed, 20 insertions(+)
> 
> diff --git a/man3/system.3 b/man3/system.3
> index 753d46f7d..ead35ab30 100644
> --- a/man3/system.3
> +++ b/man3/system.3
> @@ -255,6 +255,26 @@ are not executed.
>  Such risks are especially grave when using
>  .BR system ()
>  from a privileged program.
> +.SH BUGS
> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
> +If the command name starts with a hyphen,
> +.BR sh (1)
> +interprets the command name as an option,
> +and the behavior is undefined.
> +(See the
> +.B \-c
> +option to
> +.BR sh (1).)
> +To work around this problem,
> +prepend the command with a space as in the following call:
> +.PP
> +.RS 4
> +.EX
> +    system(" \-unfortunate\-command\-name");
> +.EE
> +.RE
>  .SH SEE ALSO
>  .BR sh (1),
>  .BR execve (2),
> 

-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Ping: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar (man-pages)]

Hi Michael,

Ping!

And now I noticed a typo in the subject:
s/hypen/hyphen/

Thanks,

Alex

On 1/8/21 3:28 PM, Alejandro Colomar (man-pages) wrote:
> 
> 
> On 1/8/21 3:22 PM, Alejandro Colomar wrote:
>> man-pages bug: 211029
>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>
>> Complete workaround
> 
> Maybe a bit more readable:
> Complete workaround example
> 
> 
>> (it was too long for the page, but it may be useful here):
>>
>> ......
>>
>> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
>> $ cc -o system_hyphen -x c - ;
>> #include <stdlib.h>
>>
>> int
>> main(void)
>> {
>>     system(" -echo Hello world!");
>>     exit(EXIT_SUCCESS);
>> }
>>
>> $ ./system_hyphen;
>> Hello world!
>>
>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>> Cc: Florian Weimer <fweimer@redhat.com>
>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>> ---
>>
>> D'oh!
>>
>>  man3/system.3 | 20 ++++++++++++++++++++
>>  1 file changed, 20 insertions(+)
>>
>> diff --git a/man3/system.3 b/man3/system.3
>> index 753d46f7d..ead35ab30 100644
>> --- a/man3/system.3
>> +++ b/man3/system.3
>> @@ -255,6 +255,26 @@ are not executed.
>>  Such risks are especially grave when using
>>  .BR system ()
>>  from a privileged program.
>> +.SH BUGS
>> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
>> +If the command name starts with a hyphen,
>> +.BR sh (1)
>> +interprets the command name as an option,
>> +and the behavior is undefined.
>> +(See the
>> +.B \-c
>> +option to
>> +.BR sh (1).)
>> +To work around this problem,
>> +prepend the command with a space as in the following call:
>> +.PP
>> +.RS 4
>> +.EX
>> +    system(" \-unfortunate\-command\-name");
>> +.EE
>> +.RE
>>  .SH SEE ALSO
>>  .BR sh (1),
>>  .BR execve (2),
>>
> 


-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Re: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Michael Kerrisk (man-pages)]

Hi Alex,

On 1/8/21 3:22 PM, Alejandro Colomar wrote:
> man-pages bug: 211029
>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
> 
> Complete workaround
> (it was too long for the page, but it may be useful here):
> 
> ......
> 
> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
> $ cc -o system_hyphen -x c - ;
> #include <stdlib.h>
> 
> int
> main(void)
> {
>     system(" -echo Hello world!");
>     exit(EXIT_SUCCESS);
> }
> 
> $ ./system_hyphen;
> Hello world!
> 
> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
> Cc: Florian Weimer <fweimer@redhat.com>
> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>

Thanks for the ping. Patch applied, but see man-pages(7)
and my small fix-up in the next commit.

Cheers,

Michael

> ---
> 
> D'oh!
> 
>  man3/system.3 | 20 ++++++++++++++++++++
>  1 file changed, 20 insertions(+)
> 
> diff --git a/man3/system.3 b/man3/system.3
> index 753d46f7d..ead35ab30 100644
> --- a/man3/system.3
> +++ b/man3/system.3
> @@ -255,6 +255,26 @@ are not executed.
>  Such risks are especially grave when using
>  .BR system ()
>  from a privileged program.
> +.SH BUGS
> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
> +If the command name starts with a hyphen,
> +.BR sh (1)
> +interprets the command name as an option,
> +and the behavior is undefined.
> +(See the
> +.B \-c
> +option to
> +.BR sh (1).)
> +To work around this problem,
> +prepend the command with a space as in the following call:
> +.PP
> +.RS 4
> +.EX
> +    system(" \-unfortunate\-command\-name");
> +.EE
> +.RE
>  .SH SEE ALSO
>  .BR sh (1),
>  .BR execve (2),
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Michael Kerrisk (man-pages)]

On 1/8/21 3:28 PM, Alejandro Colomar (man-pages) wrote:
> 
> 
> On 1/8/21 3:22 PM, Alejandro Colomar wrote:
>> man-pages bug: 211029
>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>
>> Complete workaround
> 
> Maybe a bit more readable:
> Complete workaround example

Changed.

Thanks,

Michael

> 
> 
>> (it was too long for the page, but it may be useful here):
>>
>> ......
>>
>> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
>> $ cc -o system_hyphen -x c - ;
>> #include <stdlib.h>
>>
>> int
>> main(void)
>> {
>>     system(" -echo Hello world!");
>>     exit(EXIT_SUCCESS);
>> }
>>
>> $ ./system_hyphen;
>> Hello world!
>>
>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>> Cc: Florian Weimer <fweimer@redhat.com>
>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>> ---
>>
>> D'oh!
>>
>>  man3/system.3 | 20 ++++++++++++++++++++
>>  1 file changed, 20 insertions(+)
>>
>> diff --git a/man3/system.3 b/man3/system.3
>> index 753d46f7d..ead35ab30 100644
>> --- a/man3/system.3
>> +++ b/man3/system.3
>> @@ -255,6 +255,26 @@ are not executed.
>>  Such risks are especially grave when using
>>  .BR system ()
>>  from a privileged program.
>> +.SH BUGS
>> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
>> +If the command name starts with a hyphen,
>> +.BR sh (1)
>> +interprets the command name as an option,
>> +and the behavior is undefined.
>> +(See the
>> +.B \-c
>> +option to
>> +.BR sh (1).)
>> +To work around this problem,
>> +prepend the command with a space as in the following call:
>> +.PP
>> +.RS 4
>> +.EX
>> +    system(" \-unfortunate\-command\-name");
>> +.EE
>> +.RE
>>  .SH SEE ALSO
>>  .BR sh (1),
>>  .BR execve (2),
>>
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: Ping: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Michael Kerrisk (man-pages)]

On 1/18/21 4:28 PM, Alejandro Colomar (man-pages) wrote:
> Hi Michael,
> 
> Ping!
> 
> And now I noticed a typo in the subject:
> s/hypen/hyphen/

D'oh! I missed that.

In cases like these, where there's already two amendments to the patch,
perhaps better is a new complete patch, rather than a ping :-).

Thanks,

Michael


> On 1/8/21 3:28 PM, Alejandro Colomar (man-pages) wrote:
>>
>>
>> On 1/8/21 3:22 PM, Alejandro Colomar wrote:
>>> man-pages bug: 211029
>>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>>
>>> Complete workaround
>>
>> Maybe a bit more readable:
>> Complete workaround example
>>
>>
>>> (it was too long for the page, but it may be useful here):
>>>
>>> ......
>>>
>>> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
>>> $ cc -o system_hyphen -x c - ;
>>> #include <stdlib.h>
>>>
>>> int
>>> main(void)
>>> {
>>>     system(" -echo Hello world!");
>>>     exit(EXIT_SUCCESS);
>>> }
>>>
>>> $ ./system_hyphen;
>>> Hello world!
>>>
>>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>>> Cc: Florian Weimer <fweimer@redhat.com>
>>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>>> ---
>>>
>>> D'oh!
>>>
>>>  man3/system.3 | 20 ++++++++++++++++++++
>>>  1 file changed, 20 insertions(+)
>>>
>>> diff --git a/man3/system.3 b/man3/system.3
>>> index 753d46f7d..ead35ab30 100644
>>> --- a/man3/system.3
>>> +++ b/man3/system.3
>>> @@ -255,6 +255,26 @@ are not executed.
>>>  Such risks are especially grave when using
>>>  .BR system ()
>>>  from a privileged program.
>>> +.SH BUGS
>>> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>>> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>>> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
>>> +If the command name starts with a hyphen,
>>> +.BR sh (1)
>>> +interprets the command name as an option,
>>> +and the behavior is undefined.
>>> +(See the
>>> +.B \-c
>>> +option to
>>> +.BR sh (1).)
>>> +To work around this problem,
>>> +prepend the command with a space as in the following call:
>>> +.PP
>>> +.RS 4
>>> +.EX
>>> +    system(" \-unfortunate\-command\-name");
>>> +.EE
>>> +.RE
>>>  .SH SEE ALSO
>>>  .BR sh (1),
>>>  .BR execve (2),
>>>
>>
> 
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: Ping: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar (man-pages)]

[removed some CCs]

On 1/18/21 4:37 PM, Michael Kerrisk (man-pages) wrote:
> On 1/18/21 4:28 PM, Alejandro Colomar (man-pages) wrote:
>> Hi Michael,
>>
>> Ping!
>>
>> And now I noticed a typo in the subject:
>> s/hypen/hyphen/
> 
> D'oh! I missed that.
> 
> In cases like these, where there's already two amendments to the patch,
> perhaps better is a new complete patch, rather than a ping :-).


Yup, I considered that for a moment...
Should've listened to myself :/

BTW, I don't understand why you ffixed to use .RS/.RE.

See
https://lore.kernel.org/linux-man/eaee2c6e-cbb7-94b2-f6c4-9039d184e129@gmail.com/T/

Thanks,

Alex

> 
> Thanks,
> 
> Michael
> 
> 
>> On 1/8/21 3:28 PM, Alejandro Colomar (man-pages) wrote:
>>>
>>>
>>> On 1/8/21 3:22 PM, Alejandro Colomar wrote:
>>>> man-pages bug: 211029
>>>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>>>
>>>> Complete workaround
>>>
>>> Maybe a bit more readable:
>>> Complete workaround example
>>>
>>>
>>>> (it was too long for the page, but it may be useful here):
>>>>
>>>> ......
>>>>
>>>> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
>>>> $ cc -o system_hyphen -x c - ;
>>>> #include <stdlib.h>
>>>>
>>>> int
>>>> main(void)
>>>> {
>>>>     system(" -echo Hello world!");
>>>>     exit(EXIT_SUCCESS);
>>>> }
>>>>
>>>> $ ./system_hyphen;
>>>> Hello world!
>>>>
>>>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>>>> Cc: Florian Weimer <fweimer@redhat.com>
>>>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>>>> ---
>>>>
>>>> D'oh!
>>>>
>>>>  man3/system.3 | 20 ++++++++++++++++++++
>>>>  1 file changed, 20 insertions(+)
>>>>
>>>> diff --git a/man3/system.3 b/man3/system.3
>>>> index 753d46f7d..ead35ab30 100644
>>>> --- a/man3/system.3
>>>> +++ b/man3/system.3
>>>> @@ -255,6 +255,26 @@ are not executed.
>>>>  Such risks are especially grave when using
>>>>  .BR system ()
>>>>  from a privileged program.
>>>> +.SH BUGS
>>>> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>>>> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>>>> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
>>>> +If the command name starts with a hyphen,
>>>> +.BR sh (1)
>>>> +interprets the command name as an option,
>>>> +and the behavior is undefined.
>>>> +(See the
>>>> +.B \-c
>>>> +option to
>>>> +.BR sh (1).)
>>>> +To work around this problem,
>>>> +prepend the command with a space as in the following call:
>>>> +.PP
>>>> +.RS 4
>>>> +.EX
>>>> +    system(" \-unfortunate\-command\-name");
>>>> +.EE
>>>> +.RE
>>>>  .SH SEE ALSO
>>>>  .BR sh (1),
>>>>  .BR execve (2),
>>>>
>>>
>>
>>
> 
> 


-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Re: Ping: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Michael Kerrisk (man-pages)]

Hi Alex,

On 1/18/21 4:45 PM, Alejandro Colomar (man-pages) wrote:
> [removed some CCs]
> 
> On 1/18/21 4:37 PM, Michael Kerrisk (man-pages) wrote:
>> On 1/18/21 4:28 PM, Alejandro Colomar (man-pages) wrote:
>>> Hi Michael,
>>>
>>> Ping!
>>>
>>> And now I noticed a typo in the subject:
>>> s/hypen/hyphen/
>>
>> D'oh! I missed that.
>>
>> In cases like these, where there's already two amendments to the patch,
>> perhaps better is a new complete patch, rather than a ping :-).
> 
> 
> Yup, I considered that for a moment...
> Should've listened to myself :/
> 
> BTW, I don't understand why you ffixed to use .RS/.RE.


Cause that's what we do around code blocks. See man-pages(7),
and all of the other pages :-).

The conclusion of the mail thread on this topic was that .RS/RE don't 
do correct relative indents, IIRC.

Thanks,

Michael


> See
> https://lore.kernel.org/linux-man/eaee2c6e-cbb7-94b2-f6c4-9039d184e129@gmail.com/T/
> 
> Thanks,
> 
> Alex
> 
>>
>> Thanks,
>>
>> Michael
>>
>>
>>> On 1/8/21 3:28 PM, Alejandro Colomar (man-pages) wrote:
>>>>
>>>>
>>>> On 1/8/21 3:22 PM, Alejandro Colomar wrote:
>>>>> man-pages bug: 211029
>>>>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>>>>
>>>>> Complete workaround
>>>>
>>>> Maybe a bit more readable:
>>>> Complete workaround example
>>>>
>>>>
>>>>> (it was too long for the page, but it may be useful here):
>>>>>
>>>>> ......
>>>>>
>>>>> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
>>>>> $ cc -o system_hyphen -x c - ;
>>>>> #include <stdlib.h>
>>>>>
>>>>> int
>>>>> main(void)
>>>>> {
>>>>>     system(" -echo Hello world!");
>>>>>     exit(EXIT_SUCCESS);
>>>>> }
>>>>>
>>>>> $ ./system_hyphen;
>>>>> Hello world!
>>>>>
>>>>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>>>>> Cc: Florian Weimer <fweimer@redhat.com>
>>>>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>>>>> ---
>>>>>
>>>>> D'oh!
>>>>>
>>>>>  man3/system.3 | 20 ++++++++++++++++++++
>>>>>  1 file changed, 20 insertions(+)
>>>>>
>>>>> diff --git a/man3/system.3 b/man3/system.3
>>>>> index 753d46f7d..ead35ab30 100644
>>>>> --- a/man3/system.3
>>>>> +++ b/man3/system.3
>>>>> @@ -255,6 +255,26 @@ are not executed.
>>>>>  Such risks are especially grave when using
>>>>>  .BR system ()
>>>>>  from a privileged program.
>>>>> +.SH BUGS
>>>>> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>>>>> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>>>>> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
>>>>> +If the command name starts with a hyphen,
>>>>> +.BR sh (1)
>>>>> +interprets the command name as an option,
>>>>> +and the behavior is undefined.
>>>>> +(See the
>>>>> +.B \-c
>>>>> +option to
>>>>> +.BR sh (1).)
>>>>> +To work around this problem,
>>>>> +prepend the command with a space as in the following call:
>>>>> +.PP
>>>>> +.RS 4
>>>>> +.EX
>>>>> +    system(" \-unfortunate\-command\-name");
>>>>> +.EE
>>>>> +.RE
>>>>>  .SH SEE ALSO
>>>>>  .BR sh (1),
>>>>>  .BR execve (2),
>>>>>
>>>>
>>>
>>>
>>
>>
> 
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: Ping: [PATCH v4] system.3: Document bug and workaround when the command name starts with a hypen

[Alejandro Colomar (man-pages)]

On 1/18/21 4:58 PM, Michael Kerrisk (man-pages) wrote:
> Hi Alex,
> 
> On 1/18/21 4:45 PM, Alejandro Colomar (man-pages) wrote:
>> [removed some CCs]
>>
>> On 1/18/21 4:37 PM, Michael Kerrisk (man-pages) wrote:
>>> On 1/18/21 4:28 PM, Alejandro Colomar (man-pages) wrote:
>>>> Hi Michael,
>>>>
>>>> Ping!
>>>>
>>>> And now I noticed a typo in the subject:
>>>> s/hypen/hyphen/
>>>
>>> D'oh! I missed that.
>>>
>>> In cases like these, where there's already two amendments to the patch,
>>> perhaps better is a new complete patch, rather than a ping :-).
>>
>>
>> Yup, I considered that for a moment...
>> Should've listened to myself :/
>>
>> BTW, I don't understand why you ffixed to use .RS/.RE.
> 
> 
> Cause that's what we do around code blocks. See man-pages(7),
> and all of the other pages :-).
> 
> The conclusion of the mail thread on this topic was that .RS/RE don't 
> do correct relative indents, IIRC.

Ahhh, I read the diff the other way.
I thought you changed .in -> .RS.
But you did .RS -> .in.

So forget what I said :-)

Thanks,

Alex

> 
> Thanks,
> 
> Michael
> 
> 
>> See
>> https://lore.kernel.org/linux-man/eaee2c6e-cbb7-94b2-f6c4-9039d184e129@gmail.com/T/
>>
>> Thanks,
>>
>> Alex
>>
>>>
>>> Thanks,
>>>
>>> Michael
>>>
>>>
>>>> On 1/8/21 3:28 PM, Alejandro Colomar (man-pages) wrote:
>>>>>
>>>>>
>>>>> On 1/8/21 3:22 PM, Alejandro Colomar wrote:
>>>>>> man-pages bug: 211029
>>>>>>  https://bugzilla.kernel.org/show_bug.cgi?id=211029
>>>>>>
>>>>>> Complete workaround
>>>>>
>>>>> Maybe a bit more readable:
>>>>> Complete workaround example
>>>>>
>>>>>
>>>>>> (it was too long for the page, but it may be useful here):
>>>>>>
>>>>>> ......
>>>>>>
>>>>>> $ sudo ln -s -T /usr/bin/echo /usr/bin/-echo;
>>>>>> $ cc -o system_hyphen -x c - ;
>>>>>> #include <stdlib.h>
>>>>>>
>>>>>> int
>>>>>> main(void)
>>>>>> {
>>>>>>     system(" -echo Hello world!");
>>>>>>     exit(EXIT_SUCCESS);
>>>>>> }
>>>>>>
>>>>>> $ ./system_hyphen;
>>>>>> Hello world!
>>>>>>
>>>>>> Reported-by: Ciprian Dorin Craciun <ciprian.craciun@gmail.com>
>>>>>> Cc: Florian Weimer <fweimer@redhat.com>
>>>>>> Signed-off-by: Alejandro Colomar <alx.manpages@gmail.com>
>>>>>> ---
>>>>>>
>>>>>> D'oh!
>>>>>>
>>>>>>  man3/system.3 | 20 ++++++++++++++++++++
>>>>>>  1 file changed, 20 insertions(+)
>>>>>>
>>>>>> diff --git a/man3/system.3 b/man3/system.3
>>>>>> index 753d46f7d..ead35ab30 100644
>>>>>> --- a/man3/system.3
>>>>>> +++ b/man3/system.3
>>>>>> @@ -255,6 +255,26 @@ are not executed.
>>>>>>  Such risks are especially grave when using
>>>>>>  .BR system ()
>>>>>>  from a privileged program.
>>>>>> +.SH BUGS
>>>>>> +.\" [BUG 211029](https://bugzilla.kernel.org/show_bug.cgi?id=211029)
>>>>>> +.\" [Glibc bug](https://sourceware.org/bugzilla/show_bug.cgi?id=27143)
>>>>>> +.\" [POSIX bug](https://www.austingroupbugs.net/view.php?id=1440)
>>>>>> +If the command name starts with a hyphen,
>>>>>> +.BR sh (1)
>>>>>> +interprets the command name as an option,
>>>>>> +and the behavior is undefined.
>>>>>> +(See the
>>>>>> +.B \-c
>>>>>> +option to
>>>>>> +.BR sh (1).)
>>>>>> +To work around this problem,
>>>>>> +prepend the command with a space as in the following call:
>>>>>> +.PP
>>>>>> +.RS 4
>>>>>> +.EX
>>>>>> +    system(" \-unfortunate\-command\-name");
>>>>>> +.EE
>>>>>> +.RE
>>>>>>  .SH SEE ALSO
>>>>>>  .BR sh (1),
>>>>>>  .BR execve (2),
>>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
> 
> 


-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/