zsh completion cache security model broken? -
this may bug or misfeature in zsh, don't know , may misunderstanding.
compinit (the function initializes completions) runs compaudit enforce security model whereby load completion functions directories in $fpath considered "secure" (owned root or me, not world-writable, etc.). warn user insecure paths , prompt either skip them or abort. that's , good.
it creates cache of results @ ~/.zcompdump. afaict, invalidated (i.e., deleted) manually.
i'm not entirely clear what's in cache, can't if big security issue. but, @ least, compinit consider cache valid if it's owned different user, thereby avoiding loading completion functions are valid current user weren't previous one.
this happening me every time use sudo -s zsh installation owned me (os x homebrew). writes incomplete completion cache. next shell start, loads busted cache , doesn't see completions.
is problem? zsh's? homebrews?
Comments
Post a Comment