Dash as default shell

[Bruno Wolff III]

On Thu, Oct 02, 2014 at 11:59:54 -0400,
  Miloslav Trmač <mitr at redhat.com> wrote:
>
>As I said in the snipped part, anyone able to submit arbitrary input to a shell can already cause it to do arbitrary things. The parser bugs do not give the attacker anything they don’t already have, so they are not security-relevant. So we are back to the philosophical discussion about where is the vulnerability in putting untrusted data into the environment.

I think the disconnect there was that people assumed that as long as 
you controlled which environment variables (by name) were passed you 
were OK. It was assumed that the values weren't processed outside 
of what you explicitly did.

Unless the defining functions in environment values feature is disabled, 
this expectation is still broken, regardless of the parser fix. And I 
wouldn't be surprised if more issues come up in the future because of it.