From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-users-return-17187-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 16790 invoked by alias); 2 Aug 2012 09:39:21 -0000
Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Users List <zsh-users.zsh.org>
List-Post: <mailto:zsh-users@zsh.org>
List-Help: <mailto:zsh-users-help@zsh.org>
X-Seq: 17187
Received: (qmail 5711 invoked from network); 2 Aug 2012 09:39:20 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-1.6 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED,
	DKIM_SIGNED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED,RCVD_IN_DNSWL_LOW,
	T_DKIM_INVALID autolearn=no version=3.3.2
Received-SPF: pass (ns1.primenet.com.au: SPF record at _spf.google.com designates 74.125.83.43 as permitted sender)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=message-id:date:from:user-agent:mime-version:to:subject
         :content-type:content-transfer-encoding;
        bh=hSfLGvwwD02VlW9gceVsuadtcADjVqJAXDicQ9E71pU=;
        b=AEW2qPeJnLJvM6yqgYtI4r/+a1YYslfuuc0yujdZjFhbtLPQQBkLmXMSM141niqhUo
         7gw8O7OZs0COs4uUhwwoy7lrEEAZ9a4PEupOEYyxz/lTf0giyTvosVxah7hExW40tNYT
         HwO7X2GC49nkUwK/RwhnKMtKKWw8/1JNUSmwUtDAwKdLuytDrTv0QX5xfzmi8iolmVp3
         VSXP+R26QD2PQVdJQwew/AoSJD5TsH/XuCBqrOopm8jRy9EJ02LDUyLJbD+GpkBSWf65
         soH+UFC+YLT8RtP6kZVXYDx++QGMfI7F5sIukW+iPLO1OVP8L8jCBv3WCgxYgZXn+qeM
         2VFw==
Message-ID: <501A4499.2020607@gmail.com>
Date: Thu, 02 Aug 2012 11:12:57 +0200
From: Piotr Karbowski <piotr.karbowski@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:14.0) Gecko/20120721 Thunderbird/14.0
MIME-Version: 1.0
To: Zsh Users <zsh-users@zsh.org>
Subject: Zsh doing weird symlinks /pid-*/*
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hi,

Recently I put a zsh on a box with grsecurity's RBAC enabled and 
noticed, that zsh trying to create a weird symlink like 
/pid-2031/host-localhost, whats is the reason to do so?

(root:U:/bin/zsh) denied symlink from /pid-2031/host-localhost to 
/root/.zsh_history.LOCK by /bin/zsh[zsh:2031] uid/euid:0/0 gid/egid:0/0, 
parent /usr/sbin/sshd[sshd:2027] uid/euid:0/0 gid/egid:0/0

-- Piotr.