compinit -U in /etc/zsh/zshrc is unfriendly to fpath users

Bug #16759 reported by Jay Berkenbilt
4
Affects Status Importance Assigned to Milestone
zsh (Ubuntu)
Fix Released
Medium
Tollef Fog Heen

Bug Description

This bug report refers to the zsh in Hoary. I don't see where to indicate that
here. I haven't checked the breezy version, but I know I'm reporting a problem
that is not in the original debian package.

I run compinit with different arguments in files called from my own .zshrc. The
Ubuntu /etc/zsh/zshrc contains the lines

autoload -U compinit
compinit

which are not present in the original debian package. With this here, this
compinit call gets called before my compinit -C -D in my own configuration
files, which results in security warnings when I run as root (since I set fpath
to include directories in my home directory) and a .zcompdump file which causes
problems when sharing a home directory across systems that have different
versions of zsh.

I believe that a call to compinit should not be in /etc/zsh/zshrc because users
should be able to call compinit with different arguments. As far as I can tell,
there is no way around this without losing the rest of /etc/zsh/zshrc (by
setting GLOBAL_RCS as needed to disable this from .zshenv).

Please consider removing these lines, leaving zshrc as in the debian package.
Alternatively, please explain why this is a good idea to have as it is. :-)

Related branches

CVE References

Revision history for this message
Matt Zimmerman (mdz) wrote :

The completion system is one of the premiere features of zsh, and we would like
to have it enabled by default for new users. If you know of a way to support
this use case, without interfering with configurations such as yours, I see no
problem adapting it.

Revision history for this message
Jay Berkenbilt (ejb) wrote :

Oh, yes. Of course. It's been so long since I switched that I forgot
completion wasn't enabled by default without a compinit call.

Would you consider accepting something like the following:

# If you don't want compinit called here, place the line
# ubuntu_skip_compinit=1
# in your .zshenv
if [[ "$ubuntu_skip_compinit" = "" ]]; then
  autoload -U compinit
  compinit
fi

Revision history for this message
Jay Berkenbilt (ejb) wrote :

I'll gladly submit a patch against the breezy version of the source package if
you'd like.

Matt Zimmerman (mdz)
Changed in zsh:
assignee: nobody → tfheen
status: Unconfirmed → Confirmed
Revision history for this message
Zefram (kcgurdkcaoed) wrote :

The way to have fancy shell behaviour enabled for new users is to put
fancy configuration files in /etc/skel. That way they go into new
users' home directories and can be modified if the user is sufficiently
sophisticated.

/etc/profile, /etc/zsh/zshrc, and other files of that ilk should almost
always be empty or non-existent. You have to remember that they're not
merely defaults: they apply to *everyone*. Don't use them.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (6.9 KiB)

This bug was fixed in the package zsh - 4.3.6-2ubuntu1

---------------
zsh (4.3.6-2ubuntu1) intrepid; urgency=low

  * Merge from debian unstable, remaining changes:
    - Makefile.in: Disable rule which runs autoconf;
                   we don't want it to run during the build.
    - debian/zshenv: Stop setting PATH, depend on new and shiny libpam-modules
                     which sets PATH for us.
    - debian/zshrc: Enable completions by default.
    - Change the maintainer address.
  * remove the patch from debian/zshenv. It does only act if $PATH is
    empty or likely to be unconfigured. If a local administrator really
    wants PATH to default to "/bin:/usr/bin", he can be expected to modify
    /etc/zshenv.
  * debian/zshrc: Enable to local user to prevent enabling completions by
    the global /etc/zshrc by setting the variable "skip_global_compinit=1"
    in his ~/.zshenv. Patch based on proposal by Jay Berkenbilt. LP: #16759

zsh (4.3.6-2) unstable; urgency=medium

  * Complete .spx files after ogg123, thanks to Markus Waldeck. closes:
    #474744.
  * Call configure with --enable-readnullcmd=pager (for when this
    becomes
  * Hardcode default readnullcmd to "pager" instead of "more". closes:
    #477722.

zsh (4.3.6-1) unstable; urgency=medium

  * New upstream version.
  * Unconditionally add zsh and zsh-static to /etc/shells in postinst,
    to ensure smooth transition to lenny+1. closes: #473652.

zsh (4.3.5-8) unstable; urgency=low

  * Avoid removal/readdition of shells in /etc/shells on package
    upgrades, in order to preserve local changes.
    closes: #473199, #473200.
  * Switch build dependency to libcap2-dev.

zsh (4.3.5-7) unstable; urgency=medium

  * Complete packages for aptitude why and why-not. closes: #472193.
  * Make git completion cope with user configs setting colors to
    "always". closes: #469588.
  * Move doc-base section to 'Shells' in accordance with doc-base 0.8.10
    policy.
  * Add PDF format to the doc-base control file.

zsh (4.3.5-6) unstable; urgency=low

  * Completion for calendar.
  * Update git completion (bisect skip and run, copying with the
    situation wherein git is an alias to a wrapper).

zsh (4.3.5-5) unstable; urgency=medium

  * Fix completion of rsync -e ssh remote pathnames containing spaces.
    closes: #468654.

zsh (4.3.5-4) unstable; urgency=low

  * ZW#24611: fix ${+array[...]} with empty range matches.
    closes: #466655.

zsh (4.3.5-3) unstable; urgency=medium

  * ZU#12632: fix bug unexporting special parameter after
    "SPECIAL=stuff funccall". closes: #317773.
  * Drop --print-gnu-build-architecture from dpkg completion.
    closes: #466904.
  * Patch documentation to reflect that global rc files are
    in /etc/zsh. closes: #466596.
  * Add Vcs-Git and Vcs-Browser control headers.

zsh (4.3.5-2) unstable; urgency=low

  * Add Homepage control field.
  * Apply patches from A Costa to fix documentation typos.
    closes: #463613, #463614, #463615, #463616, #463617, #463619,
    #463620, #463621, #463622.
  * Drop debconf-related dependencies and all vestiges of the
    debconf note. closes: #463916.
  * Remove conffile movement code from postinst.

zsh ...

Read more...

Changed in zsh:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.