[tex-k] secure mode of dvips should be default

[Stefan Ulrich]

Thomas Esser <te@informatik.uni-hannover.de> writes:

> Even better would be to use libgz / libbz2 for decompression. No fork,
> no security problem.

Good idea; we could have an autoconf check whether libgz is
installed, and fallback to calling the gunzip/... executables
instead. I've submitted this as a feature request for xdvik to 
http://sourceforge.net/tracker/?group_id=23164

As for the suggestion for 3 security levels: I think that
handling .gz files automagically probably makes level 2 (allow
only execution of `specific' shell commands) unneeded.

But then we'd also need to update some documentation: Currenlty
epslatex.ps and grfguide.ps list uncompression via shell escapes
as (the only) example for using \DeclareGraphicsRule ...

-- 
Stefan Ulrich