From 8ced672d2439f2b60d1c47522456fe01790e0299 Mon Sep 17 00:00:00 2001 From: "Markus F.X.J. Oberhumer" Date: Thu, 3 Dec 2020 02:10:05 +0100 Subject: [PATCH] docs: add a note about security considerations. --- NEWS | 1 + README | 11 +++++++++++ doc/upx.pod | 11 +++++++++++ 3 files changed, 23 insertions(+) diff --git a/NEWS b/NEWS index d41ceaad..1da64fad 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ User visible changes for UPX Changes in 4.0.0 (XX XXX 2020): * Switch to semantic versioning + * SECURITY NOTES: emphasize the security context in the docs * bug fixes - see https://github.com/upx/upx/milestone/6 Changes in 3.96 (23 Jan 2020): diff --git a/README b/README index cf912e6c..b21fdfd0 100644 --- a/README +++ b/README @@ -52,6 +52,17 @@ http://compression.ca/ . UPX aims to be Commercial Quality Freeware. +SECURITY CONTEXT +================ + +IMPORTANT NOTE: UPX inherits the security context of any files it handles. + +This means that packing, unpacking, or even testing or listing a file requires +the same security considerations as acutally executing the file. + +Use UPX on trusted files only! + + SHORT DOCUMENTATION =================== diff --git a/doc/upx.pod b/doc/upx.pod index e09f2a38..b0b6a4fd 100644 --- a/doc/upx.pod +++ b/doc/upx.pod @@ -44,6 +44,17 @@ Please report all problems or suggestions to the authors. Thanks. +=head1 SECURITY CONTEXT + +IMPORTANT NOTE: B inherits the security context of any files it handles. + +This means that packing, unpacking, or even testing or listing a file requires +the same security considerations as acutally executing the file. + +Use B on trusted files only! + + + =head1 DESCRIPTION B is a versatile executable packer with the following features: