Give groff the -S (safer mode) option. This is a paranoia mode that prevents

the execution of possibly dangerous macros like open, opena, write, pos, and
sy which could be abused by a malicious man page; deraadt@ ok

1 files changed, 2 insertions, 2 deletions

diff --git a/gnu/usr.bin/groff/nroff/nroff.sh b/gnu/usr.bin/groff/nroff/nroff.sh
index 7933025561e..080f04bde82 100644
--- a/gnu/usr.bin/groff/nroff/nroff.sh
+++ b/gnu/usr.bin/groff/nroff/nroff.sh
@@ -24,7 +24,7 @@ do
 		echo "$prog: option $1 requires an argument" >&2
 		exit 1
 		;;
-	-i|-[mrno]*)
+	-i|-S|-[mrno]*)
 		opts="$opts $1";
 		;;
 
@@ -58,4 +58,4 @@ done
 
 # This shell script is intended for use with man, so warnings are
 # probably not wanted.  Also load nroff-style character definitions.
-exec groff -Wall -mtty-char $T $opts ${1+"$@"}
+exec groff -S -Wall -mtty-char $T $opts ${1+"$@"}