The package auto-pst-pdf.sty needs shell-escape to run, but shell escape is known to be seriously unsafe. Is there a possibility to tell auto-pst-pdf.sty to use restricted-shell-escape instead? I'm working on Linux Mint KDE 15 and I'm relatively new both to Linux and TeX, so be prepared for stupid questions on you answers.
There's no real difference in how restricted and unrestricted shell-escape work as far as calling the operating system is concerned.
The unrestricted shell-escape is usually enabled, but it allows running only programs listed in a special variable set in
texmf.cnf; currently the list is
shell_escape_commands = bibtex,bibtex8,kpsewhich,makeindex,mpost,repstopdf,
The restricted shell escape does not create a sandbox; the listed program are trusted not to be able to make uncontrolled reads and writes: they can only write in the current directory or below it, for instance. But in the end, the same system call as with the unrestricted shell-escape is performed.
You could add
gs to the list, which is necessary for
auto-pst-pdf to work, but this would open the same security problems as running the program with
The system calls generated by
auto-pst-pdf are equivalent to running the file through
latex + dvips + ps2pdf
so they should be safe. If other code in your document triggers system calls, then
--shell-escape could be dangerous. Documents obtained from trusted sources (in particular written by you) shouldn't be risky. No package relying on
--shell-escape has, up to my knowledge, created problems. Of course there's always the possibility of receiving malicious code from untrusted sources.