This part of the document by Hans Lermen, <lermen@fgan.de> on Apr 6, 1997.
These are the hints we give you, when running dosemu on a machine that is (even temporary) connected to the internet or other machines, or that otherwise allows 'foreign' people login to your machine.
(in /etc/dosemu.conf set 'dpmi off' to disable)
It is possible to overwrite sensitive parts of the emulator code, and this makes it possible for a intruder program under DOS, who knows about dosemu interna (what is easy as you have the source) to get root access also on non dosemu processes. Because a lot of games won't work without, we allow creation of LDT-descriptor that span the whole user space.
There is a 'secure' option in /etc/dosemu.conf, that allows to turn off creation of above mentioned descritors, but those currently protect only the dosemu code and the stack, may be some diabolic person finds a way to use the (unprotected) heap in his sense of humor.
Anyway, better 'secure on' then nothing.
The 'unix.com' command (also part of dosemu) does _not_ have this security hole: before execution a separate process is forked that completely drops prililege, ... hence no danger (will no longer be disbaled by 'secure on').