lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-08 17:42:12 +03:00
Code Activity

elf: Add GLIBC_TUNABLES to unsecvars

Browse Source 
setuid/setgid process now ignores any glibc tunables, and filters out
all environment variables that might changes its behavior. This patch
also adds GLIBC_TUNABLES, so any spawned process by setuid/setgid
processes should set tunable explicitly.

Checked on x86_64-linux-gnu.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
This commit is contained in:
Adhemerval Zanella
2023-11-06 17:25:35 -03:00
parent 6c6fce572f
commit a72a4eb10b
2 changed files with 5 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
elf/tst-env-setuid-tunables.c
View File

@@ -60,45 +60,21 @@ const char *teststrings[] =
"glibc.not_valid.check=2", "glibc.not_valid.check=2",
}; };
const char *resultstrings[] =
{
"glibc.malloc.mmap_threshold=4096",
"glibc.malloc.mmap_threshold=4096",
"glibc.malloc.mmap_threshold=4096",
"glibc.malloc.perturb=0x800",
"glibc.malloc.perturb=0x800:glibc.malloc.mmap_threshold=4096",
"glibc.malloc.perturb=0x800:glibc.malloc.mmap_threshold=4096",
"glibc.malloc.mmap_threshold=4096",
"glibc.malloc.mmap_threshold=4096",
"glibc.malloc.mmap_threshold=glibc.malloc.mmap_threshold=4096",
"",
"",
"",
"",
"",
"",
"",
};
static int static int
test_child (int off) test_child (int off)
{ {
const char *val = getenv ("GLIBC_TUNABLES"); const char *val = getenv ("GLIBC_TUNABLES");
int ret = 1;
printf (" [%d] GLIBC_TUNABLES is %s\n", off, val); printf (" [%d] GLIBC_TUNABLES is %s\n", off, val);
fflush (stdout); fflush (stdout);
if (val != NULL && strcmp (val, resultstrings[off]) == 0)
return 0;
if (val != NULL) if (val != NULL)
printf (" [%d] Unexpected GLIBC_TUNABLES VALUE %s, expected %s\n", printf (" [%d] Unexpected GLIBC_TUNABLES VALUE %s\n", off, val);
off, val, resultstrings[off]);
else else
printf (" [%d] GLIBC_TUNABLES environment variable absent\n", off); ret = 0;
fflush (stdout); fflush (stdout);
return 1; return ret;
} }
static int static int

1
sysdeps/generic/unsecvars.h
View File

@@ -4,6 +4,7 @@
#define UNSECURE_ENVVARS \ #define UNSECURE_ENVVARS \
"GCONV_PATH\0" \ "GCONV_PATH\0" \
"GETCONF_DIR\0" \ "GETCONF_DIR\0" \
"GLIBC_TUNABLES\0" \
"HOSTALIASES\0" \ "HOSTALIASES\0" \
"LD_AUDIT\0" \ "LD_AUDIT\0" \
"LD_DEBUG\0" \ "LD_DEBUG\0" \