aboutsummaryrefslogtreecommitdiff
path: root/elf
diff options
context:
space:
mode:
authorSiddhesh Poyarekar <siddhesh@sourceware.org>2017-02-02 15:48:06 +0530
committerSiddhesh Poyarekar <siddhesh@sourceware.org>2017-02-02 15:50:24 +0530
commited8d5ffd0a14e84298a15ae2ec9b799010166b28 (patch)
tree6cabcdeec197523b72b6e88a1910cd97176f766d /elf
parent8b9e9c3c0bae497ad5e2d0ae2f333f62feddcc12 (diff)
downloadglibc-ed8d5ffd0a14e84298a15ae2ec9b799010166b28.zip
glibc-ed8d5ffd0a14e84298a15ae2ec9b799010166b28.tar.gz
glibc-ed8d5ffd0a14e84298a15ae2ec9b799010166b28.tar.bz2
Drop GLIBC_TUNABLES for setxid programs when tunables is disabled (bz #21073)
A setxid program that uses a glibc with tunables disabled may pass on GLIBC_TUNABLES as is to its child processes. If the child process ends up using a different glibc that has tunables enabled, it will end up getting access to unsafe tunables. To fix this, remove GLIBC_TUNABLES from the environment for setxid process. * sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES. * elf/tst-env-setuid-tunables.c (test_child_tunables)[!HAVE_TUNABLES]: Verify that GLIBC_TUNABLES is removed in a setgid process.
Diffstat (limited to 'elf')
-rw-r--r--elf/tst-env-setuid-tunables.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/elf/tst-env-setuid-tunables.c b/elf/tst-env-setuid-tunables.c
index a563f69..a5f0a81 100644
--- a/elf/tst-env-setuid-tunables.c
+++ b/elf/tst-env-setuid-tunables.c
@@ -36,6 +36,7 @@ test_child_tunables (void)
{
const char *val = getenv ("GLIBC_TUNABLES");
+#if HAVE_TUNABLES
if (val != NULL && strcmp (val, CHILD_VALSTRING_VALUE) == 0)
return 0;
@@ -43,6 +44,14 @@ test_child_tunables (void)
printf ("Unexpected GLIBC_TUNABLES VALUE %s\n", val);
return 1;
+#else
+ if (val != NULL)
+ {
+ printf ("GLIBC_TUNABLES not cleared\n");
+ return 1;
+ }
+ return 0;
+#endif
}
static int