diff options
| author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2017-02-02 16:15:45 +0530 |
|---|---|---|
| committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2017-02-02 16:15:45 +0530 |
| commit | 537a06fbdeb9a6c2184c745c15ef3346681f5eeb (patch) | |
| tree | cef4cef218fc81ec5c9d79069ddae58a151b2efe | |
| parent | 2762a7145bba9681b30ed5d4aed0c5d1df4329c8 (diff) | |
| download | glibc-537a06fbdeb9a6c2184c745c15ef3346681f5eeb.tar.gz glibc-537a06fbdeb9a6c2184c745c15ef3346681f5eeb.tar.xz glibc-537a06fbdeb9a6c2184c745c15ef3346681f5eeb.zip | |
Drop GLIBC_TUNABLES in setxid processes
Drop the GLIBC_TUNABLES environment variable from the environment of setxid processes to avoid passing it on to non-setxid children. This prevents potentially insecure tunables in the GLIBC_TUNABLES envvar from crossing over into a child that may use a libc that has tunables support. * sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES.
| -rw-r--r-- | ChangeLog | 4 | ||||
| -rw-r--r-- | sysdeps/generic/unsecvars.h | 1 |
2 files changed, 5 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index 61d02b572e..32af8098b7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +2017-02-02 Siddhesh Poyarekar <siddhesh@sourceware.org> + + * sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES. + 2017-01-23 Rajalakshmi Srinivasaraghavan <raji@linux.vnet.ibm.com> Steven Munroe <sjmunroe@us.ibm.com> Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com> diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h index d5b8119c9c..3e56538b51 100644 --- a/sysdeps/generic/unsecvars.h +++ b/sysdeps/generic/unsecvars.h @@ -4,6 +4,7 @@ #define UNSECURE_ENVVARS \ "GCONV_PATH\0" \ "GETCONF_DIR\0" \ + "GLIBC_TUNABLES\0" \ "HOSTALIASES\0" \ "LD_AUDIT\0" \ "LD_DEBUG\0" \ |