From 800f9aa06b64427336eb1f11469d854bf5889122 Mon Sep 17 00:00:00 2001
From: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date: Thu, 2 Feb 2017 16:15:45 +0530
Subject: Drop GLIBC_TUNABLES in setxid processes

Drop the GLIBC_TUNABLES environment variable from the environment of
setxid processes to avoid passing it on to non-setxid children.  This
prevents potentially insecure tunables in the GLIBC_TUNABLES envvar
from crossing over into a child that may use a libc that has tunables
support.

	* sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES.
---
 ChangeLog                   | 4 ++++
 sysdeps/generic/unsecvars.h | 1 +
 2 files changed, 5 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index ae1c767692..d4efa41002 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2017-02-02  Siddhesh Poyarekar  <siddhesh@sourceware.org>
+
+	* sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES.
+
 2017-01-23  Rajalakshmi Srinivasaraghavan  <raji@linux.vnet.ibm.com>
 	    Steven Munroe  <sjmunroe@us.ibm.com>
 	    Tulio Magno Quites Machado Filho  <tuliom@linux.vnet.ibm.com>
diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h
index d5b8119c9c..3e56538b51 100644
--- a/sysdeps/generic/unsecvars.h
+++ b/sysdeps/generic/unsecvars.h
@@ -4,6 +4,7 @@
 #define UNSECURE_ENVVARS \
   "GCONV_PATH\0"							      \
   "GETCONF_DIR\0"							      \
+  "GLIBC_TUNABLES\0"							      \
   "HOSTALIASES\0"							      \
   "LD_AUDIT\0"								      \
   "LD_DEBUG\0"								      \
-- 
cgit 1.4.1