diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2021-04-26 11:15:55 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-04-26 22:51:14 +0200 |
| commit | 7794ca552e59f8ba59a566496291e3255b4a0325 (patch) | |
| tree | 5acd0eaa02b4b6ce333eab120295a0b58dc4d6dc | |
| parent | 9fc284427c96cc2e89c51f79080f16c44a10594d (diff) | |
| download | curl-bagder/setuid-security.tar.gz | |
libcurl-security.3: be careful of setuidbagder/setuid-security
Reported-by: Harry Sintonen
| -rw-r--r-- | docs/libcurl/libcurl-security.3 | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/docs/libcurl/libcurl-security.3 b/docs/libcurl/libcurl-security.3 index b4907ac22..d4f9464e8 100644 --- a/docs/libcurl/libcurl-security.3 +++ b/docs/libcurl/libcurl-security.3 @@ -371,3 +371,15 @@ sensitive data. To avoid this problem, you must of course use your common sense. Often, you can just edit out the sensitive data or just search/replace your true information with faked data. +.SH "Setuid applications using libcurl" +libcurl-using applications that set the 'setuid' bit to run with elevated or +modified rights also implicitly give that extra suport power to libcurl and +this should only be done after very careful considerations. + +Giving setuid powers to the appliction means that libcurl can save files using +those new rights (if for example the `SSLKEYLOGFILE` environment variable is +set). Also: if the application wants these powers to read or manage secrets +that the user is otherwise not able to view (like credentials for a login +etc), it should be noted that libcurl still might understand proxy environment +variables that allow the user to redirect libcurl operations to use a proxy +controlled by the user. |