diff options
| author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2017-02-02 16:15:45 +0530 |
|---|---|---|
| committer | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2017-02-02 16:18:15 +0530 |
| commit | 800f9aa06b64427336eb1f11469d854bf5889122 (patch) | |
| tree | a07139ad8ae0b32406889cf13e6d27198b4ae545 | |
| parent | da9f68f2b9f653a49d0d0c6148d4649dc9ad7fd6 (diff) | |
| download | glibc-800f9aa06b64427336eb1f11469d854bf5889122.tar.gz | |
Drop GLIBC_TUNABLES in setxid processes
Drop the GLIBC_TUNABLES environment variable from the environment of
setxid processes to avoid passing it on to non-setxid children. This
prevents potentially insecure tunables in the GLIBC_TUNABLES envvar
from crossing over into a child that may use a libc that has tunables
support.
* sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES.
| -rw-r--r-- | ChangeLog | 4 | ||||
| -rw-r--r-- | sysdeps/generic/unsecvars.h | 1 |
2 files changed, 5 insertions, 0 deletions
@@ -1,3 +1,7 @@ +2017-02-02 Siddhesh Poyarekar <siddhesh@sourceware.org> + + * sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES. + 2017-01-23 Rajalakshmi Srinivasaraghavan <raji@linux.vnet.ibm.com> Steven Munroe <sjmunroe@us.ibm.com> Tulio Magno Quites Machado Filho <tuliom@linux.vnet.ibm.com> diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h index d5b8119c9c..3e56538b51 100644 --- a/sysdeps/generic/unsecvars.h +++ b/sysdeps/generic/unsecvars.h @@ -4,6 +4,7 @@ #define UNSECURE_ENVVARS \ "GCONV_PATH\0" \ "GETCONF_DIR\0" \ + "GLIBC_TUNABLES\0" \ "HOSTALIASES\0" \ "LD_AUDIT\0" \ "LD_DEBUG\0" \ |