diff options
| author | Siddhesh Poyarekar <siddhesh@sourceware.org> | 2017-02-02 16:15:45 +0530 |
|---|---|---|
| committer | Mike Frysinger <vapier@gentoo.org> | 2017-02-09 00:11:46 -0500 |
| commit | a0c7c4ebeea470eb00dcd1c8200a902a00b5470b (patch) | |
| tree | 544faf9c35c372fd1140a8a81ec2bd5c2c8b2266 | |
| parent | 4adce1bf311f30d584a97a25d34a2e77fa9a0bab (diff) | |
| download | glibc-a0c7c4ebeea470eb00dcd1c8200a902a00b5470b.tar glibc-a0c7c4ebeea470eb00dcd1c8200a902a00b5470b.tar.gz glibc-a0c7c4ebeea470eb00dcd1c8200a902a00b5470b.tar.bz2 glibc-a0c7c4ebeea470eb00dcd1c8200a902a00b5470b.zip | |
Drop GLIBC_TUNABLES in setxid processes
Drop the GLIBC_TUNABLES environment variable from the environment of
setxid processes to avoid passing it on to non-setxid children. This
prevents potentially insecure tunables in the GLIBC_TUNABLES envvar
from crossing over into a child that may use a libc that has tunables
support.
* sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES.
(cherry picked from commit 537a06fbdeb9a6c2184c745c15ef3346681f5eeb)
| -rw-r--r-- | sysdeps/generic/unsecvars.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h index d5b8119c9c..3e56538b51 100644 --- a/sysdeps/generic/unsecvars.h +++ b/sysdeps/generic/unsecvars.h @@ -4,6 +4,7 @@ #define UNSECURE_ENVVARS \ "GCONV_PATH\0" \ "GETCONF_DIR\0" \ + "GLIBC_TUNABLES\0" \ "HOSTALIASES\0" \ "LD_AUDIT\0" \ "LD_DEBUG\0" \ |