aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog5
-rw-r--r--elf/tst-env-setuid-tunables.c9
-rw-r--r--sysdeps/generic/unsecvars.h7
3 files changed, 21 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index aed8764272..a210e631f4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
2017-02-02 Siddhesh Poyarekar <siddhesh@sourceware.org>
+ * sysdeps/generic/unsecvars.h: Add GLIBC_TUNABLES.
+ * elf/tst-env-setuid-tunables.c
+ (test_child_tunables)[!HAVE_TUNABLES]: Verify that
+ GLIBC_TUNABLES is removed in a setgid process.
+
[BZ #21073]
* elf/dl-tunable-types.h (tunable_seclevel_t): New enum.
* elf/dl-tunables.c (tunables_strdup): Remove.
diff --git a/elf/tst-env-setuid-tunables.c b/elf/tst-env-setuid-tunables.c
index a563f69972..a5f0a81ef3 100644
--- a/elf/tst-env-setuid-tunables.c
+++ b/elf/tst-env-setuid-tunables.c
@@ -36,6 +36,7 @@ test_child_tunables (void)
{
const char *val = getenv ("GLIBC_TUNABLES");
+#if HAVE_TUNABLES
if (val != NULL && strcmp (val, CHILD_VALSTRING_VALUE) == 0)
return 0;
@@ -43,6 +44,14 @@ test_child_tunables (void)
printf ("Unexpected GLIBC_TUNABLES VALUE %s\n", val);
return 1;
+#else
+ if (val != NULL)
+ {
+ printf ("GLIBC_TUNABLES not cleared\n");
+ return 1;
+ }
+ return 0;
+#endif
}
static int
diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h
index d5b8119c9c..a74083786e 100644
--- a/sysdeps/generic/unsecvars.h
+++ b/sysdeps/generic/unsecvars.h
@@ -1,9 +1,16 @@
+#if !HAVE_TUNABLES
+# define GLIBC_TUNABLES_ENVVAR "GLIBC_TUNABLES\0"
+#else
+# define GLIBC_TUNABLES_ENVVAR
+#endif
+
/* Environment variable to be removed for SUID programs. The names are
all stuffed in a single string which means they have to be terminated
with a '\0' explicitly. */
#define UNSECURE_ENVVARS \
"GCONV_PATH\0" \
"GETCONF_DIR\0" \
+ GLIBC_TUNABLES_ENVVAR \
"HOSTALIASES\0" \
"LD_AUDIT\0" \
"LD_DEBUG\0" \