Attachment 67803 Details for Bug 52202 – Use-__secure_getenv-if-available.patch

[patch] Use-__secure_getenv-if-available.patch

0001-hardening-Use-__secure_getenv-if-available.patch (text/plain), 1.88 KB, created by Colin Walters on 2012-09-28 01:42:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Colin Walters

Created: 2012-09-28 01:42:55 UTC

Size: 1.88 KB

patch

obsolete

>From 984c04df01f499249f737727f089cd67f2504f7d Mon Sep 17 00:00:00 2001
>From: Colin Walters <walters@verbum.org>
>Date: Thu, 27 Sep 2012 21:29:29 -0400
>Subject: [PATCH 1/2] hardening: Use __secure_getenv if available
>
>This helps us in the case where we were executed via filesystem
>capabilities or a SELinux domain transition, not necessarily a plain
>old setuid binary.
>---
> configure.ac        | 2 +-
> dbus/dbus-sysdeps.c | 6 ++++++
> 2 files changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/configure.ac b/configure.ac
>index b0f2ec2..4fdf82b 100644
>--- a/configure.ac
>+++ b/configure.ac
>@@ -595,7 +595,7 @@ AC_DEFINE_UNQUOTED([DBUS_USE_SYNC], [$have_sync], [Use the gcc __sync extension]
> AC_SEARCH_LIBS(socket,[socket network])
> AC_CHECK_FUNC(gethostbyname,,[AC_CHECK_LIB(nsl,gethostbyname)])
> 
>-AC_CHECK_FUNCS(vsnprintf vasprintf nanosleep usleep setenv clearenv unsetenv socketpair getgrouplist fpathconf setrlimit poll setlocale localeconv strtoll strtoull issetugid getresuid)
>+AC_CHECK_FUNCS(vsnprintf vasprintf nanosleep usleep setenv clearenv unsetenv socketpair getgrouplist fpathconf setrlimit poll setlocale localeconv strtoll strtoull issetugid getresuid secure_getenv __secure_getenv )
> 
> AC_CHECK_HEADERS([syslog.h])
> if test "x$ac_cv_header_syslog_h" = "xyes"; then
>diff --git a/dbus/dbus-sysdeps.c b/dbus/dbus-sysdeps.c
>index 04fb8d7..fac1b79 100644
>--- a/dbus/dbus-sysdeps.c
>+++ b/dbus/dbus-sysdeps.c
>@@ -182,12 +182,18 @@ _dbus_setenv (const char *varname,
> const char*
> _dbus_getenv (const char *varname)
> {  
>+#ifdef HAVE___SECURE_GETENV
>+  return __secure_getenv (varname);
>+#elif HAVE_SECURE_GETENV
>+  return secure_getenv (varname);
>+#else
>   /* Don't respect any environment variables if the current process is
>    * setuid.  This is the equivalent of glibc's __secure_getenv().
>    */
>   if (_dbus_check_setuid ())
>     return NULL;
>   return getenv (varname);
>+#endif
> }
> 
> /**
>-- 
>1.7.11.4
>

Actions: View | Splinter Review

Attachments on bug 52202: 67345 | 67803 | 67804 | 67810 | 67977

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.