[Bug libc/2705] New: missing warn-unused-result fortify checks for setuid family

[Bug libc/2705] New: missing warn-unused-result fortify checks for setuid family

[dmueller at suse dot com]

Hi, 

there is an ongoing vixie-cron exploit that I would like to have glibc warn 
upon, because many more packages are affected. 

for details see here: 

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178431

-- 
           Summary: missing warn-unused-result fortify checks for setuid
                    family
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: dmueller at suse dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2705] missing warn-unused-result fortify checks for setuid family

[dmueller at suse dot com]

------- Additional Comments From dmueller at suse dot com  2006-05-29 13:00 -------
Created an attachment (id=1056)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=1056&action=view)
(untested) patch

this should do it, will start testing now. 

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2705] missing warn-unused-result fortify checks for setuid family

[meissner at suse dot de]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |meissner at suse dot de


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2705] missing warn-unused-result fortify checks for setuid family

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2006-05-29 16:32 -------
No, cannot be done.  There are too many places where using these functions can
be expected to work all the time and no return value must be checked.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |WONTFIX


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2705] missing warn-unused-result fortify checks for setuid family

[dmueller at suse dot com]

------- Additional Comments From dmueller at suse dot com  2006-05-29 16:49 -------
Thats exactly the point, they can not be expected to work all the time because 
of user imposed ressource limits (nproc mainly) and this leads to 
user-exploitable situations in root running daemons. 



-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|WONTFIX                     |


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2705] missing warn-unused-result fortify checks for setuid family

[dmueller at suse dot com]

------- Additional Comments From dmueller at suse dot com  2006-05-29 16:50 -------
BTW, it only is warning for -D_FORTIFY_CHECKS is defined, and which triggers 
warnings already elsewhere (for write() (but not send()!) which produces 
bazillion of most of the time useless warnings. 

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2705] missing warn-unused-result fortify checks for setuid family

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2006-05-29 19:44 -------
Stop reopening bugs.  You have no idea of the semantics is meant to be.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |WONTFIX


http://sourceware.org/bugzilla/show_bug.cgi?id=2705

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.