public inbox for glibc-cvs@sourceware.org
help / color / mirror / Atom feed
From: Siddhesh Poyarekar <siddhesh@sourceware.org>
To: glibc-cvs@sourceware.org
Subject: [glibc/release/2.38/master] Propagate GLIBC_TUNABLES in setxid binaries
Date: Tue,  3 Oct 2023 17:06:23 +0000 (GMT)	[thread overview]
Message-ID: <20231003170623.B8B8A3858D28@sourceware.org> (raw)

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=73e3fcd1a552783e66ff1f65c5f322e2f17a81d1

commit 73e3fcd1a552783e66ff1f65c5f322e2f17a81d1
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date:   Tue Sep 19 13:25:40 2023 -0400

    Propagate GLIBC_TUNABLES in setxid binaries
    
    GLIBC_TUNABLES scrubbing happens earlier than envvar scrubbing and some
    tunables are required to propagate past setxid boundary, like their
    env_alias.  Rely on tunable scrubbing to clean out GLIBC_TUNABLES like
    before, restoring behaviour in glibc 2.37 and earlier.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit 0d5f9ea97f1b39f2a855756078771673a68497e1)

Diff:
---
 sysdeps/generic/unsecvars.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sysdeps/generic/unsecvars.h b/sysdeps/generic/unsecvars.h
index 81397fb90b..8278c50a84 100644
--- a/sysdeps/generic/unsecvars.h
+++ b/sysdeps/generic/unsecvars.h
@@ -4,7 +4,6 @@
 #define UNSECURE_ENVVARS \
   "GCONV_PATH\0"							      \
   "GETCONF_DIR\0"							      \
-  "GLIBC_TUNABLES\0"							      \
   "HOSTALIASES\0"							      \
   "LD_AUDIT\0"								      \
   "LD_DEBUG\0"								      \

                 reply	other threads:[~2023-10-03 17:06 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231003170623.B8B8A3858D28@sourceware.org \
    --to=siddhesh@sourceware.org \
    --cc=glibc-cvs@sourceware.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).