RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 22:18:12 +00:00
Code Issues Activity Actions

LibC: Don't honor LIBC_* malloc debugging flags in AT_SECURE context

Browse source 
Just ignore all these environment flags if the AT_SECURE flag is set in
the program's auxiliary vector.

This prevents a user from tricking set-uid programs into dumping debug
information via environment flags.
This commit is contained in:
Andreas Kling 2021-01-31 14:31:13 +01:00
parent 9984201634
commit fc4eae87f8
3 changed files with 35 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

28
Userland/Libraries/LibC/stdlib.cpp
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
* Copyright (c) 2018-2021, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@ -31,6 +31,7 @@
#include <AK/Types.h>
#include <AK/Utf8View.h>
#include <Kernel/API/Syscall.h>
#include <LibELF/AuxiliaryVector.h>
#include <alloca.h>
#include <assert.h>
#include <ctype.h>
@ -195,11 +196,27 @@ inline int generate_unique_filename(char* pattern, Callback callback)
extern "C" {
long getauxval(long type)
{
errno = 0;
char** env;
for (env = environ; *env; ++env) {
}
auxv_t* auxvp = (auxv_t*)++env;
for (; auxvp->a_type != AT_NULL; ++auxvp) {
if (auxvp->a_type == type)
return auxvp->a_un.a_val;
}
errno = ENOENT;
return 0;
}
void exit(int status)
{
__cxa_finalize(nullptr);
if (getenv("LIBC_DUMP_MALLOC_STATS"))
if (secure_getenv("LIBC_DUMP_MALLOC_STATS"))
serenity_dump_malloc_stats();
extern void _fini();
@ -256,6 +273,13 @@ char* getenv(const char* name)
return nullptr;
}
char* secure_getenv(const char* name)
{
if (getauxval(AT_SECURE))
return nullptr;
return getenv(name);
}
int unsetenv(const char* name)
{
auto new_var_len = strlen(name);