mbox series

[v2,0/4] tunables and setxid programs

Message ID 20210316070608.329892-1-siddhesh@sourceware.org
Headers show
Series tunables and setxid programs | expand

Message

Siddhesh Poyarekar March 16, 2021, 7:06 a.m. UTC 
When parse_tunables tries to erase a tunable marked as SXID_ERASE for
setuid programs, it ends up setting the envvar string iterator
incorrectly, because of which it may parse the next tunable
incorrectly.  Given that currently the implementation allows malformed
and unrecognized tunables pass through, it may even allow SXID_ERASE
tunables to go through.

This change revamps the SXID_ERASE implementation so that:

- Only valid tunables are written back to the tunestr string, because
  of which children of SXID programs will only inherit a clean list of
  identified tunables that are not SXID_ERASE.

- Unrecognized tunables get scrubbed off from the environment and
  subsequently from the child environment.

- This has the side-effect that a tunable that is not identified by
  the setxid binary, will not be passed on to a non-setxid child even
  if the child could have identified that tunable.  This may break
  applications that expect this behaviour but expecting such tunables
  to cross the SXID boundary is wrong.

The setuid test for tunables has been bolstered to test different
combinations of tunable values to ensure that the behaviour is now
consistent.

Siddhesh Poyarekar (4):
  support: Add capability to fork an sgid child
  tst-env-setuid: Use support_capture_subprogram_self_sgid
  Enhance setuid-tunables test
  Fix SXID_ERASE behavior in setuid programs (BZ #27471)

 elf/Makefile                         |   2 -
 elf/dl-tunables.c                    |  56 ++++----
 elf/tst-env-setuid-tunables.c        | 118 +++++++++++++---
 elf/tst-env-setuid.c                 | 197 ++------------------------
 stdlib/tst-secure-getenv.c           | 199 +++------------------------
 support/capture_subprocess.h         |   6 +
 support/check.h                      |  12 ++
 support/subprocess.h                 |   5 +
 support/support_capture_subprocess.c | 114 +++++++++++++++
 support/support_subprocess.c         |  13 ++
 10 files changed, 304 insertions(+), 418 deletions(-)