OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: glibc env. vars. (again)
From: Pavel Kankovsky (peakargo.troja.mff.cuni.cz)
Date: Wed May 24 2000 - 17:15:25 CDT


On Wed, 24 May 2000, Matthew Kirkwood wrote:

> > __libc_start_main() (sysdeps/generic/libc-start.c)
>
> Does this before or after C++ constructors (or equivalents)
> are called?

As far as I can tell, glibc _init (calling __libc_start_main) is run
before the program's _init (calling global C++ constructors).

> More controversially, I'd also like MALLOC_CHECK_, MALLOC_TRACE,
> and pals to be removed from the environment to avoid non-suid
> children inheriting it.

A setuid program neglecting to sanitize the environment (i.e. to filter
out any variable that is not allowed explicitly) before running other
programs is broken.

--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."