This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[Patch] Document __secure_getenv
- From: Florian Weimer <fweimer at redhat dot com>
- To: libc-alpha at sourceware dot org
- Date: Wed, 11 Jul 2012 15:38:46 +0200
- Subject: [Patch] Document __secure_getenv
A recent discussion on oss-security
<http://thread.gmane.org/gmane.comp.security.oss.general/7960> revealed
that __secure_getenv could use some promotion. What about this patch
documenting it?
--
Florian Weimer / Red Hat Product Security Team
2012-07-11 Florian Weimer <fweimer@redhat.com>
* manual/startup.texi (Environment Access): Document
__secure_getenv.
diff --git a/manual/startup.texi b/manual/startup.texi
index 0420e93..73c6624 100644
--- a/manual/startup.texi
+++ b/manual/startup.texi
@@ -310,11 +310,15 @@ character, since this is assumed to terminate the string.
The value of an environment variable can be accessed with the
@code{getenv} function. This is declared in the header file
-@file{stdlib.h}. Modifications of enviroment variables are not
-allowed in Multi-threaded programs. The @code{getenv} function
-can be safely used in multi-threaded programs
+@file{stdlib.h}.
@pindex stdlib.h
+Libraries should use @code{__secure_getenv} instead of @code{getenv},
+so that they do not accidentally use entrusted environment variables.
+Modifications of environment variables are not allowed in
+multi-threaded programs. The @code{getenv} function can be safely
+used in multi-threaded programs.
+
@comment stdlib.h
@comment ISO
@deftypefun {char *} getenv (const char *@var{name})
@@ -326,6 +330,18 @@ environment variable @var{name} is not defined, the value is a null
pointer.
@end deftypefun
+@comment stdlib.h
+@comment GNU
+@deftypefun {char *} __secure_getenv (const char *@var{name})
+This function is similar to @code{getenv}, but it returns a null
+pointer if the environment is untrusted. This happens when the
+program file has SUID or SGID bits set. General-purpose libraries
+should always prefer this function over @code{getenv}, to avoid
+vulnerabilities if the library is referenced from a SUID/SGID program.
+
+This function is a GNU extension.
+@end deftypefun
+
@comment stdlib.h
@comment SVID