3:31 a.m.
repo: git://git.gitano.org.uk/personal/richardipsum/supple.git
branch: richardipsum/clearenv
HEAD: a18b40facef388bb94b3c22ee908e65cbbcdcce6
Hi,
I came across Secure Programming HOWTO: Environment Variables[1],
and thought that maybe we should just clear the whole environment,
I've tested this on Nix and it all still seems to work.
Setting environ directly maybe isn't the cleanest but it's probably
the most portable I guess.
Thanks,
Richard
[1]:
https://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/environmen...
Richard Ipsum (1):
security: clear environment
src/wrapper.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--
2.11.0
3:31 a.m.
New subject: [PATCH 1/1] security: clear environment
Motivation:
https://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/environmen...
---
src/wrapper.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/src/wrapper.c b/src/wrapper.c
index a8a33da..ff2df91 100644
--- a/src/wrapper.c
+++ b/src/wrapper.c
@@ -60,18 +60,17 @@ main(int argc, char **argv)
prot_args parg;
lua_State *L;
int success;
+ extern char **environ;
/* Perform pre-lua-interpreter initialisation */
#if defined BAKE_SUPPLE_PATHS
+ environ = NULL; /* security: clear environment */
setenv("LUA_PATH", SUPPLE_LUA_PATH, 1);
setenv("LUA_CPATH", SUPPLE_LUA_CPATH, 1);
- unsetenv("SUPPLE_MKDTEMP");
- unsetenv("LUA_INIT");
#elif !defined TESTING_SUPPLE
- unsetenv("LUA_PATH");
- unsetenv("LUA_CPATH");
- unsetenv("SUPPLE_MKDTEMP");
- unsetenv("LUA_INIT");
+ environ = NULL; /* security: clear environment */
+#else
+ (void)(environ); /* unused */
#endif
L = luaL_newstate();
--
2.11.0
4:01 a.m.
New subject: [PATCH 1/1] security: clear environment
On Sun, Jul 30, 2017 at 19:31:17 +0100, Richard Ipsum wrote:
+ extern char **environ;
Should this not be #include'd from unistd.h ?
Otherwise looks plausible.
D.
--
Daniel Silverstone http://www.digital-scurf.org/
PGP mail accepted and encouraged. Key Id: 3CCE BABE 206C 3B69
5:39 a.m.
New subject: [PATCH 1/1] security: clear environment
On Sun, Jul 30, 2017 at 03:01:20PM -0400, Daniel Silverstone wrote:
On Sun, Jul 30, 2017 at 19:31:17 +0100, Richard Ipsum wrote:
> + extern char **environ;
Should this not be #include'd from unistd.h ?
I think that's one way to do it, but I don't know that it's as portable.
My man page says it's only defined in unistd.h if _GNU_SOURCE is defined.
Where as, as far as I can tell, the global variable `environ` is defined
by POSIX.
Ah, and now my new signature is coincidentally ironic... how like life >.>
--
Life is too short for POSIX compliance
6:11 a.m.
New subject: [PATCH 1/1] security: clear environment
On Sun, Jul 30, 2017 at 21:39:47 +0100, Richard Ipsum wrote:
On Sun, Jul 30, 2017 at 03:01:20PM -0400, Daniel Silverstone wrote:
> On Sun, Jul 30, 2017 at 19:31:17 +0100, Richard Ipsum wrote:
> > + extern char **environ;
>
> Should this not be #include'd from unistd.h ?
I think that's one way to do it, but I don't know that it's as portable.
My man page says it's only defined in unistd.h if _GNU_SOURCE is defined.
Where as, as far as I can tell, the global variable `environ` is defined
by POSIX.
Interesting...
/* NULL-terminated array of "NAME=VALUE" environment variables. */
extern char **__environ;
#ifdef __USE_GNU
extern char **environ;
#endif
I wonder if that's purely glibc or something else too.
*rummages for musl source*
That also guards it, with _GNU_SOURCE
Interesting.
I wonder if there's something we could do, perhaps by means of execve to pass
an empty/sanitised environment in... I'm not comfortable with the extern
char** esp. since unistd.h on FreeBSD seems to lack it entirely, and while
supple has Linux specific bits, I'd like it to be portable if at all possible.
Perhaps we might capture the incoming environment by dint of the 3 argument
main function? Then we could explicitly unset everything from there. I shall
have a quick hack and see what I think...
Ah, and now my new signature is coincidentally ironic... how like
life >.>
--
Life is too short for POSIX compliance
Sweet irony :-)
D.
--
Daniel Silverstone http://www.digital-scurf.org/
PGP mail accepted and encouraged. Key Id: 3CCE BABE 206C 3B69
6:15 a.m.
New subject: [PATCH 1/1] security: clear environment
On Sun, Jul 30, 2017 at 17:11:47 -0400, Daniel Silverstone wrote:
I wonder if there's something we could do, perhaps by means of
execve to pass
an empty/sanitised environment in... I'm not comfortable with the extern
char** esp. since unistd.h on FreeBSD seems to lack it entirely, and while
supple has Linux specific bits, I'd like it to be portable if at all possible.
Nope, I can't find anything cleaner, and FreeBSD's manpages suggest that
the extern ought to work too. Bleh.
Merging...
--
Daniel Silverstone http://www.digital-scurf.org/
PGP mail accepted and encouraged. Key Id: 3CCE BABE 206C 3B69
6:45 a.m.
New subject: [PATCH 1/1] security: clear environment
On Sun, Jul 30, 2017 at 05:15:55PM -0400, Daniel Silverstone wrote:
On Sun, Jul 30, 2017 at 17:11:47 -0400, Daniel Silverstone wrote:
> I wonder if there's something we could do, perhaps by means of execve to pass
> an empty/sanitised environment in... I'm not comfortable with the extern
> char** esp. since unistd.h on FreeBSD seems to lack it entirely, and while
> supple has Linux specific bits, I'd like it to be portable if at all possible.
Nope, I can't find anything cleaner, and FreeBSD's manpages suggest that
the extern ought to work too. Bleh.
Merging...
Sorry!
We could as you say wrap the wrapper, and pass an empty environment... *shrug*
--
Life is too short for POSIX compliance
6:58 a.m.
New subject: [PATCH 1/1] security: clear environment
On Sun, Jul 30, 2017 at 22:45:30 +0100, Richard Ipsum wrote:
We could as you say wrap the wrapper, and pass an empty
environment... *shrug*
I fear that'd make Nix the master of metawrappers. Nope, Your environ change
has gone in :-)
D.
--
Daniel Silverstone http://www.digital-scurf.org/
PGP mail accepted and encouraged. Key Id: 3CCE BABE 206C 3B69
1835
days inactive
1835
days old
7 comments
2 participants
participants (2)
-
Daniel Silverstone -
Richard Ipsum