From owner-freebsd-ports-bugs@FreeBSD.ORG Tue Mar 7 14:20:29 2006 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0848116A420 for ; Tue, 7 Mar 2006 14:20:29 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 26E9343D86 for ; Tue, 7 Mar 2006 14:20:06 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k27EK5Kd032287 for ; Tue, 7 Mar 2006 14:20:05 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k27EK56B032286; Tue, 7 Mar 2006 14:20:05 GMT (envelope-from gnats) Resent-Date: Tue, 7 Mar 2006 14:20:05 GMT Resent-Message-Id: <200603071420.k27EK56B032286@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Kenneth Vestergaard Schmidt Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 001CF16A420 for ; Tue, 7 Mar 2006 14:17:19 +0000 (GMT) (envelope-from kvs@binarysolutions.dk) Received: from ns2.pil.dk (ns2.pil.dk [195.41.47.38]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9E94C43D46 for ; Tue, 7 Mar 2006 14:17:19 +0000 (GMT) (envelope-from kvs@binarysolutions.dk) Received: from donkey.binarysolutions.dk (fw2.pil.dk [83.90.227.58]) by ns2.pil.dk (Postfix) with ESMTP id C17DA7BA8AB; Tue, 7 Mar 2006 15:17:18 +0100 (CET) Received: by donkey.binarysolutions.dk (Postfix, from userid 1001) id CF25E6159; Tue, 7 Mar 2006 15:17:15 +0100 (CET) Message-Id: <20060307141715.CF25E6159@donkey.binarysolutions.dk> Date: Tue, 7 Mar 2006 15:17:15 +0100 (CET) From: Kenneth Vestergaard Schmidt To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: kvs@binarysolutions.dk Subject: ports/94170: Port security/chroot_safe unintended environment leak (minor security flaw) X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Kenneth Vestergaard Schmidt List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2006 14:20:29 -0000 >Number: 94170 >Category: ports >Synopsis: Port security/chroot_safe unintended environment leak (minor security flaw) >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Mar 07 14:20:05 GMT 2006 >Closed-Date: >Last-Modified: >Originator: Kenneth Vestergaard Schmidt >Release: FreeBSD 7.0-CURRENT i386 >Organization: >Environment: System: FreeBSD donkey.binarysolutions.dk 7.0-CURRENT FreeBSD 7.0-CURRENT #6: Fri Feb 3 01:17:43 CET 2006 root@donkey.binarysolutions.dk:/usr/obj/usr/src/sys/X30 i386 >Description: The putenv(3) library call doesn't unset environment variables on FreeBSD as it apparently does on Linux. The correct usage is unsetenv(3). This has the effect that CHROOT_USER, CHROOT_ROOT and LD_PRELOAD are leaked into the chroot'ed programs environment. >How-To-Repeat: Dump the environment after invoking something with chroot_safe.so preloaded. >Fix: Apply the following diff to the port's Makefile. It will replace the usage of putenv(3) with unsetenv(3). --- Makefile.orig Thu Mar 2 23:42:49 2006 +++ Makefile Thu Mar 2 23:42:10 2006 @@ -25,5 +25,6 @@ -e 's|-o chroot_safe.so|chroot_safe.cpp -o chroot_safe.so|' \ ${WRKSRC}/Makefile.in ${REINPLACE_CMD} 's|chroot(1)|chroot(8)|' ${WRKSRC}/chroot_safe.1.in + ${REINPLACE_CMD} 's|putenv|unsetenv|' ${WRKSRC}/chroot_safe.cpp .include >Release-Note: >Audit-Trail: >Unformatted: