From owner-freebsd-current@FreeBSD.ORG  Tue Nov 18 20:09:18 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 6D78B16A4CE; Tue, 18 Nov 2003 20:09:18 -0800 (PST)
Received: from VARK.homeunix.com (adsl-68-123-40-77.dsl.pltn13.pacbell.net
	[68.123.40.77])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id D937643F75; Tue, 18 Nov 2003 20:09:16 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: from VARK.homeunix.com (localhost [127.0.0.1])
	by VARK.homeunix.com (8.12.9/8.12.9) with ESMTP id hAJ47Qen063449;
	Tue, 18 Nov 2003 20:07:26 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Received: (from das@localhost)
	by VARK.homeunix.com (8.12.9/8.12.9/Submit) id hAJ47PsK063448;
	Tue, 18 Nov 2003 20:07:25 -0800 (PST)
	(envelope-from das@FreeBSD.ORG)
Date: Tue, 18 Nov 2003 20:07:25 -0800
From: David Schultz <das@FreeBSD.ORG>
To: Scott Long <scottl@FreeBSD.ORG>
Message-ID: <20031119040725.GB63031@VARK.homeunix.com>
Mail-Followup-To: Scott Long <scottl@FreeBSD.ORG>, dyson@iquest.net,
	current@FreeBSD.ORG, "M. Warner Losh" <imp@bsdimp.com>
References: <200311190021.hAJ0Lj5e000832@dyson.jdyson.com>
	<20031118175434.A35215@pooker.samsco.home>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20031118175434.A35215@pooker.samsco.home>
cc: dyson@iquest.net
cc: current@FreeBSD.ORG
cc: "M. Warner Losh" <imp@bsdimp.com>
Subject: Re: Unfortunate dynamic linking for everything
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Nov 2003 04:09:18 -0000

On Tue, Nov 18, 2003, Scott Long wrote:
> > The additional hole of exploiting the system through the shared libs
> > is a negative tradeoff.
> 
> Exploits in libraries happen though.  The LD_LIBRARY_PATH attack is an old
> one that most Unixes are hopefully hardened against.

FreeBSD had a lingering LD_LIBRARY_PATH-related vulnerability
until Sunday, actually[1].  ;-)  But I don't mean to dispute your
point.  Like most of the other arguments in this bikeshed, there
is nothing fundamental about the LD_LIBRARY_PATH problem---nothing
that can't be fixed easily.


[1] The bug is either that nologin(8) respected LD_LIBRARY_PATH or
    that sshd(8) and login(1) allow environment poisoning, depending
    on your point of view.