Date: Tue, 30 Jul 2002 13:46:07 -0700 (PDT) From: Lee Brotherston <lee@nerds.org.uk> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/41180: ldconfig man page amendment Message-ID: <200207302046.g6UKk7QA052561@www.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 41180
>Category: misc
>Synopsis: ldconfig man page amendment
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: doc-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Jul 30 13:50:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Lee Brotherston
>Release: FreeBSD 4.6-RC #3
>Organization:
>Environment:
FreeBSD cybergimp.nerds.org.uk 4.6-RC FreeBSD 4.6-RC #3: Sat Jun 15 21:56:30 BST 2002 lee@cybergimp.nerds.org.uk:/usr/src/sys/compile/NEWGIMPYKERN i386
>Description:
The man page for ldconfig(8) says:
"Security
Special care must be taken when loading shared libraries into the address space of set-user-Id programs. Whenever such a program is run, the dynamic linker will only load shared libraries from the hints file. In particular, the LD_LIBRARY_PATH is not used to search for libraries."
This is true for most users, but not for root. I know setuid programs are generally setuid root, and root can do pretty much what it likes, but the man page is not 100% correct. Just wanted to suggest and "unless you are root" type addition to the page ;)
>How-To-Repeat:
$ su
Password:
# export LD_LIBRARY_PATH="/var/tmp"
# cp /usr/lib/libcrypt.so.2 /var/tmp/
# ldd /usr/bin/passwd
/usr/bin/passwd:
libcrypt.so.2 => /var/tmp/libcrypt.so.2 (0x2806c000)
librpcsvc.so.2 => /usr/lib/librpcsvc.so.2 (0x28085000)
libutil.so.3 => /usr/lib/libutil.so.3 (0x2808d000)
libc.so.4 => /usr/lib/libc.so.4 (0x28096000)
>Fix:
Presumably an ammendment to the man page ;) Although I have just raised another problem report (misc/41179: LD_LIBRARY_PATH security checks) as to wether this behaviour is correct or not.
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200207302046.g6UKk7QA052561>