From owner-freebsd-bugs Tue Jul 30 13:50: 7 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BCE0B37B400 for ; Tue, 30 Jul 2002 13:50:02 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1395143E42 for ; Tue, 30 Jul 2002 13:50:02 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g6UKo1JU065467 for ; Tue, 30 Jul 2002 13:50:01 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g6UKo1Vb065466; Tue, 30 Jul 2002 13:50:01 -0700 (PDT) Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6E7E737B400 for ; Tue, 30 Jul 2002 13:46:07 -0700 (PDT) Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3176B43E42 for ; Tue, 30 Jul 2002 13:46:07 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.4/8.12.4) with ESMTP id g6UKk7OT052562 for ; Tue, 30 Jul 2002 13:46:07 -0700 (PDT) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.4/8.12.4/Submit) id g6UKk7QA052561; Tue, 30 Jul 2002 13:46:07 -0700 (PDT) Message-Id: <200207302046.g6UKk7QA052561@www.freebsd.org> Date: Tue, 30 Jul 2002 13:46:07 -0700 (PDT) From: Lee Brotherston To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-1.0 Subject: misc/41180: ldconfig man page amendment Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org >Number: 41180 >Category: misc >Synopsis: ldconfig man page amendment >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: doc-bug >Submitter-Id: current-users >Arrival-Date: Tue Jul 30 13:50:01 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Lee Brotherston >Release: FreeBSD 4.6-RC #3 >Organization: >Environment: FreeBSD cybergimp.nerds.org.uk 4.6-RC FreeBSD 4.6-RC #3: Sat Jun 15 21:56:30 BST 2002 lee@cybergimp.nerds.org.uk:/usr/src/sys/compile/NEWGIMPYKERN i386 >Description: The man page for ldconfig(8) says: "Security Special care must be taken when loading shared libraries into the address space of set-user-Id programs. Whenever such a program is run, the dynamic linker will only load shared libraries from the hints file. In particular, the LD_LIBRARY_PATH is not used to search for libraries." This is true for most users, but not for root. I know setuid programs are generally setuid root, and root can do pretty much what it likes, but the man page is not 100% correct. Just wanted to suggest and "unless you are root" type addition to the page ;) >How-To-Repeat: $ su Password: # export LD_LIBRARY_PATH="/var/tmp" # cp /usr/lib/libcrypt.so.2 /var/tmp/ # ldd /usr/bin/passwd /usr/bin/passwd: libcrypt.so.2 => /var/tmp/libcrypt.so.2 (0x2806c000) librpcsvc.so.2 => /usr/lib/librpcsvc.so.2 (0x28085000) libutil.so.3 => /usr/lib/libutil.so.3 (0x2808d000) libc.so.4 => /usr/lib/libc.so.4 (0x28096000) >Fix: Presumably an ammendment to the man page ;) Although I have just raised another problem report (misc/41179: LD_LIBRARY_PATH security checks) as to wether this behaviour is correct or not. >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message