From owner-freebsd-security@FreeBSD.ORG  Fri Feb 27 03:27:12 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id A91E816A4CE; Fri, 27 Feb 2004 03:27:12 -0800 (PST)
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id F3D2C43D1D; Fri, 27 Feb 2004 03:27:11 -0800 (PST)
	(envelope-from ache@pobrecita.freebsd.ru)
Received: from pobrecita.freebsd.ru (ache@localhost [127.0.0.1])
	by nagual.pp.ru (8.12.11/8.12.11) with ESMTP id i1RBR2PG036307;
	Fri, 27 Feb 2004 14:27:02 +0300 (MSK)
	(envelope-from ache@pobrecita.freebsd.ru)
Received: (from ache@localhost)
	by pobrecita.freebsd.ru (8.12.11/8.12.11/Submit) id i1RBR2Sp036302;
	Fri, 27 Feb 2004 14:27:02 +0300 (MSK)
	(envelope-from ache)
Date: Fri, 27 Feb 2004 14:27:00 +0300
From: Andrey Chernov <ache@nagual.pp.ru>
To: D J Hawkey Jr <hawkeyd@visi.com>
Message-ID: <20040227112658.GA36271@nagual.pp.ru>
Mail-Followup-To: Andrey Chernov <ache@nagual.pp.ru>,
	D J Hawkey Jr <hawkeyd@visi.com>, kientzle@acm.org, das@FreeBSD.ORG,
	freebsd-security@FreeBSD.ORG
References: <403CEF67.5040004@kientzle.com>
	<20040226225149.GB73252@nagual.pp.ru> <403E7B4D.8030803@kientzle.com>
	<20040227111353.GA14777@sheol.localdomain>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20040227111353.GA14777@sheol.localdomain>
User-Agent: Mutt/1.5.6i
X-AntiVirus: checked by AntiVir Milter 1.1-beta; AVE 6.24.0.5; VDF 6.24.0.20
	     (host: pobrecita.freebsd.ru)
cc: freebsd-security@FreeBSD.ORG
cc: das@FreeBSD.ORG
cc: kientzle@acm.org
Subject: Re: Environment Poisoning and login -p
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Feb 2004 11:27:12 -0000

On Fri, Feb 27, 2004 at 05:13:53AM -0600, D J Hawkey Jr wrote:
> > Instead, I've decided to follow Jacques Vidrine's
> > suggestion of using a whitelist of environment variables
> > that are "known-safe."
> 
> Coming in from left field... Will there be some sort of mechanism for
> an admin to set/modify this list?

I agree we'll need it (because of different assumptions). Something like 
/etc/safe_environment file.

-- 
Andrey Chernov | http://ache.pp.ru/