Re: bin/38327: uu{en,de}code - any reason to use non-portable [sg]etprogname?

[Aleksey Cheusov <cheusov%tut.by@localhost>]

>  On Sat, Mar 29, 2008 at 03:55:02PM +0000, Aleksey Cheusov wrote:
 >>  Not a discussion :) Just a note.
 >>  Using setprogname(argv [0]) may be dangerous for SUID programs.
 >>  Invalid argv [0] may be passed through execv(2).
>  
>  More to the point, using getprogname() may be dangerous in setugid
>  programs. The information comes from argv[0] in any event. Have you
>  found any problematic uses?

No. I'm not security Wizard.

For paranoids
void setprogname (const char *name)
{
   if (i_am_paranoid){
      if (geteuid () == 0 && getuid () != 0 ||
          getegid () == 0 && getgid () != 0)
      {
         generate error message;
         exit (1);
      }
   }

   ...
}

-- 
Best regards, Aleksey Cheusov.