Re: kern/42420: $ORIGIN undefined on NetBSD

[David Laight <david%l8s.co.uk@localhost>]

The following reply was made to PR kern/42420; it has been noted by GNATS.

From: David Laight <david%l8s.co.uk@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/42420: $ORIGIN undefined on NetBSD
Date: Wed, 11 Jul 2012 18:24:18 +0100

 On Wed, Jul 11, 2012 at 05:10:05PM +0000, Matthew Mondor wrote:
 >  
 >  We must be sure that like for LD_PRELOAD and LD_LIBRARY_PATH, ORIGIN be
 >  disabled for setuid and setgid binaries.
 
 I suspect that $ORIGIN is ok for suid programs provided that the saved
 path contains no symlinks or is a direct reference to the actual directory
 the program binary was loaded from.
 
 Saving the string passed to exec certainly isn't good enough.
 
        David
 
 -- 
 David Laight: david%l8s.co.uk@localhost