Re: bin/38327: uu{en,de}code - any reason to use non-portable [sg]etprogname?

[Aleksey Cheusov <cheusov%tut.by@localhost>]

The following reply was made to PR bin/38327; it has been noted by GNATS.

From: Aleksey Cheusov <cheusov%tut.by@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Subject: Re: bin/38327: uu{en,de}code - any reason to use non-portable 
[sg]etprogname?
Date: Sat, 29 Mar 2008 19:42:55 +0200

 >  On Sat, Mar 29, 2008 at 03:55:02PM +0000, Aleksey Cheusov wrote:
  >>  Not a discussion :) Just a note.
  >>  Using setprogname(argv [0]) may be dangerous for SUID programs.
  >>  Invalid argv [0] may be passed through execv(2).
 >  
 >  More to the point, using getprogname() may be dangerous in setugid
 >  programs. The information comes from argv[0] in any event. Have you
 >  found any problematic uses?
 
 No. I'm not security Wizard.
 
 For paranoids
 void setprogname (const char *name)
 {
    if (i_am_paranoid){
       if (geteuid () == 0 && getuid () != 0 ||
           getegid () == 0 && getgid () != 0)
       {
          generate error message;
          exit (1);
       }
    }
 
    ...
 }
 
 -- 
 Best regards, Aleksey Cheusov.