Subject: Re: LD_CHROOT idea
To: Andrew Brown <atatat@atatdot.net>
From: Luke Mewburn <lukem@wasabisystems.com>
List: tech-security
Date: 04/06/2001 16:43:19
On Fri, Apr 06, 2001 at 02:35:25AM -0400, Andrew Brown wrote:
> >If LD_CHROOT is set and the process isn't setuid or setgid, then
> 
> so...
> 
> 	if (getenv("LD_CHROOT") &&
> 	    !getuid() && !geteuid() && getgid == getegid()) {
> 		...do chroot stuff...
> 	}
> 
> yesh?  does it really matter if a program is suid (or sgid) to
> something we already had access to?

i just reused the same `trust' rules that already exist for
LD_LIBRARY_PATH and LD_PRELOAD; it keeps it consistent and simple.