Subject: Re: LD_CHROOT idea
To: Andrew Brown <atatat@atatdot.net>
From: Luke Mewburn <lukem@wasabisystems.com>
List: tech-security
Date: 04/06/2001 16:43:19
On Fri, Apr 06, 2001 at 02:35:25AM -0400, Andrew Brown wrote:
> >If LD_CHROOT is set and the process isn't setuid or setgid, then
>
> so...
>
> if (getenv("LD_CHROOT") &&
> !getuid() && !geteuid() && getgid == getegid()) {
> ...do chroot stuff...
> }
>
> yesh? does it really matter if a program is suid (or sgid) to
> something we already had access to?
i just reused the same `trust' rules that already exist for
LD_LIBRARY_PATH and LD_PRELOAD; it keeps it consistent and simple.