mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 00:14:44 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/libraries/libapparmor
History
Patrick Steinhardt 778176b9d8
libapparmor: do not honor $LIBAPPARMOR_DEBUG when secure_getenv is undefined 
The `secure_getenv` function is a non-POSIX compliant extension of
glibc. In contrast to the POSIX `getenv`, `secure_getenv` will return
`NULL` for all environment variables when the program is run with
escalated privileges due to an SUID or SGID bit. Some strictly
POSIX-compliant libc libraries, most notably musl libc, do not have this
function and do not wish to implement it. Thus, AppArmor cannot be
compiled on such systems.

In libapparmor, `secure_getenv` is only used to determine whether the
environment variable DEBUG_ENV_VAR has been set to enable debugging. In
case an unprivileged user runs a SUID/SGID executable linked against
libapparmor, we do not want that user to be able to get additional
information via debug output.

The fix here is to produce an error only in case where debug output is
enabled by defining ENABLE_DEBUG_OUTPUT. Otherwise, we simply define
`secure_getenv` to `NULL` to completely disable the debug output.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
2018-05-09 13:15:42 -07:00
..
doc libapparmor: docs: fixup version numbers and small mistakes/typos 2018-04-14 15:51:23 -07:00
include libapparmor: Add support for overlaycache directories 2018-04-14 15:51:23 -07:00
m4 libapparmor: Check for podchecker during configure stage 2014-11-17 21:19:55 -06:00
src libapparmor: do not honor $LIBAPPARMOR_DEBUG when secure_getenv is undefined 2018-05-09 13:15:42 -07:00
swig libapparmor: fix swig test_apparmor.py for zero length ptrace records 2017-10-18 16:54:56 -07:00
testsuite Update libapparmor testsuite profiles with owner rules 2017-12-13 20:19:06 +01:00
AUTHORS libraries/libapparmor/: more license cleanups, adjust my email address 2011-02-23 14:02:45 -08:00
autogen.sh libapparmor: Force libtoolize to replace existing files 2016-09-14 12:48:58 -05:00
ChangeLog move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
configure.ac libapparmor: fix reallocarray FTBFS w/older glibc 2018-04-18 21:08:03 -07:00
COPYING.LGPL move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
INSTALL move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
Makefile.am libapparmor: more Makefile cleanups 2015-01-26 15:39:10 -08:00
NEWS move libapparmor into the libraries directory 2008-05-19 22:48:31 +00:00
README update the bugtracker link in the libapparmor README 2014-02-24 22:44:32 +01:00

README 

What little documentation exists is in src/aalogparse.h.

Please file bugs using https://bugs.launchpad.net/apparmor/+filebug