This is the mail archive of the mailing list for the GDB project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: [RFA] Add $pdir as entry for libthread-db-search-path.

On Fri, May 6, 2011 at 11:40 AM, Tom Tromey <> wrote:
>>>>>> "Doug" == Doug Evans <> writes:
> Doug> Thanks, but I'm still stuck ...
> I have gone back and forth on this a few times.
> On the one hand, I think people running gdb on an untrusted executable
> are acting naively. ?I think this is true even for a python-less build
> using -nx -- I just don't think gdb or bfd has had enough scrutiny along
> these lines to warrant trust.
> On the other hand, I think it makes sense to aim for trustworthiness as
> a goal, because gdb is a powerful tool for inspecting executables.
> I think my overall preference would be for gdb to run securely by
> default, with some runtime settings to let users override this.
> Also I don't have any problem recognizing that different organizations
> build gdb in different ways for their own reasons, and making
> accommodations for that. ?That is, a configure option to make $pdir the
> default seems fine to me, if you want something like that.
> Doug> Question for the group at large (and I it doesn't matter to me which
> Doug> way we go, I just want to make forward progress ...).
> Doug> Do we enforce such security concerns in FSF gdb?
> IMO, yes.
> Doug> Second,
> Doug> If we address these security concerns what is the solution?
> Doug> One proposal is on the table.
> Doug> [Maintain a list of trusted paths in gdb and have a flag for
> Doug> permissive/restrictive mode.
> Doug> If in restrictive mode libthread_db and autoloaded python/gdbinit code
> Doug> has to come from a trusted path.
> Doug> I think one could take this further though.]
> It seems reasonable to me.
> Doug> Last,
> Doug> Do we need to address this before adding my $pdir patch?
> IMO, no, but it would be nicer that way.

If I also add $sdir to specify a plain dlopen (LIBTHREAD_DB) and put
that ahead of $pdir ("s" for system), then I can have $pdir and not
change the current behaviour (though I still think $pdir should come
first - we can move it first after whatever security model is added).

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]