$ORIGIN expansion in SUID/SGID applications

[Tavis Ormandy]

Hello, I've noticed that $ORIGIN is expanded in RPATH entries for
SGID/SUID binaries, on the condition that it is alone (_dl_dst_count,
elf/dl-load.c).

From http://tinyurl.com/yj7lpr "For security, the dynamic linker does
not allow use of $ORIGIN substitution sequences for set-user and
set-group ID programs.". Is there any reason why $ORIGIN is permitted on
it's own? Of course, this would be a very bad idea as creating a link to
a suid program would allow a user to manipulate the value of $ORIGIN.

I was planning on submitting a patch that disables this expansion in
secure mode, but noticed that Ulrich had already looked at this code in
1999 and made this exception.

Thanks, Tavis.

-- 
-------------------------------------
taviso@sdf.lonestar.org | finger me for my pgp key.
-------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 238 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20061219/6ec98183/attachment.sig>