[PATCH] Ignore LD_POINTER_GUARD for set-user-ID/set-group-ID binaries.

[Florian Weimer]

On 10/16/2015 04:51 PM, Hector Marco-Gisbert wrote:
> Hello all,
> 
> It would be nice if our names (Hector Marco and Ismael Ripoll) appear in
> the Changelog. At least showing that we reported the security issue.
> 
> Previously reported security issues (i.e BZ #15754) were properly
> credited in the Glibc Changelog.

In my opinion, this was a mistake, we should credit only reporters which
follow the established disclosure procedures.

If you found a vulnerability which is sufficiently significant, in your
opinion, to deserve credits and a CVE identifier, you should make at
least one attempt to report it privately first.  We do not want to keep
things secret, but the pain of CVE assignment *after* public disclosure
means that we currently need private vulnerability reports to arrange
for CVE assignment.

Florian