[PATCH 2/2] Erase GLIBC_TUNABLES for setxid processes when tunables is disabled

[Florian Weimer]

On 01/31/2017 02:29 PM, Siddhesh Poyarekar wrote:
> On Tuesday 31 January 2017 06:52 PM, Florian Weimer wrote:
>> On 01/29/2017 06:11 PM, Siddhesh Poyarekar wrote:
>>> In addition to this, I'll post a patch for earlier releases (2.24 and
>>> older) to add GLIBC_TUNABLES to unsecure_envvars (is unsecure even a
>>> word?) so that they too don't end up passing on unsafe tunables.
>>
>> I expected a patch with a preprocessor condition for unsecvars.h for
>> glibc 2.25.  Wouldn't this have the same effect than your tunables-based
>> changes?
>
> It would, but I chose to limit the change to within the tunables code
> base.  I can do it your way if that's your preference.

I'd suggest to keep the changes to a non-tunables configuration to a 
minimum, and unsecvars.h is better at that goal, I think.

Thanks,
Florian