[PATCH v4] Improve DST handling (Bug 23102, Bug 21942, Bug 18018, Bug, 23259, CVE-2011-0536 ).

[Florian Weimer]

On 06/08/2018 07:45 AM, Carlos O'Donell wrote:
> +	      /* For SUID/GUID programs we normally ignore the path with
> +		 a DST in DT_RUNPATH, or DT_RPATH.  However, there is
> +		 one exception to this rule, and it is:
> +
> +		   * $ORIGIN appears first in the path element, and is
> +		     the only thing in the element or is immediately
> +		     followed by a path separator and the rest of the
> +		     path.
> +
> +		   * The path element is rooted in a trusted directory.
> +
> +		 This exception allows such programs to reference
> +		 shared libraries in subdirectories of trusted
> +		 directories.  The use case is one of general
> +		 organization and deployment flexibility.
> +		 Trusted directories are usually such paths as "/lib64"
> +		 or "/lib".  */
> +	      if (__glibc_unlikely (__libc_enable_secure)
> +		  && !((input == start + 1
> +			|| (input > start + 1 && input[-2] == '\0'))
> +		       && (input[len] == '\0' || input[len] == '/')))
> +		repl = (const char *) -1;

The comment does not match the code: The code checks that $ORIGIN comes 
first in the *path*, not *path element* (hence the need for the start 
variable).  I'm not sure what the right behavior is here.  Going by path 
element seems more correct.

(The begin variable doesn't seem to add much value, as you noted.)

Thanks,
Florian