Security implications of debugging features

[Siddhesh Poyarekar]

On 7/12/21 4:11 PM, Florian Weimer wrote:
> * Siddhesh Poyarekar:
> 
>> OK, then how about just the first paragraph for now?  I was trying to
>> write for a future where we have a way to, say, administratively
>> disable the debugging features but I guess we could add that in later.
>>
>> ~~~~~~~~~~
>> Debugging features
>>
>> glibc comes with a number of debugging features that allow developers
>> to isolate root causes of problems.  Bugs in debugging features that
>> are enabled by explicitly compiling applications or glibc to use them
>> are not considered security vulnerabilities and will be treated as
>> regular bugs.  Examples of such features are mcheck and mtrace, which
>> allow debugging and tracing of glibc malloc functions.
>> ~~~~~~~~~~
> 
> It still needs to mention AT_SECURE, I think.

Could you suggest text that you think should get added to cover this?

Thanks,
Siddhesh