[PATCH v2 12/19] elf: Ignore LD_PROFILE for setuid binaries

[Florian Weimer]

* Siddhesh Poyarekar:

> On 2023-10-17 09:05, Adhemerval Zanella wrote:
>> Loader does not ignore LD_PROFILE in secure-execution mode (different
>> than man-page states [1]), rather it uses a different path
>> (/var/profile) and ignore LD_PROFILE_OUTPUT.
>> Allowing secure-execution profiling is already a non good security
>> boundary, since it enables different code paths and extra OS access by
>> the process.  But by ignoring LD_PROFILE_OUTPUT, the resulting profile
>> file might also be acceded in a racy manner since the file name does not
>> use any process-specific information (such as pid, timing, etc.).
>> Another side-effect is it forces lazy binding even on libraries that
>> might be with DF_BIND_NOW.
>> [1] https://man7.org/linux/man-pages/man8/ld.so.8.html
>> ---
>
> I tend to agree.  Carlos, Florian, is profiling of setuid binaries
> something that needs to be supported as compatibility behaviour?  I'm
> inclined to agree with Adhemerval and just rip it out.

It's not something we need to support.  LD_PROFILE does not seem to be
regularly used for profiling anyway.

Thanks,
Florian