[PATCH] elf: Ignore LD_PROFILE if LD_PROFILE_OUTPUT is not set (bug 33797)

[Andreas K. Huettel]

Am Samstag, 17. Januar 2026, 01:02:25 Mitteleuropäische Normalzeit schrieb Florian Weimer:
> * Carlos O'Donell:
> 
> > On 1/15/26 5:24 PM, Florian Weimer wrote:
> >> The previous default for LD_PROFILE_OUTPUT, /var/tmp, is insecure
> >> because it's typically a 1777 directory, and other systems could
> >> place malicious files there which interfere with execution.
> >
> > Correct. This is an accident waiting to happen, even if we marked
> > bug 33797 as security- it is dangerous.
> >
[...]

> >
> > Reviewed-by: Carlos O'Donell <carlos@redhat.com>
> 
> Thanks.
> 
> Andreas, okay for the release?

Yes, sure. Makes a lot of sense.

> 
> Florian
> 
> 


-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer 
(council, comrel, toolchain, base-system, perl, libreoffice)
https://wiki.gentoo.org/wiki/User:Dilfridge
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 870 bytes
Desc: This is a digitally signed message part.
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260118/0f998f51/attachment.sig>