[ABRT PATCH v2] add environment variable whitelist to debuginfo install wrapper - closes 692
Petr Kubat
pkubat at redhat.com
Wed Sep 11 10:13:25 UTC 2013
The install-debuginfo C wrapper which is run by a non-root user
clears the whole environment. However, since the installer
asks for user input by the use of an environment variable,
we have to create a whitelist of variables to keep when doing
the environment purge.
Signed-off-by: Petr Kubat <pkubat at redhat.com>
---
.../abrt-action-install-debuginfo-to-abrt-cache.c | 25 ++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
index 60ac5c9..d53f09f 100644
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
@@ -70,7 +70,32 @@ int main(int argc, char **argv)
// We forgot to sanitize PYTHONPATH. And who knows what else we forgot
// (especially considering *future* new variables of this kind).
// We switched to clearing entire environment instead:
+
+ // However since we communicate through environment variables
+ // we have to keep a whitelist of variables to keep.
+ static const char *whitelist[] = {
+ "REPORT_CLIENT_SLAVE" // Check if the app is being run as a slave
+ };
+ const size_t wlsize = sizeof(whitelist)/sizeof(char*);
+ char *setlist[wlsize];
+ char *p = NULL;
+ for (size_t i = 0; i < wlsize; i++)
+ if ((p = getenv(whitelist[i])) != NULL)
+ setlist[i] = xstrdup(p);
+ else
+ // Variable size arrays cannot be statically initialized
+ setlist[i] = NULL;
+
+ // Now we can clear the environment
clearenv();
+
+ // And once again set whitelisted variables
+ for (size_t i = 0; i < wlsize; i++)
+ if (setlist[i] != NULL)
+ {
+ setenv(whitelist[i], setlist[i]);
+ free(setlist[i]);
+ }
#else
/* Clear dangerous stuff from env */
static const char forbid[] =
--
1.7.11.7
More information about the Crash-catcher
mailing list