[ABRT PATCH v2] add environment variable whitelist to debuginfo install wrapper - closes 692

Petr Kubat pkubat at redhat.com
Wed Sep 11 10:13:25 UTC 2013


The install-debuginfo C wrapper which is run by a non-root user
clears the whole environment. However, since the installer
asks for user input by the use of an environment variable,
we have to create a whitelist of variables to keep when doing
the environment purge.

Signed-off-by: Petr Kubat <pkubat at redhat.com>
---
 .../abrt-action-install-debuginfo-to-abrt-cache.c  | 25 ++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
index 60ac5c9..d53f09f 100644
--- a/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
+++ b/src/plugins/abrt-action-install-debuginfo-to-abrt-cache.c
@@ -70,7 +70,32 @@ int main(int argc, char **argv)
 // We forgot to sanitize PYTHONPATH. And who knows what else we forgot
 // (especially considering *future* new variables of this kind).
 // We switched to clearing entire environment instead:
+
+        // However since we communicate through environment variables
+        // we have to keep a whitelist of variables to keep.
+        static const char *whitelist[] = {
+            "REPORT_CLIENT_SLAVE" //  Check if the app is being run as a slave
+        };
+        const size_t wlsize = sizeof(whitelist)/sizeof(char*);
+        char *setlist[wlsize];
+        char *p = NULL;
+        for (size_t i = 0; i < wlsize; i++)
+            if ((p = getenv(whitelist[i])) != NULL)
+                setlist[i] = xstrdup(p);
+            else
+                // Variable size arrays cannot be statically initialized
+                setlist[i] = NULL;
+
+        // Now we can clear the environment
         clearenv();
+
+        // And once again set whitelisted variables
+        for (size_t i = 0; i < wlsize; i++)
+            if (setlist[i] != NULL)
+            {
+                setenv(whitelist[i], setlist[i]);
+                free(setlist[i]);
+            }
 #else
         /* Clear dangerous stuff from env */
         static const char forbid[] =
-- 
1.7.11.7



More information about the Crash-catcher mailing list