15821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Copyright (c) 2012 The Chromium Authors. All rights reserved. 25821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Use of this source code is governed by a BSD-style license that can be 35821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// found in the LICENSE file. 45821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 55821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// This is a list of environment variables which the ELF loader unsets when 65821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// loading a SUID binary. Because they are unset rather than just ignored, they 75821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// aren't passed to child processes of SUID processes either. 85821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 95821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// We need to save these environment variables before running a SUID sandbox 105821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// and restore them before running child processes (but after dropping root). 115821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// 125821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// List gathered from glibc sources (00ebd7ed58df389a78e41dece058048725cb585e): 135821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// sysdeps/unix/sysv/linux/i386/dl-librecon.h 145821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// sysdeps/generic/unsecvars.h 155821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 165821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#ifndef SANDBOX_LINUX_SUID_SUID_UNSAFE_ENVIRONMENT_VARIABLES_H_ 175821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#define SANDBOX_LINUX_SUID_SUID_UNSAFE_ENVIRONMENT_VARIABLES_H_ 185821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 19c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)#include <stdint.h> 205821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <stdlib.h> // malloc 215821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#include <string.h> // memcpy 225821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 235821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static const char* kSUIDUnsafeEnvironmentVariables[] = { 245821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_AOUT_LIBRARY_PATH", 255821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_AOUT_PRELOAD", 265821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "GCONV_PATH", 275821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "GETCONF_DIR", 285821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "HOSTALIASES", 295821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_AUDIT", 305821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_DEBUG", 315821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_DEBUG_OUTPUT", 325821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_DYNAMIC_WEAK", 335821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_LIBRARY_PATH", 345821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_ORIGIN_PATH", 355821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_PRELOAD", 365821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_PROFILE", 375821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_SHOW_AUXV", 385821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LD_USE_LOAD_BIAS", 395821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LOCALDOMAIN", 405821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "LOCPATH", 415821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "MALLOC_TRACE", 425821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "NIS_PATH", 435821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "NLSPATH", 445821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "RESOLV_HOST_CONF", 455821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "RES_OPTIONS", 465821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "TMPDIR", 475821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) "TZDIR", 485821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) NULL, 495821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)}; 505821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 515821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// Return a malloc allocated string containing the 'saved' environment variable 525821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)// name for a given environment variable. 535821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)static inline char* SandboxSavedEnvironmentVariable(const char* envvar) { 545821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const size_t envvar_len = strlen(envvar); 55c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) const size_t kMaxSizeT = (size_t) -1; 565821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 57a02191e04bc25c4935f804f2c080ae28663d096dBen Murdoch if (envvar_len > kMaxSizeT - 1 - 8) 585821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 595821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 605821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) const size_t saved_envvarlen = envvar_len + 1 /* NUL terminator */ + 615821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 8 /* strlen("SANDBOX_") */; 625821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) char* const saved_envvar = (char*) malloc(saved_envvarlen); 635821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) if (!saved_envvar) 645821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return NULL; 655821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 665821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(saved_envvar, "SANDBOX_", 8); 675821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) memcpy(saved_envvar + 8, envvar, envvar_len); 685821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) saved_envvar[8 + envvar_len] = 0; 695821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 705821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) return saved_envvar; 715821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)} 725821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles) 735821806d5e7f356e8fa4b058a389a808ea183019Torne (Richard Coles)#endif // SANDBOX_LINUX_SUID_SUID_UNSAFE_ENVIRONMENT_VARIABLES_H_ 74