Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/gss-proxy/ticket/110 It would be safer to avoid reading environment variables if proxymech.so is ever used in a setuid program. Change the code to use secure_getenv() to accomplish that.
Fix pushed, package built.
review the code, and SanityOnly [root@dhcp12-241 gssproxy-0.3.0]# grep secure_getenv -r ../../SOURCES/ ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:Subject: [PATCH 3/3] Use secure_getenv in client and mechglue module ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:practices and use secure_getenv() if available. ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:Fallback to poorman emulation when secure_getenv() is not available. ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:+AC_CHECK_FUNCS([__secure_getenv secure_getenv]) ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:+ return secure_getenv(name); ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:+ return __secure_getenv(name); ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch:+#warning secure_getenv not available, falling back to poorman emulation [root@dhcp12-241 gssproxy-0.3.0]# vim ../../SOURCES/gssproxy-0.3.1-secure_getenv.patch [root@dhcp12-241 gssproxy-0.3.0]# grep secure_getenv -r . ./configure.ac:AC_CHECK_FUNCS([__secure_getenv secure_getenv]) ./src/gp_util.c.strerror_r: return secure_getenv(name); ./src/gp_util.c.strerror_r: return __secure_getenv(name); ./src/gp_util.c.strerror_r:#warning secure_getenv not available, falling back to poorman emulation ./src/gp_util.c: return secure_getenv(name); ./src/gp_util.c: return __secure_getenv(name); ./src/gp_util.c:#warning secure_getenv not available, falling back to poorman emulation https://beaker.engineering.redhat.com/jobs/563445 https://beaker.engineering.redhat.com/jobs/563446
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.