Description of problem:
When a statically linked executable is run with glibc secure mode, it segfaults before reaching main().
glibc secure mode is enabled for SUID/SGID programs, or when the SELinux policy for the program does not allow the "noatsecure" permission.
I found this bug while using the distributed compiler icecream, whose icecc-create-env scripts runs confined by SELinux and calls ldconfig (statically linked).

Version-Release number of selected component (if applicable):
glibc-2.10.90-24.x86_64

How reproducible:
always

Steps to Reproduce:
1. Get a statically linked binary (Just copy /sbin/ldconfig somewhere.)
2. Set the SUID bit for the binary. (chmod u+s the_binary)
3. Run the binary as a different user.
  
Actual results:
The binary crashes with Segmentation fault (SIGSEGV).

Expected results:
The binary should not crash.

Additional info:
Using gdb on the crashing ldconfig showed me there is a problem in elf/dl-support.c:_dl_non_dynamic_init() here:

      const char *cp = unsecure_envvars;

      while (cp < unsecure_envvars + sizeof (unsecure_envvars))
        {   
          __unsetenv (cp);
          cp = (const char *) __rawmemchr (cp, '\0') + 1;
        }

The __rawmemchr function is not really called. Instead the calls leads to address 0x04002f8 which is just before _start (0x400300):

(gdb) x/8i 0x00000000004002f8
0x4002f8:	add    %al,(%rax)
0x4002fa:	add    %al,(%rax)
0x4002fc:	add    %al,(%rax)
0x4002fe:	add    %al,(%rax)
0x400300 <_start>:	xor    %ebp,%ebp
0x400302 <_start+2>:	mov    %rdx,%r9
0x400305 <_start+5>:	pop    %rsi
0x400306 <_start+6>:	mov    %rsp,%rdx