Bug#1053470: ld.so: ignore tunables in secure mode

2023-10-04 Thread Aurelien Jarno
Hi, On 2023-10-05 09:33, Michael Hudson-Doyle wrote: > I think that is the sort of conclusion upstream is coming to in > https://inbox.sourceware.org/libc-alpha/20231003201151.1406279-1-siddh...@sourceware.org/T/#e9123bc53d892ab6552e05109ce939d531d741092 > too. In any case, the upstream bug tracke

Bug#1053470: ld.so: ignore tunables in secure mode

2023-10-04 Thread Michael Hudson-Doyle
I think that is the sort of conclusion upstream is coming to in https://inbox.sourceware.org/libc-alpha/20231003201151.1406279-1-siddh...@sourceware.org/T/#e9123bc53d892ab6552e05109ce939d531d741092 too. In any case, the upstream bug tracker / mailing list is probably the place to start with this.

Bug#1053470: ld.so: ignore tunables in secure mode

2023-10-04 Thread Christian Göttsche
Package: glibc Version: 2.37-12 In the light of the recent privilege escalation vulnerability I'd like to suggest disabling the support for tunables in secure mode (most notably for setuid-binaries). This would mitigate future regressions in the handling of the environment variable and possible vu