mirror of
https://git.savannah.gnu.org/git/guix.git
synced 2026-04-07 13:40:36 +02:00
d659fe8666
Before this change, the environment variable GUIX_LOCPATH is not in the unsafe variable list, meaning that it is not unset in a privileged environment. This could lead to potential security issues. A CVE number is pending for this issue. A similar upstream glibc issue was CVE-2023-4911. * gnu/packages/base.scm (glibc)[replacement]: Add field to graft with ... (glibc/fixed): ... this new package. * gnu/packages/patches/glibc-guix-locpath.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it. Change-Id: I74d87ce543bfba7d5f424efb2b87926ca336c725 Reported-by: "Stefan" <stefan-guix@vodafonemail.de>
14 lines
455 B
Diff
14 lines
455 B
Diff
Patch to add the GUIX_LOCPATH environment variable to ones that should
|
|
be unset for SUID programs, same as LOCPATH.
|
|
|
|
--- glibc-2.41-old/sysdeps/generic/unsecvars.h
|
|
+++ glibc-2.41/sysdeps/generic/unsecvars.h
|
|
@@ -5,6 +5,7 @@
|
|
"GCONV_PATH\0" \
|
|
"GETCONF_DIR\0" \
|
|
"GLIBC_TUNABLES\0" \
|
|
+ "GUIX_LOCPATH\0" \
|
|
"HOSTALIASES\0" \
|
|
"LD_AUDIT\0" \
|
|
"LD_BIND_NOT\0" \
|