NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

Block all use of getenv with syntax-check

Browse Source 
The use of getenv is typically insecure, and we want people
to use our wrappers, to force them to think about setuid
needs.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2013-10-09 11:19:27 +01:00
parent 1e4a02bdfe
commit 71b21f12be
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cfg.mk
View File

@ -859,6 +859,11 @@ sc_prohibit_unbounded_arrays_in_rpc:
halt='Arrays in XDR must have a upper limit set for <NNN>' \ halt='Arrays in XDR must have a upper limit set for <NNN>' \
$(_sc_search_regexp) $(_sc_search_regexp)
sc_prohibit_getenv:
@prohibit='\b(secure_)?getenv *\(' \
exclude='exempt from syntax-check' \
halt='Use virGetEnv{Allow,Block}SUID instead of getenv' \
$(_sc_search_regexp)
# We don't use this feature of maint.mk. # We don't use this feature of maint.mk.
prev_version_file = /dev/null prev_version_file = /dev/null
@ -1028,3 +1033,6 @@ exclude_file_name_regexp--sc_prohibit_include_public_headers_brackets = \
exclude_file_name_regexp--sc_prohibit_int_ijk = \ exclude_file_name_regexp--sc_prohibit_int_ijk = \
^(src/remote_protocol-structs|src/remote/remote_protocol.x|cfg.mk|include/)$ ^(src/remote_protocol-structs|src/remote/remote_protocol.x|cfg.mk|include/)$
exclude_file_name_regexp--sc_prohibit_getenv = \
^tests/.*\.[ch]$$

4
src/util/virutil.c
View File

@ -2143,7 +2143,7 @@ cleanup:
*/ */
const char *virGetEnvBlockSUID(const char *name) const char *virGetEnvBlockSUID(const char *name)
{ {
return secure_getenv(name); return secure_getenv(name); /* exempt from syntax-check-rules */
} }
@ -2157,7 +2157,7 @@ const char *virGetEnvBlockSUID(const char *name)
*/ */
const char *virGetEnvAllowSUID(const char *name) const char *virGetEnvAllowSUID(const char *name)
{ {
return getenv(name); return getenv(name); /* exempt from syntax-check-rules */
} }