Re: [PATCH 2/2] Erase GLIBC_TUNABLES for setxid processes when tunables is disabled

[Florian Weimer <fweimer at redhat dot com>]

On 01/31/2017 02:29 PM, Siddhesh Poyarekar wrote:
> On Tuesday 31 January 2017 06:52 PM, Florian Weimer wrote:
> > On 01/29/2017 06:11 PM, Siddhesh Poyarekar wrote:
> > > In addition to this, I'll post a patch for earlier releases (2.24 and
> > > older) to add GLIBC_TUNABLES to unsecure_envvars (is unsecure even a
> > > word?) so that they too don't end up passing on unsafe tunables.
> >
> > I expected a patch with a preprocessor condition for unsecvars.h for
> > glibc 2.25.  Wouldn't this have the same effect than your tunables-based
> > changes?
>
> It would, but I chose to limit the change to within the tunables code
> base.  I can do it your way if that's your preference.

I'd suggest to keep the changes to a non-tunables configuration to a 
minimum, and unsecvars.h is better at that goal, I think.

Thanks,
Florian