From: Colin Walters <walters@verbum.org>
Date: Fri, 28 Sep 2012 01:29:29 +0000 (-0400)
Subject: hardening: Use __secure_getenv if available
X-Git-Tag: dbus-1.6.6~5
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1a556443757b19fee67ef4441141246dd9cfed4f;p=thirdparty%2Fdbus.git

hardening: Use __secure_getenv if available

This helps us in the case where we were executed via filesystem
capabilities or a SELinux domain transition, not necessarily a plain
old setuid binary.

https://bugs.freedesktop.org/show_bug.cgi?id=52202
---

diff --git a/configure.ac b/configure.ac
index df9098565..4eb530ae0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -596,7 +596,7 @@ AC_DEFINE_UNQUOTED([DBUS_USE_SYNC], [$have_sync], [Use the gcc __sync extension]
 AC_SEARCH_LIBS(socket,[socket network])
 AC_CHECK_FUNC(gethostbyname,,[AC_CHECK_LIB(nsl,gethostbyname)])
 
-AC_CHECK_FUNCS(vsnprintf vasprintf nanosleep usleep setenv clearenv unsetenv socketpair getgrouplist fpathconf setrlimit poll setlocale localeconv strtoll strtoull issetugid getresuid)
+AC_CHECK_FUNCS(vsnprintf vasprintf nanosleep usleep setenv clearenv unsetenv socketpair getgrouplist fpathconf setrlimit poll setlocale localeconv strtoll strtoull issetugid getresuid secure_getenv __secure_getenv )
 
 AC_CHECK_HEADERS([syslog.h])
 if test "x$ac_cv_header_syslog_h" = "xyes"; then
diff --git a/dbus/dbus-sysdeps.c b/dbus/dbus-sysdeps.c
index 04fb8d763..976c7e4b0 100644
--- a/dbus/dbus-sysdeps.c
+++ b/dbus/dbus-sysdeps.c
@@ -182,12 +182,18 @@ _dbus_setenv (const char *varname,
 const char*
 _dbus_getenv (const char *varname)
 {  
+#if defined(HAVE_SECURE_GETENV)
+  return secure_getenv (varname);
+#elif defined(HAVE___SECURE_GETENV)
+  return __secure_getenv (varname);
+#else
   /* Don't respect any environment variables if the current process is
    * setuid.  This is the equivalent of glibc's __secure_getenv().
    */
   if (_dbus_check_setuid ())
     return NULL;
   return getenv (varname);
+#endif
 }
 
 /**