Re: Bug reporting

Re: Bug reporting

[Alejandro Colomar (man-pages)]

[ added a few CCs ]

Hello Dave,

On 5/5/21 10:30 PM, Dave Chupreev wrote:
> Hello, Alejandro.
>  
> On page 138

I guess you refer to TLPI, written by Michael.

> 
>      1.
> 
>         Your version of /unsetenv() /should check to see whether there
>         are multiple definitions of an environment variable, and remove
>         them all.
> 
> How can I add such variables which have many definitions? According to
> *putenv* and *setenv* functions, variables with the same names are
> replaced if encountered.

I haven't read that part of the book yet, so I ignore the context.  But
AFAIK, that can't happen on Linux, as you pointed out (probably neither
on Unix systems in general, but I don't know for sure, probably Michael
does).  I guess the only possibility is if an attacker somehow modified
your environment and inserted multiple copies of an env variable.

The book (TLPI) states that glibc does check that, so I digged into the
sources and found that in <stdlib/setenv.c>, around line 290
(<https://sourceware.org/git?p=glibc.git;a=blob;f=stdlib/setenv.c;h=893f081af6b5a21b999a4056757fd69d1386c0d4;hb=HEAD#l290>).
 That behavior was introduced by Roland in commit
196980f5117c8d38f10d64bf67eeb0924651675f
(<https://sourceware.org/git/?p=glibc.git;a=commit;h=196980f5117c8d38f10d64bf67eeb0924651675f>),
so maybe he can better explain the reasons behind the change (the commit
msg is quite unexplicative) if he still remembers (that goes back to 1995).

Regards,

Alex

-- 
Alejandro Colomar
Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
http://www.alejandro-colomar.es/

Re: Bug reporting

[Michael Kerrisk (man-pages)]

Hello,

On Fri, 7 May 2021 at 02:21, Dave Chupreev <cdn.dev@yandex.ru> wrote:
>
> Well I see, I've tried on Linux and yea I didn't find any option to insert multiple definitions.

I think the only way to insert multiple definitions is by direct
manipulation of 'extern char **environ'.

Thanks,

Michael


> 06.05.2021, 01:37, "Alejandro Colomar (man-pages)" <alx.manpages@gmail.com>:
>
> [ added a few CCs ]
>
> Hello Dave,
>
> On 5/5/21 10:30 PM, Dave Chupreev wrote:
>
>  Hello, Alejandro.
>
>  On page 138
>
>
> I guess you refer to TLPI, written by Michael.
>
>
>       1.
>
>          Your version of /unsetenv() /should check to see whether there
>          are multiple definitions of an environment variable, and remove
>          them all.
>
>  How can I add such variables which have many definitions? According to
>  *putenv* and *setenv* functions, variables with the same names are
>  replaced if encountered.
>
>
> I haven't read that part of the book yet, so I ignore the context. But
> AFAIK, that can't happen on Linux, as you pointed out (probably neither
> on Unix systems in general, but I don't know for sure, probably Michael
> does). I guess the only possibility is if an attacker somehow modified
> your environment and inserted multiple copies of an env variable.
>
> The book (TLPI) states that glibc does check that, so I digged into the
> sources and found that in <stdlib/setenv.c>, around line 290
> (<https://sourceware.org/git?p=glibc.git;a=blob;f=stdlib/setenv.c;h=893f081af6b5a21b999a4056757fd69d1386c0d4;hb=HEAD#l290>).
>  That behavior was introduced by Roland in commit
> 196980f5117c8d38f10d64bf67eeb0924651675f
> (<https://sourceware.org/git/?p=glibc.git;a=commit;h=196980f5117c8d38f10d64bf67eeb0924651675f>),
> so maybe he can better explain the reasons behind the change (the commit
> msg is quite unexplicative) if he still remembers (that goes back to 1995).
>
> Regards,
>
> Alex
>
> --
> Alejandro Colomar
> Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/
> http://www.alejandro-colomar.es/



-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

Re: Bug reporting

[Alexander Monakov]

On Mon, 10 May 2021, Michael Kerrisk (man-pages) via Libc-alpha wrote:

> Hello,
> 
> On Fri, 7 May 2021 at 02:21, Dave Chupreev <cdn.dev@yandex.ru> wrote:
> >
> > Well I see, I've tried on Linux and yea I didn't find any option to insert multiple definitions.
> 
> I think the only way to insert multiple definitions is by direct
> manipulation of 'extern char **environ'.

You can cause a program to start with multiple definitions, because it is
possible to pass arbitrarily funny stuff as 'envp' argument to execve, such as:

- duplicated entries
- entries without a '='
- entries starting with '='
- empty strings
- "2 x 2 = 4"

All of that will be present in the exec'd program's environment array.

Alexander

Re: Bug reporting

[Michael Kerrisk (man-pages)]

Hello ALexander,

On Mon, 10 May 2021 at 05:20, Alexander Monakov <amonakov@ispras.ru> wrote:
>
>
>
> On Mon, 10 May 2021, Michael Kerrisk (man-pages) via Libc-alpha wrote:
>
> > Hello,
> >
> > On Fri, 7 May 2021 at 02:21, Dave Chupreev <cdn.dev@yandex.ru> wrote:
> > >
> > > Well I see, I've tried on Linux and yea I didn't find any option to insert multiple definitions.
> >
> > I think the only way to insert multiple definitions is by direct
> > manipulation of 'extern char **environ'.
>
> You can cause a program to start with multiple definitions, because it is
> possible to pass arbitrarily funny stuff as 'envp' argument to execve, such as:
>
> - duplicated entries
> - entries without a '='
> - entries starting with '='
> - empty strings
> - "2 x 2 = 4"
>
> All of that will be present in the exec'd program's environment array.

Yes. I was too focussed on thinking about what an already running
program can do to its current environment. Thanks for reminding me of
the above.

Thanks,

Michael


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/