Rename __secure_getenv to secure_getenv

40 files changed, 446 insertions, 28 deletions

diff --git a/ChangeLog b/ChangeLog
index 87552c4452..b39a5a887f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,66 @@
+2012-07-25  Florian Weimer  <fweimer@redhat.com>
+
+	* Versions.def: Add GLIBC_2.17.
+
+	* stdlib/stdlib.h: Rename __secure_getenv to secure_getenv.
+	* include/stdlib.h: Rename __secure_getenv to secure_getenv.
+	Introduce __libc_secure_getenv.
+	* stdlib/Versions: Add secure_getenv and __libc_secure_getenv.
+	* stdlib/secure-getenv.c: Likewise.  Update copyright years.
+	* stdlib/tst-secure-getenv.c: New.
+	* stdlib/Makefile (tests): Add testcase.
+
+	* manual/startup.texi (Environment Access): Document
+	secure_getenv.
+
+	* hesiod/hesiod.c (hesiod_init): Rename __secure_getenv to
+	__libc_secure_getenv.
+	* inet/ruserpass.c (ruserpass): Likewise.
+	* malloc/mtrace.c (mtrace): Likewise.
+	* sysdeps/mach/hurd/tmpfile.c (__tmpfile): Likewise.
+	* sysdeps/posix/libc_fatal.c (__libc_fatal): Likewise.  Update
+	copyright years.
+	* sysdeps/posix/sysconf.c (__sysconf__check_spec): Likewise.
+	* sysdeps/posix/tempname.c: Likewise.  Evaluate
+	HAVE_SECURE_GETENV.
+	* sysdeps/unix/sysv/linux/libc_fatal.c (__libc_message): Rename
+	__secure_getenv to __libc_secure_getenv.  Update copyright years.
+
+	* sysdeps/unix/sysv/linux/i386/nptl/libc.abilist: Add secure_getenv.
+	* sysdeps/unix/sysv/linux/libc_fatal.c: Likewise.
+	* sysdeps/unix/sysv/linux/powerpc/powerpc32/fpu/nptl/libc.abilist:
+	Likewise.
+	* sysdeps/unix/sysv/linux/powerpc/powerpc64/nptl/libc.abilist:
+	Likewise.
+	* sysdeps/unix/sysv/linux/s390/s390-32/nptl/libc.abilist: Likewise.
+	* sysdeps/unix/sysv/linux/s390/s390-64/nptl/libc.abilist: Likewise.
+	* sysdeps/unix/sysv/linux/sh/nptl/libc.abilist: Likewise.
+	* sysdeps/unix/sysv/linux/sparc/sparc32/nptl/libc.abilist: Likewise.
+	* sysdeps/unix/sysv/linux/sparc/sparc64/nptl/libc.abilist: Likewise.
+	* sysdeps/unix/sysv/linux/x86_64/64/nptl/libc.abilist: Likewise.
+	* sysdeps/unix/sysv/linux/x86_64/x32/nptl/libc.abilist: Likewise.
+	* ports/sysdeps/unix/sysv/linux/alpha/nptl/libc.abilist: Likewise.
+	* ports/sysdeps/unix/sysv/linux/arm/nptl/libc.abilist: Likewise.
+	* ports/sysdeps/unix/sysv/linux/ia64/nptl/libc.abilist: Likewise.
+	* ports/sysdeps/unix/sysv/linux/m68k/coldfire/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/m68k/m680x0/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/mips/mips32/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/mips/mips64/n32/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/mips/mips64/n64/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/powerpc/powerpc32/nofpu/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/tile/tilegx/tilegx64/nptl/libc.abilist:
+	Likewise.
+	* ports/sysdeps/unix/sysv/linux/tile/tilepro/nptl/libc.abilist:
+	Likewise.
+
 2012-07-25  Joseph Myers  <joseph@codesourcery.com>
 
 	* sysdeps/generic/ldsodefs.h (struct La_i86_regs): Remove.
diff --git a/NEWS b/NEWS
index 65ca380fd7..d7084a02db 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,10 @@ Version 2.17
   zEnterprise z196.
   Implemented by Andreas Krebbel.
 
+* The new function secure_getenv allows secure access to the environment,
+  returning NULL if running in a SUID/SGID process.  This function replaces
+  the internal function __secure_getenv.
+
 
 Version 2.16
 
diff --git a/Versions.def b/Versions.def
index 2b44f5e0bb..3c9e0aedbc 100644
--- a/Versions.def
+++ b/Versions.def
@@ -33,6 +33,7 @@ libc {
   GLIBC_2.14
   GLIBC_2.15
   GLIBC_2.16
+  GLIBC_2.17
   HURD_CTHREADS_0.3
 %ifdef EXPORT_UNWIND_FIND_FDE
   GCC_3.0
diff --git a/hesiod/hesiod.c b/hesiod/hesiod.c
index a3f22e5c88..657dabebc1 100644
--- a/hesiod/hesiod.c
+++ b/hesiod/hesiod.c
@@ -87,7 +87,7 @@ hesiod_init(void **context) {
 	ctx->classes[0] = C_IN;
 	ctx->classes[1] = C_HS;
 
-	configname = __secure_getenv("HESIOD_CONFIG");
+	configname = __libc_secure_getenv("HESIOD_CONFIG");
 	if (!configname)
 	  configname = _PATH_HESIOD_CONF;
 	if (parse_config_file(ctx, configname) < 0) {
@@ -109,7 +109,7 @@ hesiod_init(void **context) {
 	 * The default RHS can be overridden by an environment
 	 * variable.
 	 */
-	if ((cp = __secure_getenv("HES_DOMAIN")) != NULL) {
+	if ((cp = __libc_secure_getenv("HES_DOMAIN")) != NULL) {
 		free(ctx->RHS);
 		ctx->RHS = malloc(strlen(cp)+2);
 		if (!ctx->RHS)
diff --git a/include/stdlib.h b/include/stdlib.h
index de0b414d86..d45b2f02de 100644
--- a/include/stdlib.h
+++ b/include/stdlib.h
@@ -33,12 +33,13 @@ libc_hidden_proto (__strtold_l)
 libc_hidden_proto (exit)
 libc_hidden_proto (abort)
 libc_hidden_proto (getenv)
+extern __typeof (secure_getenv) __libc_secure_getenv;
+libc_hidden_proto (__libc_secure_getenv)
 libc_hidden_proto (bsearch)
 libc_hidden_proto (qsort)
 libc_hidden_proto (qsort_r)
 libc_hidden_proto (lrand48_r)
 libc_hidden_proto (wctomb)
-libc_hidden_proto (__secure_getenv)
 
 extern long int __random (void);
 extern void __srandom (unsigned int __seed);
diff --git a/inet/ruserpass.c b/inet/ruserpass.c
index df423ba6ee..71a734dfda 100644
--- a/inet/ruserpass.c
+++ b/inet/ruserpass.c
@@ -102,7 +102,7 @@ ruserpass(host, aname, apass)
 	int t, usedefault = 0;
 	struct stat64 stb;
 
-	hdir = __secure_getenv("HOME");
+	hdir = __libc_secure_getenv("HOME");
 	if (hdir == NULL) {
 		/* If we can't get HOME, fail instead of trying ".",
 		   which is no improvement. This really should call
diff --git a/malloc/mtrace.c b/malloc/mtrace.c
index d1049c982c..d7a032a86a 100644
--- a/malloc/mtrace.c
+++ b/malloc/mtrace.c
@@ -309,7 +309,7 @@ mtrace ()
   /* When compiling the GNU libc we use the secure getenv function
      which prevents the misuse in case of SUID or SGID enabled
      programs.  */
-  mallfile = __secure_getenv (mallenv);
+  mallfile = __libc_secure_getenv (mallenv);
 #else
   mallfile = getenv (mallenv);
 #endif
diff --git a/manual/startup.texi b/manual/startup.texi
index 0420e93289..d0be5e65f4 100644
--- a/manual/startup.texi
+++ b/manual/startup.texi
@@ -310,11 +310,15 @@ character, since this is assumed to terminate the string.
 
 The value of an environment variable can be accessed with the
 @code{getenv} function.  This is declared in the header file
-@file{stdlib.h}.  Modifications of enviroment variables are not
-allowed in Multi-threaded programs.  The @code{getenv} function
-can be safely used in multi-threaded programs
+@file{stdlib.h}.
 @pindex stdlib.h
 
+Libraries should use @code{secure_getenv} instead of @code{getenv}, so
+that they do not accidentally use untrusted environment variables.
+Modifications of environment variables are not allowed in
+multi-threaded programs.  The @code{getenv} and @code{secure_getenv}
+functions can be safely used in multi-threaded programs.
+
 @comment stdlib.h
 @comment ISO
 @deftypefun {char *} getenv (const char *@var{name})
@@ -326,6 +330,18 @@ environment variable @var{name} is not defined, the value is a null
 pointer.
 @end deftypefun
 
+@comment stdlib.h
+@comment GNU
+@deftypefun {char *} secure_getenv (const char *@var{name})
+This function is similar to @code{getenv}, but it returns a null
+pointer if the environment is untrusted.  This happens when the
+program file has SUID or SGID bits set.  General-purpose libraries
+should always prefer this function over @code{getenv} to avoid
+vulnerabilities if the library is referenced from a SUID/SGID program.
+
+This function is a GNU extension.
+@end deftypefun
+
 
 @comment stdlib.h
 @comment SVID
diff --git a/ports/sysdeps/unix/sysv/linux/alpha/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/alpha/nptl/libc.abilist
index 6d333aa522..f8a3295add 100644
--- a/ports/sysdeps/unix/sysv/linux/alpha/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/alpha/nptl/libc.abilist
@@ -1811,6 +1811,9 @@ GLIBC_2.16
  sys_errlist D 0x460
  sys_nerr D 0x4
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.2
  GLIBC_2.2 A
  _IO_adjust_wcolumn F
diff --git a/ports/sysdeps/unix/sysv/linux/arm/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/arm/nptl/libc.abilist
index 1f496fb61c..5523fdd2a3 100644
--- a/ports/sysdeps/unix/sysv/linux/arm/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/arm/nptl/libc.abilist
@@ -78,6 +78,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.4
  GLIBC_2.4 A
  _Exit F
diff --git a/ports/sysdeps/unix/sysv/linux/ia64/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/ia64/nptl/libc.abilist
index 6939ad73bc..b73f5ca8f7 100644
--- a/ports/sysdeps/unix/sysv/linux/ia64/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/ia64/nptl/libc.abilist
@@ -78,6 +78,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.2
  GLIBC_2.2 A
  _Exit F
diff --git a/ports/sysdeps/unix/sysv/linux/m68k/coldfire/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/m68k/coldfire/nptl/libc.abilist
index ca31ead95f..9a924571e8 100644
--- a/ports/sysdeps/unix/sysv/linux/m68k/coldfire/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/m68k/coldfire/nptl/libc.abilist
@@ -79,6 +79,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.4
  GLIBC_2.4 A
  _Exit F
diff --git a/ports/sysdeps/unix/sysv/linux/m68k/m680x0/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/m68k/m680x0/nptl/libc.abilist
index c2706f1e14..fbcd20897b 100644
--- a/ports/sysdeps/unix/sysv/linux/m68k/m680x0/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/m68k/m680x0/nptl/libc.abilist
@@ -1767,6 +1767,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.2
  GLIBC_2.2 A
  _IO_adjust_wcolumn F
diff --git a/ports/sysdeps/unix/sysv/linux/mips/mips32/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/mips/mips32/nptl/libc.abilist
index 80f7d3321d..54e8d1a94e 100644
--- a/ports/sysdeps/unix/sysv/linux/mips/mips32/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/mips/mips32/nptl/libc.abilist
@@ -2242,3 +2242,6 @@ GLIBC_2.9
  pipe2 F
 _gp_disp
  _gp_disp A
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
diff --git a/ports/sysdeps/unix/sysv/linux/mips/mips64/n32/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/mips/mips64/n32/nptl/libc.abilist
index 6d64e1d238..2a0e2a2d96 100644
--- a/ports/sysdeps/unix/sysv/linux/mips/mips64/n32/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/mips/mips64/n32/nptl/libc.abilist
@@ -1390,6 +1390,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.2
  GLIBC_2.2 A
  _Exit F
diff --git a/ports/sysdeps/unix/sysv/linux/mips/mips64/n64/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/mips/mips64/n64/nptl/libc.abilist
index 701152eeb5..0e21194ac1 100644
--- a/ports/sysdeps/unix/sysv/linux/mips/mips64/n64/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/mips/mips64/n64/nptl/libc.abilist
@@ -1388,6 +1388,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.2
  GLIBC_2.2 A
  _Exit F
diff --git a/ports/sysdeps/unix/sysv/linux/powerpc/powerpc32/nofpu/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/powerpc/powerpc32/nofpu/nptl/libc.abilist
index 43015f4e92..11ad6a525d 100644
--- a/ports/sysdeps/unix/sysv/linux/powerpc/powerpc32/nofpu/nptl/libc.abilist
+++ b/ports/sysdeps/unix/sysv/linux/powerpc/powerpc32/nofpu/nptl/libc.abilist
@@ -1772,6 +1772,9 @@ GLIBC_2.16
  mbrtoc16 F
  mbrtoc32 F
  timespec_get F
+GLIBC_2.17
+ GLIBC_2.17 A
+ secure_getenv F
 GLIBC_2.2
  GLIBC_2.2 A
  _IO_adjust_wcolumn F
diff --git a/ports/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/nptl/libc.abilist b/ports/sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/nptl/libc.abilist
index eed3b4937f..48f0c69eb8 100644
--- a/ports/sysdeps/unix/sysv/linux/tile/tilegx