rtld: restore abort for malformed environments while setuid

[kevans]

Summary

From 2009 up until bfd4c875a105 ("rtld: avoid use of of getenv(3) ..."),
rtld would abort if a malformed environment was observed in tainted
executions. The abort was added at the time because we wouldn't be able
to unset any of the sensitive env vars that we try to sanitize. This
has been rewritten such that that isn't an issue anymore, but a
malformed environment like this can be a good indicator that the caller
is trying to do something hinky; let's restore the previous behavior.

Discussed with: emaste

[kib]

In my opinion, it is not an rtld job to enforce policies on the application. It is application itself, might be libc, which should do anything there. But even with libc, library should not enforce the policy either.

Next day somebody would trick some binary that is not suid to do stupid thing with non-compliant environment, and then what, rtld should be tasked with sanitizing and aborting?

[kevans]

In D34074#770475, @kib wrote:

In my opinion, it is not an rtld job to enforce policies on the application. It is application itself, might be libc, which should do anything there. But even with libc, library should not enforce the policy either.

Next day somebody would trick some binary that is not suid to do stupid thing with non-compliant environment, and then what, rtld should be tasked with sanitizing and aborting?

libc seems to go scorched earth after seeing this anyways: https://cgit.freebsd.org/src/tree/lib/libc/stdlib/getenv.c#n364

[kib]

In D34074#770732, @kevans wrote:

In D34074#770475, @kib wrote:

In my opinion, it is not an rtld job to enforce policies on the application. It is application itself, might be libc, which should do anything there. But even with libc, library should not enforce the policy either.

Next day somebody would trick some binary that is not suid to do stupid thing with non-compliant environment, and then what, rtld should be tasked with sanitizing and aborting?

libc seems to go scorched earth after seeing this anyways: https://cgit.freebsd.org/src/tree/lib/libc/stdlib/getenv.c#n364

So libc approach, as already implemented, is clearly superior:

• it is done in the right way, i.e. process is not abruptly terminated, but an error is returned instead
• it is handled both for static and dynamic binaries
• all processes are protected, not only suid