On 03/21/2015 04:17 AM, Daiki Ueno wrote: > Florian Weimer <fwei...@redhat.com> writes: > >> The patch will use getauxval(AT_SECURE) or __libc_enable_secure (or >> issetuugid on other systems, but which I cannot test). It is not going >> to be very portable. > > I see (though I'm a bit confused that you removed the use of > __libc_enable_secure in CVE-2014-0475). Can't you use secure_getenv, > which Gnulib provides a replacement, compare the result with > the normal getenv, and apply the pathname check if needed?
Hmm, I was under the impression that absolute paths for LANGUAGE were a supported feature. If that's not the case, we can just reject directory traversal and confine lookups to the system locale directory, like we did for the other locale files. -- Florian Weimer / Red Hat Product Security
