CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/10 16:51:25
Modified files:
share/mk : bsd.prog.mk
Log message:
An restriction on setuid/setgid binaries linked against libc will arrive
soon, and this is another prep step.
The libc startup code is aware of the executable file's setuid/setgid
bits (via new AUX_openbsd_execmode), and will compare these bits
against a global (weak) variable "mode_t _permit_setugid" in the main
program dso -- which must indicate similar abilities.
If the binary does not contain that variable, it picks up the weak libc
version which is 0. If the corresponding bits are not set right, it means
this binary was not intended to be setuid/setgid.
The file has become setuid/setgid accidentally, unintentionally, or
due to attacker control, and libc will log the event and abort (the
abort is disabled until we complete more steps of this transition).
This change in bsd.prog.mk automatically (based upon BINMODE) creates
an additional .c file with the correct variable definition to compile
and link into the program, so that we don't need any additional changes
in userland base.
