30 lines
951 B
Diff
30 lines
951 B
Diff
Ignore environment variables in setuid or setgid programs. The glibc-internal
|
|
copy of the library already implements a similar check.
|
|
|
|
--- hesiod-3.0.2/hesiod.c Wed Oct 3 14:53:37 2001
|
|
+++ hesiod-3.0.2/hesiod.c Wed Oct 3 14:55:02 2001
|
|
@@ -52,6 +52,7 @@
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
+#include <unistd.h>
|
|
#include <ctype.h>
|
|
#include "hesiod.h"
|
|
|
|
@@ -79,13 +80,13 @@
|
|
if (ctx)
|
|
{
|
|
*context = ctx;
|
|
- configname = getenv("HESIOD_CONFIG");
|
|
+ configname = ((getuid() == geteuid()) && (getgid() == getegid())) ? getenv("HESIOD_CONFIG") : NULL;
|
|
if (!configname)
|
|
configname = SYSCONFDIR "/hesiod.conf";
|
|
if (read_config_file(ctx, configname) >= 0)
|
|
{
|
|
/* The default rhs can be overridden by an environment variable. */
|
|
- p = getenv("HES_DOMAIN");
|
|
+ p = ((getuid() == geteuid()) && (getgid() == getegid())) ? getenv("HES_DOMAIN") : NULL;
|
|
if (p)
|
|
{
|
|
if (ctx->rhs)
|