Skip to content

src: call linux getauxval(AT_SECURE) in SafeGetenv #12548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
danbev wants to merge 3 commits into from
Closed

src: call linux getauxval(AT_SECURE) in SafeGetenv #12548

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a7c7bea
src: add linux getauxval(AT_SECURE) in SafeGetenv
danbev Apr 20, 2017
21f2446
remove unused inttypes.h
danbev May 24, 2017
e4eb855
fix pointer style
danbev May 24, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
src: add linux getauxval(AT_SECURE) in SafeGetenv 
This commit attempts to fix the following TODO:
// TODO(bnoordhuis) Should perhaps also check whether
getauxval(AT_SECURE) is non-zero on Linux.

This can be manually tested at the moment using the following steps:

$ setcap cap_net_raw+ep out/Release/node
$ NODE_PENDING_DEPRECATION="1" out/Release/node -p
"process.binding('config').pendingDeprecation"
true
$ useradd test
$ su test
$ NODE_PENDING_DEPRECATION="1" out/Release/node -p
"process.binding('config').pendingDeprecation"
undefined
  • Loading branch information
@danbev
danbev committed May 18, 2017
commit a7c7bea1c3ab4fdf985f5e520cec6d4f276a47d2
8 changes: 6 additions & 2 deletions src/node.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,8 @@ bool config_expose_internals = false;

bool v8_initialized = false;

bool linux_at_secure = false;

// process-relative uptime base, initialized at start-up
static double prog_start_time;
static bool debugger_running;
Expand Down Expand Up @@ -959,13 +961,15 @@ Local<Value> UVException(Isolate* isolate,
// Look up environment variable unless running as setuid root.
bool SafeGetenv(const char* key, std::string* text) {
#ifndef _WIN32
// TODO(bnoordhuis) Should perhaps also check whether getauxval(AT_SECURE)
// is non-zero on Linux.
if (getuid() != geteuid() || getgid() != getegid()) {
text->clear();
return false;
}
#endif
if (linux_at_secure) {
text->clear();
return false;
}
if (const char* value = getenv(key)) {
*text = value;
return true;
Expand Down
26 changes: 26 additions & 0 deletions src/node_main.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,33 @@ int wmain(int argc, wchar_t *wargv[]) {
}
#else
// UNIX
#ifdef __linux__
#include <elf.h>
#include <inttypes.h>
Copy link
Copy Markdown
Member

@bnoordhuis bnoordhuis May 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you need inttypes.h for?

#ifdef __LP64__
#define Elf_auxv_t Elf64_auxv_t
#else
#define Elf_auxv_t Elf32_auxv_t
#endif // __LP64__
extern char **environ;
Copy link
Copy Markdown
Member

@bnoordhuis bnoordhuis May 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Style nit: extern char** environ;

Copy link
Copy Markdown
Contributor Author

@danbev danbev May 24, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll fix this.

#endif // __linux__

namespace node {
extern bool linux_at_secure;
} // namespace node

int main(int argc, char *argv[]) {
#if defined(__linux__)
char** envp = environ;
while (*envp++ != nullptr) {}
Elf_auxv_t* auxv = reinterpret_cast<Elf_auxv_t*>(envp);
for (; auxv->a_type != AT_NULL; auxv++) {
if (auxv->a_type == AT_SECURE) {
node::linux_at_secure = auxv->a_un.a_val;
break;
}
}
#endif
// Disable stdio buffering, it interacts poorly with printf()
// calls elsewhere in the program (e.g., any logging from V8.)
setvbuf(stdout, nullptr, _IONBF, 0);
Expand Down