Re: Games Team policy on games being setgid
On Sun, 28 Dec 2025 at 15:46:52 +0000, Simon McVittie wrote:
for example SDL
trusts and obeys many environment variables, without considering
whether they might be attacker-supplied
As I expected, SDL upstream has confirmed in
https://github.com/libsdl-org/SDL/issues/14717 that SDL's policy is that
it does not aim to support being run with elevated privileges, so each
of our games that is setgid and uses SDL without first sanitizing the
execution environment should be considered to be a game bug (not a SDL
bug).
smcv
Reply to: