Bug#272210: libc6: LD_DEBUG should be ignored for suid/sgid binaries

[GOTO Masanori <gotom@debian.or.jp>]

At Sun, 19 Sep 2004 17:12:30 +0200,
Ulf H�hammar wrote:
> > At Sat, 18 Sep 2004 13:20:08 +0200, Ulf Härnhammar wrote:
> > > I read this article in LWN about how LD_DEBUG should be ignored for
> > > suid/sgid binaries to avoid helping people to exploit race conditions:
> 
> > Isn't "cat /proc/<pid>/maps" security critical?
> 
> Well, there are two issues here - one of exposing information and one of 
> allowing pauses and single-stepping through programs. Both /proc/<pid>/maps 
> and LD_DEBUG allow the first issue to happen, while only LD_DEBUG allows the 
> second (and to me the more critical one) to happen.

How to allow pauses and single-stepping?  Bugtraq does not say about
the latter things.

BTW, Jakub comments Gentoo's patch:

	http://sources.redhat.com/ml/libc-hacker/2004-08/msg00059.html

I agree with his opinion.

Regards,
-- gotom