News for hackers. Stuff that matters.
Re:Never run ldd on unknown executables by jameshart on Sunday July 23, 2023 @11:46PM (#36842902)
Am I the only one who read this and thought 'wow, if I can get LD_TRACE_LOADED_OBJECTS to be set I can block anything from being executed'?

That seems like a scary powerful environment variable.

Re:Never run ldd on unknown executables by sp1rit on Monday July 24, 2023 @12:23AM (#36843082)
Not really. Realistically you can set PATH to an empty string, and block execution everything that isn't invoked using a hardcoded path.
Re:Never run ldd on unknown executables by jameshart on Monday July 24, 2023 @12:40AM (#36843169)
Yeah, I thought about that, but this would kill even directly invoked executables, right?
Re:Never run ldd on unknown executables by sp1rit on Monday July 24, 2023 @03:32AM (#36844223)
Yes, this is certainly more "far-reaching" than other env vars. But If you have the ability to wreak havoc even if ld-linux wouldn't check for this (obv. PATH being the prime example, but unsetting HOME will almost certainly break some software written by novices (not falling back to the home specified in /etc/passwd)).

And I also could imagine that tools that allow setting arbitrary env vars might filter common troublemakers like PATH, but almost certainly not niche env vars that change the bahviour of ld-linux.

Re:Never run ldd on unknown executables by immibis on Monday July 24, 2023 @02:21AM (#36843744)
You can also set LD_PRELOAD to the path of a shared library whose constructor segfaults, or set LD_LIBRARY_PATH to the path of a directory containing a libc that doesn't work.