lib/env.c

   1 /*
   2  * Security checks of environment
   3  * Added from shadow-utils package
   4  * by Arkadiusz Mi¶kiewicz <misiek@pld.ORG.PL>
   5  *
   6  */
   7
   8 #include <stdio.h>
   9 #include <stdlib.h>
  10 #include <string.h>
  11 #include "env.h"
  12
  13 extern char **environ;
  14
  15 static char * const forbid[] = {
  16         "_RLD_=",
  17         "BASH_ENV=",    /* GNU creeping featurism strikes again... */
  18         "ENV=",
  19         "HOME=",
  20         "IFS=",
  21         "KRB_CONF=",
  22         "LD_",          /* anything with the LD_ prefix */
  23         "LIBPATH=",
  24         "MAIL=",
  25         "NLSPATH=",
  26         "PATH=",
  27         "SHELL=",
  28         "SHLIB_PATH=",
  29         (char *) 0
  30 };
  31
  32 /* these are allowed, but with no slashes inside
  33    (to work around security problems in GNU gettext) */
  34 static char * const noslash[] = {
  35         "LANG=",
  36         "LANGUAGE=",
  37         "LC_",          /* anything with the LC_ prefix */
  38         (char *) 0
  39 };
  40
  41 void
  42 sanitize_env(void)
  43 {
  44         char **envp = environ;
  45         char * const *bad;
  46         char **cur;
  47         char **move;
  48
  49         for (cur = envp; *cur; cur++) {
  50                 for (bad = forbid; *bad; bad++) {
  51                         if (strncmp(*cur, *bad, strlen(*bad)) == 0) {
  52                                 for (move = cur; *move; move++)
  53                                         *move = *(move + 1);
  54                                 cur--;
  55                                 break;
  56                         }
  57                 }
  58         }
  59
  60         for (cur = envp; *cur; cur++) {
  61                 for (bad = noslash; *bad; bad++) {
  62                         if (strncmp(*cur, *bad, strlen(*bad)) != 0)
  63                                 continue;
  64                         if (!strchr(*cur, '/'))
  65                                 continue;  /* OK */
  66                         for (move = cur; *move; move++)
  67                                 *move = *(move + 1);
  68                         cur--;
  69                         break;
  70                 }
  71         }
  72 }
  73