Hi Janne,
- If the program is privileged, we shouldn't trust path style
environment variables. The patch fixes this for TMPDIR and also for
the logic figuring out where addr2line is.
I did not test it, but if I remember right, the use of geteuid() and friends
does prevent static compilation, resp. static compilation does seem
to work, but it needs a matched dynamic library nonetheless,
which means if you relocate your statically linked program to another
box with differing glibc, you get runtime errors?
Or is the use of static programs already broken so it does not matter?
If this security feature would prevent use of static programs, it would
not be worth it, I think.
Cheers,
Manfred
Regtested on x86_64-unknown-linux-gnu, Ok for trunk?
gcc/fortran ChangeLog:
2012-04-19 Janne Blomqvist<j...@gcc.gnu.org>
* gfortran.texi (GFORTRAN_TMPDIR): Rename to TMPDIR, explain
algorithm for choosing temp directory.
libgfortran ChangeLog:
2012-04-19 Janne Blomqvist<j...@gcc.gnu.org>
* config.h.in: Regenerated.
* configure: Regenerated.
* configure.ac: Add checks for getegid and __secure_getenv.
* io/unix.c (P_tmpdir): Fallback definition for macro.
(tempfile_open): New function.
(tempfile): Use secure_getenv, call tempfile_open to try each
directory in turn.
* libgfortran.h (DEFAULT_TMPDIR): Remove macro.
(secure_getenv): New macro/prototype.
* runtime/environ.c (secure_getenv): New function.
(variable_table): Rename GFORTRAN_TMPDIR to TMPDIR.
* runtime/main.c (find_addr2line): Use secure_getenv.
