kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Use secure_getenv() instead of getenv() for all environment variables

Browse Source 
... to avoid vulnerabilities that could occur if set-user-ID or
set-group-ID programs accidentally trusted the environment.

zkey is usually NOT a set-user-ID or set-group-ID program, but its
safer to use secure_getenv() anyway.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2021-06-21 11:26:23 +02:00
committed by Jan Höppner
parent 8723dbce04
commit 02aaff72fa
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
zkey/kms.c
View File

@@ -125,7 +125,7 @@ static FILE *open_kms_plugins_file(bool verbose)
char *conf;
FILE *fp;
conf = getenv(ENVVAR_ZKEY_KMS_PLUGINS);
conf = secure_getenv(ENVVAR_ZKEY_KMS_PLUGINS);
if (conf == NULL)
conf = DEFAULT_KMS_PLUGINS;
@@ -438,7 +438,7 @@ int check_for_kms_plugin(struct kms_info *kms_info, bool verbose)
memset(kms_info, 0, sizeof(*kms_info));
directory = getenv(ENVVAR_ZKEY_REPOSITORY);
directory = secure_getenv(ENVVAR_ZKEY_REPOSITORY);
if (directory == NULL)
directory = DEFAULT_KEYSTORE;
@@ -634,7 +634,7 @@ int bind_kms_plugin(struct keystore *keystore, const char *plugin,
if (rc != 0)
goto out;
directory = getenv(ENVVAR_ZKEY_REPOSITORY);
directory = secure_getenv(ENVVAR_ZKEY_REPOSITORY);
if (directory == NULL)
directory = DEFAULT_KEYSTORE;
util_asprintf(&config_dir, "%s/%s", directory, plugin_name);

2
zkey/zkey.c
View File

@@ -2894,7 +2894,7 @@ static int open_keystore(void)
{
char *directory;
directory = getenv(ENVVAR_ZKEY_REPOSITORY);
directory = secure_getenv(ENVVAR_ZKEY_REPOSITORY);
if (directory == NULL)
directory = DEFAULT_KEYSTORE;