Re: libdbus hardening

[Solar Designer <solar () openwall com>]

On Tue, Jul 10, 2012 at 04:11:12PM +0200, Sebastian Krahmer wrote:
> I am fine with either solution and would prefer upstream patches
> anyway, but it turned out in past that nobody from upstream
> is willing to add such patches.

If this is not for upstream and you only need it working on a particular
distro with glibc, then why not use __secure_getenv()?

> I tried a year ago with openssl and AFAIK its still suffering
> (at least I never heared back).
>
> If you compile your openssh '--with-ssl-engine' you have
> an easy root exploit (given that ssh-keysign is mode 04755
> such as on Debian) via OPENSSL_config().
>
> If you ask me, thats quite poor for a framework that wants to
> add security to the system.
> So, I do not have any problems adding our own patch sets rather
> than waiting for another year.

Of course.

Alexander