mirror of https://github.com/mkerrisk/man-pages
ld.so.8: Replace mentions of set-UID/set-GID programs with secure-execution mode
Inspired by a patch from Maria Guseva. Reported-by: Maria Guseva <m.guseva@samsung.com> Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
parent
9894eac316
commit
24fb0923ab
32
man8/ld.so.8
32
man8/ld.so.8
|
@ -61,8 +61,8 @@ of the binary if present and DT_RUNPATH attribute does not exist.
|
|||
Use of DT_RPATH is deprecated.
|
||||
.IP o
|
||||
Using the environment variable
|
||||
.BR LD_LIBRARY_PATH .
|
||||
Except if the executable is a set-user-ID/set-group-ID binary,
|
||||
.BR LD_LIBRARY_PATH
|
||||
(unless the executable is being run in secure-execution mode; see below).
|
||||
in which case it is ignored.
|
||||
.IP o
|
||||
(ELF only) Using the directories specified in the
|
||||
|
@ -166,9 +166,7 @@ environment variable setting (see below).
|
|||
.BI \-\-inhibit\-rpath " list"
|
||||
Ignore RPATH and RUNPATH information in object names in
|
||||
.IR list .
|
||||
This option is ignored if
|
||||
.B ld.so
|
||||
is set-user-ID or set-group-ID.
|
||||
This option is ignored if when running in secure-execution mode (see below).
|
||||
.TP
|
||||
.BI \-\-audit " list"
|
||||
Use objects named in
|
||||
|
@ -260,7 +258,7 @@ The items in the list are separated by either colons or semicolons.
|
|||
Similar to the
|
||||
.B PATH
|
||||
environment variable.
|
||||
Ignored in set-user-ID and set-group-ID programs.
|
||||
This variable is ignore in secure-execution mode.
|
||||
.TP
|
||||
.B LD_PRELOAD
|
||||
A list of additional, user-specified, ELF shared
|
||||
|
@ -268,7 +266,7 @@ objects to be loaded before all others.
|
|||
The items of the list can be separated by spaces or colons.
|
||||
This can be used to selectively override functions in other shared objects.
|
||||
The objects are searched for using the rules given under DESCRIPTION.
|
||||
For set-user-ID/set-group-ID ELF binaries,
|
||||
In secure-execution mode,
|
||||
preload pathnames containing slashes are ignored,
|
||||
and shared objects in the standard search directories are loaded
|
||||
only if the set-user-ID mode bit is enabled on the shared object file.
|
||||
|
@ -307,7 +305,7 @@ to be loaded before all others in a separate linker namespace
|
|||
would occur in the process).
|
||||
These objects can be used to audit the operation of the dynamic linker.
|
||||
.B LD_AUDIT
|
||||
is ignored for set-user-ID/set-group-ID binaries.
|
||||
is ignored in secure-execution mode.
|
||||
|
||||
The dynamic linker will notify the audit
|
||||
shared objects at so-called auditing checkpoints\(emfor example,
|
||||
|
@ -338,7 +336,7 @@ prints a help message about which categories can be specified in this
|
|||
environment variable.
|
||||
Since glibc 2.3.4,
|
||||
.B LD_DEBUG
|
||||
is ignored for set-user-ID/set-group-ID binaries.
|
||||
is ignored in secure-execution mode.
|
||||
.TP
|
||||
.B LD_DEBUG_OUTPUT
|
||||
(glibc since 2.1)
|
||||
|
@ -347,7 +345,7 @@ File in which
|
|||
output should be written.
|
||||
The default is standard error.
|
||||
.B LD_DEBUG_OUTPUT
|
||||
is ignored for set-user-ID/set-group-ID binaries.
|
||||
is ignored in secure-execution mode.
|
||||
.TP
|
||||
.B LD_DYNAMIC_WEAK
|
||||
(glibc since 2.1.91)
|
||||
|
@ -361,7 +359,7 @@ Allow weak symbols to be overridden (reverting to old glibc behavior).
|
|||
.\" Reply-To: drepper at cygnus dot com (Ulrich Drepper)
|
||||
For security reasons, since glibc 2.3.4,
|
||||
.B LD_DYNAMIC_WEAK
|
||||
is ignored for set-user-ID/set-group-ID binaries.
|
||||
is ignored in secure-execution mode.
|
||||
.TP
|
||||
.B LD_HWCAP_MASK
|
||||
(glibc since 2.1)
|
||||
|
@ -380,9 +378,9 @@ version numbers.
|
|||
.B LD_ORIGIN_PATH
|
||||
(glibc since 2.1)
|
||||
Path where the binary is found (for non-set-user-ID programs).
|
||||
For security reasons, since glibc 2.4,
|
||||
Since glibc 2.4,
|
||||
.B LD_ORIGIN_PATH
|
||||
is ignored for set-user-ID/set-group-ID binaries.
|
||||
is ignored in secure-execution mode.
|
||||
.\" Only used if $ORIGIN can't be determined by normal means
|
||||
.\" (from the origin path saved at load time, or from /proc/self/exe)?
|
||||
.TP
|
||||
|
@ -419,16 +417,16 @@ If this variable is not defined, or is defined as an empty string,
|
|||
then the default is
|
||||
.IR /var/tmp .
|
||||
.B LD_PROFILE_OUTPUT
|
||||
is ignored for set-user-ID and set-group-ID programs,
|
||||
is ignored in secure-execution mode.
|
||||
which always use
|
||||
.IR /var/profile .
|
||||
.TP
|
||||
.B LD_SHOW_AUXV
|
||||
(glibc since 2.1)
|
||||
Show auxiliary array passed up from the kernel.
|
||||
For security reasons, since glibc 2.3.5,
|
||||
Since glibc 2.3.5,
|
||||
.B LD_SHOW_AUXV
|
||||
is ignored for set-user-ID/set-group-ID binaries.
|
||||
is ignored in secure-execution mode.
|
||||
.TP
|
||||
.B LD_TRACE_PRELINKING
|
||||
(glibc since 2.4)
|
||||
|
@ -458,7 +456,7 @@ If
|
|||
.B LD_USE_LOAD_BIAS
|
||||
is defined with the value 0,
|
||||
neither executables nor PIEs will honor the base addresses.
|
||||
This variable is ignored by set-user-ID and set-group-ID programs.
|
||||
This variable is ignored in secure-execution mode.
|
||||
.TP
|
||||
.B LD_VERBOSE
|
||||
(glibc since 2.1)
|
||||
|
|
Loading…
Reference in New Issue