7c2f4db828
…ackend orc_rt::secureGetenv is like getenv, but returns null when the process is running with elevated privileges (e.g. a set-user-ID or set-group-ID program), so that a variable in an attacker-controlled environment cannot influence a privileged host. On libcs where privilege can't be checked (anything other than glibc or the BSDs/macOS), it fails secure and returns null, so those environment variables are ignored until a branch for the platform is added. Switch the printf logging backend to read ORC_RT_LOG and ORC_RT_LOG_OUTPUT through secureGetenv, so a redirected log file or level can't be forced via the environment in a privileged process. Note that running the ORC runtime in a process with elevated privileges is extremely risky (since the JIT'd code will typically inherit these elevated privileges), and expected to be rare. Exercise extreme caution with such setups.
28 lines
1.1 KiB
C++
28 lines
1.1 KiB
C++
//===- Environment.h - ORC-RT executor environment access -------*- C++ -*-===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// Helpers for reading the process environment.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#ifndef ORC_RT_LIB_EXECUTOR_ENVIRONMENT_H
|
|
#define ORC_RT_LIB_EXECUTOR_ENVIRONMENT_H
|
|
|
|
namespace orc_rt {
|
|
|
|
/// Like getenv, but returns null when the process is running with elevated
|
|
/// privileges (e.g. a set-user-ID or set-group-ID program), so that a variable
|
|
/// in an attacker-controlled environment cannot influence a privileged host.
|
|
///
|
|
/// Use this for any environment variable whose value has security-relevant
|
|
/// effects, e.g. choosing a file to open.
|
|
const char *secureGetenv(const char *Name);
|
|
|
|
} // namespace orc_rt
|
|
|
|
#endif // ORC_RT_LIB_EXECUTOR_ENVIRONMENT_H
|