this mail was sent using 100% recycled electrons

Daniel wrote:

Ich meine den Benutzer der das Program ausführt und bräuchte es in C (wenn das überhaupt geht). In der Shell würde der Befehl "printenv HOME"; jedoch gibt printenv nicht den String (also das Home Verzeichnes) sondern den Befehlstatus zurück.

char *my_homedir = getenv("HOME");

Hannes

Daniel ha scritto:

Das funktioniert einwandfrei. Dankeschön :)

Grüße, Daniel

Am 15.12.05 schrieb Hannes Mayr bik@bauchlandung.org:

...

Daniel wrote:

...

Ich meine den Benutzer der das Program ausführt und bräuchte es in C (wenn das überhaupt geht). In der Shell würde der Befehl "printenv HOME"; jedoch gibt printenv nicht den String (also das Home Verzeichnes) sondern den Befehlstatus zurück.

char *my_homedir = getenv("HOME");

http://www.die.net/doc/linux/man/man3/getenv.3.html

char *my_homedir = getenv("HOME"); if(my_homedir) my_homedir = strdup(my_homedir); else return/exit(EXIT_FAILURE);

is not safe to play with pointers which point directly to the process inherited environment space. If you are developing networked deamon that pointer could be used for some kind of exploit or nasty things. In case of environment space corruption application itself or its forked childs which inherited corrupted enviroments could crash badly.

If you want change your enviroment please use setenv/putenv

http://www.die.net/doc/linux/man/man3/setenv.3.html http://www.die.net/doc/linux/man/man3/putenv.3.html

I hope this will save your time. If not I am sorry but I am not able to read german fluently.

Cheers,

Thomas Pircher ha scritto:

On Thursday 22 December 2005 15:07, Roberto A. Foglietta wrote:

...

is not safe to play with pointers which point directly to the process inherited environment space.

Hi Roberto,

I would like to add my 2 cents: if security is important, then it would be better avoiding environment variables (and other information which can be influenced by a malicious and/or chuckleheaded user) at all.

I understand... ...so, for example, busybox has to avoid any enviroment managment to be secure?

Enviroments could be a data-input-channel like another and we have to treat it, not to drop it. Some sw has the need to r/w a $HOME/.myexec, for example

export HOME="$(cat malicios.data)"; myexec

now could happen:

- myexec: open a root shell - myexec: segmentation fault - myexec: quit with exit code 255

May be somebody could do a thing like this

cp -f malicios.data ~/.myexec

or

myexec < malicios.data

so we have to avoid file r/w and ignore keyboard inputs too, in order to enache security? :-)

Cheers,

Hi Roberto,

in fact, I am only interested in reading the values of the environment variables. This trick with the if/else block and the "strdup" function is really interesting, since it is exactly what I was searching and I don't have to care about pointers to the original environment variables. Thank you :)

Best regards, Daniel

2005/12/22, Roberto A. Foglietta roberto.foglietta@sad.it:

Daniel ha scritto:

...

Das funktioniert einwandfrei. Dankeschön :)

Grüße, Daniel

Am 15.12.05 schrieb Hannes Mayr bik@bauchlandung.org:

...

Daniel wrote:

...

Ich meine den Benutzer der das Program ausführt und bräuchte es in C (wenn das überhaupt geht). In der Shell würde der Befehl "printenv HOME"; jedoch gibt printenv nicht den String (also das Home Verzeichnes) sondern den Befehlstatus zurück.

char *my_homedir = getenv("HOME");

http://www.die.net/doc/linux/man/man3/getenv.3.html

char *my_homedir = getenv("HOME"); if(my_homedir) my_homedir = strdup(my_homedir); else return/exit(EXIT_FAILURE);

is not safe to play with pointers which point directly to the process inherited environment space. If you are developing networked deamon that pointer could be used for some kind of exploit or nasty things. In case of environment space corruption application itself or its forked childs which inherited corrupted enviroments could crash badly.

If you want change your enviroment please use setenv/putenv

http://www.die.net/doc/linux/man/man3/setenv.3.html http://www.die.net/doc/linux/man/man3/putenv.3.html

I hope this will save your time. If not I am sorry but I am not able to read german fluently.

Cheers,

Roberto A. Foglietta Analista Programmatore GNU/Linux SAD Trasporto Locale S.p.a. Corso Italia 13/N 39100 BOLZANO (I)

Tel. +39/0471-450.261 Fax +39/0471-450.253 _______________________________________________ http://www.lugbz.org/mailman/listinfo/lugbz-list