This patch does not apply to 8.1RC-2, or 7.3-RELEASE just accept whatever the project has corrected it to. *** 8.0-RELEASE/src/libexec/rtld-elf/rtld.c Sun Oct 25 02:10:29 2009 --- new-generic-from-sec-officer/src/libexec/rtld-elf/rtld.c Tue Dec 1 17:31:53 2009 *************** *** 372,377 **** --- 372,384 ---- unsetenv(LD_ "LIBMAP_DISABLE"); unsetenv(LD_ "DEBUG"); unsetenv(LD_ "ELF_HINTS_PATH"); + // http://people.freebsd.org/~cperciva/rtld.patch + if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") || + unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") || + unsetenv(LD_ "DEBUG") || unsetenv(LD_ "ELF_HINTS_PATH")) { + _rtld_error("environment corrupt; aborting"); + die(); + } } ld_debug = getenv(LD_ "DEBUG"); libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL; ------------------- http://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/ ------------------- /pri/freebsd/releases grep -l unsetenv [4-8]*/src/libexec 6.3-RELEASE/src/libexec/rtld-elf/rtld.c 6.4-RELEASE/src/libexec/rtld-elf/rtld.c 7.1-RELEASE/src/libexec/rtld-elf/rtld.c 7.2-RELEASE/src/libexec/rtld-elf/rtld.c 8.0-RELEASE/src/libexec/rtld-elf/rtld.c