You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ubuntu 22.04 patched ld.so with local-disable-ld_audit.diff, a patch that offers:
No security benefits - what it is aiming to prevent is already offered by other components of glibc making it trivial to bypass, and the patch itself relies on invalid assumptions about current glibc security countermeasures in an effort to mitigate a decade-old (patched) security vulnerability
Breaks glibc-provided features - patch mentions that it is unlikely to be merged upstream due to breaking changes limiting the auditing features of the linker
No configuration options - breaks LD_AUDIT fundamentally including recent (2020) binary flags that would be otherwise unaffected if the patch was better designed
Despite this unfortunate change, there are two paths forward:
Offer WhiteBeam repositories that provide a patched libc6 package on Ubuntu 22.04, which is helpful for out of date ARM systems regardless (all Ubuntu versions prior to 22.04 ship with < glibc 2.35 which has audit fixes and v2 of the API)
Inform Ubuntu developers that one of the 9 patches of glibc causes breaking changes and to revert it, or to add configuration options to not fundamentally break LD_AUDIT for SUID binaries
The text was updated successfully, but these errors were encountered:
Ubuntu 22.04 patched ld.so with local-disable-ld_audit.diff, a patch that offers:
Despite this unfortunate change, there are two paths forward:
The text was updated successfully, but these errors were encountered: