[lee at nerds.org.uk: LD_LIBRARY_PATH security checks]

[Tom Hukins]

On Tue, Jul 30, 2002 at 04:40:37PM +0100, Lee Brotherston wrote:
> 
> My points were really that I though that there should be the same
> security checks applied to LD_LIBRARY_PATH as there are to
> ldconfig....

Your points make sense to me.  Have you considered filing a PR about
this?  I've just searched GNATS and there doesn't seem to be anything
like this in there already.

> The other point was that the man page for ldconfig states the
> following when talking about setuid binaries: 
> 
> "LD_LIBRARY_PATH is not used to search for libraries"
> 
> Which is the case, unless you are root.  That's probably me being
> perdantic, but might be worth clarifying?

The docs certainly should reflect how programs behave.  I'd consider
this worthy of a separate PR with a brief "How-To-Repeat" section
demonstrating a test case that proves the existing docs wrong.

Thanks,
Tom