diff options
| author | Zac Medico <zmedico@gentoo.org> | 2007-12-07 22:21:24 +0000 |
|---|---|---|
| committer | Zac Medico <zmedico@gentoo.org> | 2007-12-07 22:21:24 +0000 |
| commit | 224b56c64db83e444da6e2cab20b35659bcae854 (patch) | |
| tree | 3678470576b7f7eb138f835c85bbead4a0a37c21 | |
| parent | bbb055dfd0ecc43ee4c11b940b80d5486b32587b (diff) | |
| download | portage-224b56c64db83e444da6e2cab20b35659bcae854.tar.gz portage-224b56c64db83e444da6e2cab20b35659bcae854.tar.bz2 portage-224b56c64db83e444da6e2cab20b35659bcae854.zip | |
Bug #189417 - Comment on how the whitelist and BASH_ENV are used to
prevent environment leakage.
svn path=/main/trunk/; revision=8867
| -rw-r--r-- | pym/portage/__init__.py | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/pym/portage/__init__.py b/pym/portage/__init__.py index dbbe97e3a..711355e01 100644 --- a/pym/portage/__init__.py +++ b/pym/portage/__init__.py @@ -860,9 +860,14 @@ class config(object): _environ_whitelist = [] - # Preserve backupenv values that are initialized in the config - # constructor. Also, preserve XARGS since it is set by the - # portage.data module. + # Whitelisted variables are always allowed to enter the ebuild + # environment. Generally, this only includes special portage + # variables. Ebuilds can unset variables that are not whitelisted + # and rely on them remaining unset for future phases, without them + # leaking back in from various locations (bug #189417). It's very + # important to set our special BASH_ENV variable in the ebuild + # environment in order to prevent sandbox from sourcing /etc/profile + # in it's bashrc (causing major leakage). _environ_whitelist += [ "BASH_ENV", "BUILD_PREFIX", "D", "DISTDIR", "DOC_SYMLINKS_DIR", "EBUILD_EXIT_STATUS_FILE", |