Hello, On Fri, 7 May 2021 at 02:21, Dave Chupreev <cdn.dev@xxxxxxxxx> wrote: > > Well I see, I've tried on Linux and yea I didn't find any option to insert multiple definitions. I think the only way to insert multiple definitions is by direct manipulation of 'extern char **environ'. Thanks, Michael > 06.05.2021, 01:37, "Alejandro Colomar (man-pages)" <alx.manpages@xxxxxxxxx>: > > [ added a few CCs ] > > Hello Dave, > > On 5/5/21 10:30 PM, Dave Chupreev wrote: > > Hello, Alejandro. > > On page 138 > > > I guess you refer to TLPI, written by Michael. > > > 1. > > Your version of /unsetenv() /should check to see whether there > are multiple definitions of an environment variable, and remove > them all. > > How can I add such variables which have many definitions? According to > *putenv* and *setenv* functions, variables with the same names are > replaced if encountered. > > > I haven't read that part of the book yet, so I ignore the context. But > AFAIK, that can't happen on Linux, as you pointed out (probably neither > on Unix systems in general, but I don't know for sure, probably Michael > does). I guess the only possibility is if an attacker somehow modified > your environment and inserted multiple copies of an env variable. > > The book (TLPI) states that glibc does check that, so I digged into the > sources and found that in <stdlib/setenv.c>, around line 290 > (<https://sourceware.org/git?p=glibc.git;a=blob;f=stdlib/setenv.c;h=893f081af6b5a21b999a4056757fd69d1386c0d4;hb=HEAD#l290>). > That behavior was introduced by Roland in commit > 196980f5117c8d38f10d64bf67eeb0924651675f > (<https://sourceware.org/git/?p=glibc.git;a=commit;h=196980f5117c8d38f10d64bf67eeb0924651675f>), > so maybe he can better explain the reasons behind the change (the commit > msg is quite unexplicative) if he still remembers (that goes back to 1995). > > Regards, > > Alex > > -- > Alejandro Colomar > Linux man-pages comaintainer; https://www.kernel.org/doc/man-pages/ > http://www.alejandro-colomar.es/ -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/
