James Tucker ff3bb58830 ssh/tailssh: validate accepted env values, deny GLIBC_TUNABLES, cap names ...

GLIBC_TUNABLES is parsed by glibc in root su/login environments with
AT_SECURE=0 (CVE-2023-4911 class); add it to the dangerous-env-var
denylist next to its GCONV_PATH/LOCPATH siblings.

The TERM/LANG/LC_* pairs accepted without policy (OpenSSH's default
AcceptEnv) had unvalidated values that reach root-exec'd login/su
environments, where glibc treats path-like locale names as locale-data
paths and leading dashes as its own options. Reject path- and
option-like values (and NUL, which would truncate on exec) instead of
trying to sanitize them.

Also cap accepted env var names at 256 bytes before any wildcard
matching, bounding the matcher input and the child's "su -w" allowlist;
real names are short (LOGIN_NAME_MAX).

Updates tailscale/corp#50380

Signed-off-by: James Tucker <james@tailscale.com>

2026-10-24 13:55:35 -07:00

..

tailssh

ssh/tailssh: validate accepted env values, deny GLIBC_TUNABLES, cap names

2026-10-24 13:55:35 -07:00