glib should attempt to use secure_getenv / check for issetugid
Submitted by coy..@..df.org
Link to original bug (#791151)
Description
Hi,
glib's g_getenv could be a wrapper that attempts to use secure_getenv or similar.
glib as a library doesn't have control over where it's used. someone could use it in a setuid root program, or add the more dangerous OS capabilities, and not be aware of exposing himself to significant risk.
gnulib's fallback secure_getenv is good for this purpose.
Additionally glib internally uses getenv as-is, so these should be adapted too.