api: drop KASLD_* on a privilege-gaining exec

KASLD_COMPONENT_DIR and KASLD_EXEC_WRAPPER name programs kasld executes,
and KASLD_SYSROOT names the files it reads. Nothing stripped them, so a
set-uid or set-gid install, or one carrying file capabilities, handed
whoever set them code execution at that privilege. The dynamic loader
sanitises only the variables it owns and these are ordinary ones. No
install here sets those bits — the install target uses mode 755
throughout — but nothing would notice if that changed, and setcap on a
tool that reads /proc/kallsyms and the kernel log is a plausible step for
someone to take.

A constructor in api.h, which the orchestrator and every component
include, unlinks each KASLD_ entry from environ when getauxval(AT_SECURE)
reports the exec gained privilege, falling back to a uid/gid comparison
where the auxiliary vector carries no such entry. AT_SECURE is the only
one of the two that accounts for file capabilities.

The whole prefix goes rather than a list of names, so a variable added
later needs no change here. Removing the entries rather than ignoring
them at each read also cleans what the component children inherit, which
matters because a child gains no privilege at its own exec and cannot
detect the case itself. environ is edited directly because unsetenv is
not declared under the strict -std=c99 compile that check-headers builds
api.h as.

Nothing aborts: a privileged install still runs, on its own configuration
rather than a caller's. The removal is covered over a synthetic prefix,
since dropping the real one in-process would take the staged sysroot with
it and send every later test to the live host. kasld(1) records the
behaviour beside the env_reset note it already carried.

Author: bcoles

man/kasld.1

@@ -187,6 +187,13 @@ rule with
 or
 .BR SETENV ,
 or any wrapper that elevates while keeping the environment, does not.
+.B kasld
+covers the remaining case itself: where the kernel marks the exec as
+privilege-gaining \(em a set-uid or set-gid binary, or one carrying file
+capabilities \(em every
+.B KASLD_*
+variable is dropped before it is read, and the run proceeds on its own
+configuration.
 .TP
 .B KASLD_COMPONENT_DIR
 Directory to load component binaries from, overriding the default search

src/include/kasld/api.h

@@ -1228,6 +1228,8 @@ static inline unsigned long arch_default_phys_text_base(void) { return 0; }
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/auxv.h>
+#include <unistd.h>
 
 /* Filesystem-fact reads route through the KASLD_SYSROOT redirection layer so a
  * copied filesystem tree can be analyzed offline. api.h is kasld's universal
@@ -2427,6 +2429,72 @@ __attribute__((constructor)) static void kasld_init_buffering(void) {
   setvbuf(stdout, NULL, _IOLBF, 0);
 }
 
+/* environ is undeclared under a strict -std=c99 compile and declared by
+ * unistd.h under a feature-test macro, so this covers the first case and the
+ * pragma the second, whichever order a translation unit reaches them in. */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wredundant-decls"
+extern char **environ;
+#pragma GCC diagnostic pop
+
+/* Unlink every environment entry whose name starts with `prefix`.
+ *
+ * The entries are removed from environ directly. unsetenv() is the obvious
+ * call and is not declared under a strict -std=c99 compile, whereas environ
+ * needs no library function at all; getenv() reads the same array, so a name
+ * removed here is a name no later read can find. The strings themselves are
+ * left alone — they may not be the allocator's to release. */
+__attribute__((unused)) static void kasld_env_drop_prefix(const char *prefix) {
+  size_t n = strlen(prefix);
+  char **src, **dst;
+
+  if (environ == NULL)
+    return;
+  for (src = dst = environ; *src != NULL; src++) {
+    if (strncmp(*src, prefix, n) == 0)
+      continue;
+    *dst++ = *src;
+  }
+  *dst = NULL;
+}
+
+/* Non-zero when this exec gained privilege: a set-uid or set-gid binary, or
+ * one carrying file capabilities.
+ *
+ * AT_SECURE is the kernel's own verdict and the only one of the two tests that
+ * accounts for file capabilities; the uid/gid comparison stands in where the
+ * auxiliary vector carries no such entry. */
+__attribute__((unused)) static int kasld_exec_gained_privilege(void) {
+  unsigned long secure;
+  int gained;
+
+  errno = 0;
+  secure = getauxval(AT_SECURE);
+  gained = (secure == 0 && errno != 0)
+               ? (getuid() != geteuid()) || (getgid() != getegid())
+               : (secure != 0);
+  errno = 0;
+  return gained;
+}
+
+/* An exec that gained privilege holds rights its caller does not, while the
+ * caller still chose the environment it started in. KASLD_COMPONENT_DIR and
+ * KASLD_EXEC_WRAPPER name programs this process executes and KASLD_SYSROOT
+ * names the files it reads, so honouring them there lends those rights to
+ * whoever set them. The dynamic loader strips only the variables it owns;
+ * these are not among them.
+ *
+ * The whole KASLD_ prefix goes, so a variable added later needs no change
+ * here. Dropping the entries rather than ignoring them at each read also
+ * cleans the environment the orchestrator's component children inherit, which
+ * matters because those children gain no privilege of their own at exec and so
+ * cannot detect the case themselves. Nothing aborts: a privileged install
+ * still runs, on its own configuration rather than a caller's. */
+__attribute__((constructor)) static void kasld_drop_inherited_env(void) {
+  if (kasld_exec_gained_privilege())
+    kasld_env_drop_prefix("KASLD_");
+}
+
 /* Suppress -Wpedantic "ISO C forbids an empty translation unit". */
 typedef int make_iso_compilers_happy;
 

tests/test_kasld.c

@@ -3127,6 +3127,54 @@ static void test_vantage_oracle_readable_each_path(void) {
   th_sysroot_clear();
 }
 
+/* The removal half of the privilege-gaining environment guard. The detection
+ * half is not exercisable here: this process gained no privilege at exec, and
+ * making one that did needs a set-uid install.
+ *
+ * A synthetic prefix is used rather than the real KASLD_ one. Dropping that
+ * prefix in-process would take the staged KASLD_SYSROOT with it and send every
+ * later test to the live host — which is the hazard, not an inconvenience. */
+static void test_env_drop_prefix_removes_only_the_prefix(void) {
+  setenv("KASLDTEST_ALPHA", "1", 1);
+  setenv("KASLDTEST_BETA", "2", 1);
+  setenv("KASLDTESTNOUNDERSCORE", "keep", 1);
+  setenv("PATH_KASLDTEST_MIDDLE", "keep", 1);
+
+  assert(getenv("KASLDTEST_ALPHA") != NULL);
+  assert(getenv("PATH") != NULL);
+
+  kasld_env_drop_prefix("KASLDTEST_");
+
+  /* Every name carrying the prefix goes, including one no read site knows
+   * about — the property that keeps a variable added later covered. */
+  assert(getenv("KASLDTEST_ALPHA") == NULL);
+  assert(getenv("KASLDTEST_BETA") == NULL);
+
+  /* A name merely beginning with the same letters, or carrying them in the
+   * middle, is not the prefix and stays. */
+  assert(getenv("KASLDTESTNOUNDERSCORE") != NULL);
+  assert(getenv("PATH_KASLDTEST_MIDDLE") != NULL);
+
+  /* Unrelated entries survive, the staged sysroot among them, and the block is
+   * still a well-formed environment that setenv and getenv work over. */
+  assert(getenv("PATH") != NULL);
+  assert(getenv("KASLD_SYSROOT") != NULL);
+  setenv("KASLDTEST_GAMMA", "3", 1);
+  assert(getenv("KASLDTEST_GAMMA") != NULL);
+
+  kasld_env_drop_prefix("KASLDTEST_");
+  assert(getenv("KASLDTEST_GAMMA") == NULL);
+  assert(getenv("KASLDTESTNOUNDERSCORE") != NULL);
+}
+
+/* An ordinary run must not lose its environment: the constructor has already
+ * run by the time any test does, and it must have changed nothing. */
+static void test_unprivileged_exec_keeps_its_environment(void) {
+  assert(kasld_exec_gained_privilege() == 0);
+  assert(getenv("PATH") != NULL);
+  assert(getenv("KASLD_SYSROOT") != NULL);
+}
+
 int main(void) {
   th_sysroot_init("kasld");
   TEST_SUITE("test_kasld");
@@ -3246,6 +3294,8 @@ int main(void) {
   RUN(test_vantage_group_names);
   RUN(test_unread_marker_separates_denial_from_absence);
   RUN(test_environment_defaults_to_unknown);
+  RUN(test_env_drop_prefix_removes_only_the_prefix);
+  RUN(test_unprivileged_exec_keeps_its_environment);
   RUN(test_vantage_mac_absent_then_present);
   RUN(test_vantage_oracle_readable_each_path);
   RUN(test_discard_ledger_aggregates_and_reports_truncation);