runc icon indicating copy to clipboard operation
runc copied to clipboard

[carry 1738] Clear hook environ variables on empty Env

Open lifubang opened this issue 2 months ago • 4 comments

Carry #1738


The runtime spec has:

  • env (array of strings, OPTIONAL) with the same semantics as IEEE Std 1003.1-2008's environ.

And running execle or similar with NULL env results in an empty environent:

$ cat test.c
#include <unistd.h>

int main()
{
  return execle("/usr/bin/env", "env", NULL, NULL);
}
$ cc -o test test.c
$ ./test
…no output…

Go's Cmd.Env, on the other hand, has:

If Env is nil, the new process uses the current process's environment.

This commit works around that by setting ~~a single dummy environment variable~~ []string{} in those cases to avoid leaking the runtime environment into the hooks.

lifubang avatar Jun 19 '24 14:06 lifubang