For "sensitive" processes, we always set the 'A' flag which causes abort()

to be called on first sight of trouble.

"sensitive" is somewhat arbitrarily defined as "setuid, setgid, uid == root
or gid == wheel".

The 'A' option carries no performance penalty.

It is not possible to override this setting: fix the program instead.

Absentmindedly nodded OK to by:    various

1 files changed, 7 insertions, 0 deletions

diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c
index fdcc751..3cd58f7 100644
--- a/lib/libc/stdlib/malloc.c
+++ b/lib/libc/stdlib/malloc.c
@@ -465,6 +465,13 @@ malloc_init ()
 	}
     }
 
+    /*
+     * Sensitive processes, somewhat arbitrarily defined here as setuid,
+     * setgid, root and wheel cannot afford to have malloc mistakes.
+     */
+    if (issetugid() || getuid() == 0 || getgid() == 0)
+	    malloc_abort = 1;
+
     UTRACE(0, 0, 0);
 
     /*