glibc: use secure_getenv for loading locale archive

To quote `getenv(3)`:

> The  GNU-specific  secure_getenv()  function  is just like
> getenv() except that it returns NULL in cases where "secure
> execution" is required.

One of these cases is running in setuid mode. In this case, one could
make `sudo` load an arbitrary file as locale archive by modifying the
LOCALE_ARCHIVE env variable accordingly.

After consultation with the security team we came to the conclusion that
this is not exploitable by itself since it'd need another issue that
can be triggered by a maliciously crafted locale archive. Since this is
a valid issue nonetheless[1], I decided to fix it, but go through the
normal PR & staging lifecycle.

This patch also adds another fallback to
`/run/current-system/sw/lib/locale/locale-archive`: otherwise `sudo`
would fail to load any locale archive since that would be in
LOCALE_ARCHIVE/LOCALE_ARCHIVE_2_27 and thus setuid programs would
regress on translated output.

Thank you to Elliot Cameron for reporting this.

[1] glibc's internal environment filtering also prevents setuid
    processes to use certain locale settings from the environment
    such as LOCPATH.

0 files changed, 0 insertions, 0 deletions