diff -up openssl-fips-0.9.8e/crypto/conf/conf_api.c.secure-getenv openssl-fips-0.9.8e/crypto/conf/conf_api.c

--- openssl-fips-0.9.8e/crypto/conf/conf_api.c.secure-getenv	2013-07-17 11:38:28.172584638 +0200

+++ openssl-fips-0.9.8e/crypto/conf/conf_api.c	2013-07-17 11:44:13.779925448 +0200

@@ -62,6 +62,8 @@

 # undef NDEBUG /* avoid conflicting definitions */

 # define NDEBUG

 #endif

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <assert.h>

 #include <string.h>

@@ -145,7 +147,7 @@ char *_CONF_get_string(const CONF *conf,

 			if (v != NULL) return(v->value);

 			if (strcmp(section,"ENV") == 0)

 				{

-				p=Getenv(name);

+				p=secure_getenv(name);

 				if (p != NULL) return(p);

 				}

 			}

@@ -158,7 +160,7 @@ char *_CONF_get_string(const CONF *conf,

 			return(NULL);

 		}

 	else

-		return(Getenv(name));

+		return(secure_getenv(name));

 	}

 #if 0 /* There's no way to provide error checking with this function, so

diff -up openssl-fips-0.9.8e/crypto/conf/conf_mod.c.secure-getenv openssl-fips-0.9.8e/crypto/conf/conf_mod.c

--- openssl-fips-0.9.8e/crypto/conf/conf_mod.c.secure-getenv	2013-07-17 11:38:28.173584642 +0200

+++ openssl-fips-0.9.8e/crypto/conf/conf_mod.c	2013-07-17 11:44:37.188017398 +0200

@@ -56,6 +56,8 @@

  *

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <stdio.h>

 #include <ctype.h>

 #include <openssl/crypto.h>

@@ -548,8 +550,8 @@ char *CONF_get1_default_config_file(void

 	char *file;

 	int len;

-	file = getenv("OPENSSL_CONF");

-	if (file) 

+	file = secure_getenv("OPENSSL_CONF");

+	if (file)

 		return BUF_strdup(file);

 	len = strlen(X509_get_default_cert_area());

diff -up openssl-fips-0.9.8e/crypto/engine/eng_list.c.secure-getenv openssl-fips-0.9.8e/crypto/engine/eng_list.c

--- openssl-fips-0.9.8e/crypto/engine/eng_list.c.secure-getenv	2005-08-06 12:34:35.000000000 +0200

+++ openssl-fips-0.9.8e/crypto/engine/eng_list.c	2013-07-17 11:42:52.210608034 +0200

@@ -61,6 +61,8 @@

  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include "eng_int.h"

 /* The linked-list of pointers to engine types. engine_list_head

@@ -398,9 +400,9 @@ ENGINE *ENGINE_by_id(const char *id)

 	if (strcmp(id, "dynamic"))

 		{

 #ifdef OPENSSL_SYS_VMS

-		if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = "SSLROOT:[ENGINES]";

+		if(OPENSSL_issetugid() || (load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = "SSLROOT:[ENGINES]";

 #else

-		if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = ENGINESDIR;

+		if((load_dir = secure_getenv("OPENSSL_ENGINES")) == 0) load_dir = ENGINESDIR;

 #endif

 		iterator = ENGINE_by_id("dynamic");

 		if(!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) ||

diff -up openssl-fips-0.9.8e/crypto/o_init.c.secure-getenv openssl-fips-0.9.8e/crypto/o_init.c

--- openssl-fips-0.9.8e/crypto/o_init.c.secure-getenv	2013-07-17 11:38:28.232584911 +0200

+++ openssl-fips-0.9.8e/crypto/o_init.c	2013-07-17 11:41:57.060391907 +0200

@@ -56,6 +56,8 @@

  *

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <e_os.h>

 #include <openssl/err.h>

@@ -77,7 +79,7 @@ static void init_fips_mode(void)

 	char buf[2] = "0";

 	int fd;

-	if (getenv("OPENSSL_FORCE_FIPS_MODE") != NULL)

+	if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL)

 		{

 		buf[0] = '1';

 		}

diff -up openssl-fips-0.9.8e/crypto/rand/randfile.c.secure-getenv openssl-fips-0.9.8e/crypto/rand/randfile.c

--- openssl-fips-0.9.8e/crypto/rand/randfile.c.secure-getenv	2007-03-02 18:44:55.000000000 +0100

+++ openssl-fips-0.9.8e/crypto/rand/randfile.c	2013-07-17 11:43:29.891755269 +0200

@@ -58,6 +58,8 @@

 /* We need to define this to get macros like S_IFBLK and S_IFCHR */

 #define _XOPEN_SOURCE 500

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <errno.h>

 #include <stdio.h>

@@ -231,8 +233,7 @@ const char *RAND_file_name(char *buf, si

 	struct stat sb;

 #endif

-	if (OPENSSL_issetugid() == 0)

-		s=getenv("RANDFILE");

+	s=secure_getenv("RANDFILE");

 	if (s != NULL && *s && strlen(s) + 1 < size)

 		{

 		if (BUF_strlcpy(buf,s,size) >= size)

@@ -240,8 +241,7 @@ const char *RAND_file_name(char *buf, si

 		}

 	else

 		{

-		if (OPENSSL_issetugid() == 0)

-			s=getenv("HOME");

+		s=secure_getenv("HOME");

 #ifdef DEFAULT_HOME

 		if (s == NULL)

 			{

diff -up openssl-fips-0.9.8e/crypto/x509/by_dir.c.secure-getenv openssl-fips-0.9.8e/crypto/x509/by_dir.c

--- openssl-fips-0.9.8e/crypto/x509/by_dir.c.secure-getenv	2007-02-18 18:23:20.000000000 +0100

+++ openssl-fips-0.9.8e/crypto/x509/by_dir.c	2013-07-17 11:45:03.612126552 +0200

@@ -56,6 +56,8 @@

  * [including the GNU Public Licence.]

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <stdio.h>

 #include <time.h>

 #include <errno.h>

@@ -123,7 +125,7 @@ static int dir_ctrl(X509_LOOKUP *ctx, in

 	case X509_L_ADD_DIR:

 		if (argl == X509_FILETYPE_DEFAULT)

 			{

-			dir=(char *)Getenv(X509_get_default_cert_dir_env());

+			dir=(char *)secure_getenv(X509_get_default_cert_dir_env());

 			if (dir)

 				ret=add_cert_dir(ld,dir,X509_FILETYPE_PEM);

 			else

diff -up openssl-fips-0.9.8e/crypto/x509/by_file.c.secure-getenv openssl-fips-0.9.8e/crypto/x509/by_file.c

--- openssl-fips-0.9.8e/crypto/x509/by_file.c.secure-getenv	2013-07-17 11:38:28.127584434 +0200

+++ openssl-fips-0.9.8e/crypto/x509/by_file.c	2013-07-17 11:45:22.708202388 +0200

@@ -56,6 +56,8 @@

  * [including the GNU Public Licence.]

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <stdio.h>

 #include <time.h>

 #include <errno.h>

@@ -100,7 +102,7 @@ static int by_file_ctrl(X509_LOOKUP *ctx

 	case X509_L_FILE_LOAD:

 		if (argl == X509_FILETYPE_DEFAULT)

 			{

-			file = (char *)Getenv(X509_get_default_cert_file_env());

+			file = (char *)secure_getenv(X509_get_default_cert_file_env());

 			if (file)

 				ok = (X509_load_cert_crl_file(ctx,file,

 					      X509_FILETYPE_PEM) != 0);

diff -up openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.secure-getenv openssl-fips-0.9.8e/crypto/x509/x509_vfy.c

--- openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.secure-getenv	2013-07-17 11:38:28.396585612 +0200

+++ openssl-fips-0.9.8e/crypto/x509/x509_vfy.c	2013-07-17 11:45:49.733310202 +0200

@@ -56,6 +56,8 @@

  * [including the GNU Public Licence.]

  */

+/* for secure_getenv */

+#define _GNU_SOURCE

 #include <stdio.h>

 #include <time.h>

 #include <errno.h>

@@ -414,7 +416,7 @@ static int check_chain_extensions(X509_S

 	/* A hack to keep people who don't want to modify their software

 	   happy */

-	if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))

+	if (secure_getenv("OPENSSL_ALLOW_PROXY_CERTS"))

 		allow_proxy_certs = 1;

 	/* Check all untrusted certificates */