VK_INSTANCE_LAYERS security inconsistent with VK_LOADER_LAYERS_* secutity

[pdaniell-nv]

I noticed in Vulkan SDK 1.4.313.0 the Vulkan loader treats the new VK_LOADER_LAYERS_* environment variables differently to the old deprecated VK_INSTANCE_LAYERS environment variable.

The new VK_LOADER_LAYERS_* environment variables include VK_LOADER_LAYERS_ENABLE, VK_LOADER_LAYERS_DISABLE and VK_LOADER_LAYERS_ALLOW. All of these are read from the environment in the loader code using loader_secure_getenv(). If the Vulkan loader is executed with elevated privileges then this function will return NULL and not allow these environment variables to be used. The theory being that an elevated application may execute an untrusted (at that level) layer dll and cause harm.

However, the old VK_INSTANCE_LAYERS environment variable uses the loader_getenv() function in the loader code, which reads the environment variable without restrictions.

Since the functionality of VK_INSTANCE_LAYERS is basically the same as VK_LOADER_LAYERS_ENABLE, this means a Vulkan application running with elevated privileges could enable an untrusted layer DLL. Also if VK_INSTANCE_LAYERS is used it overrides VK_LOADER_LAYERS_DISABLE causing a layer to be used even if the user wanted to disable it.

I think using loader_secure_getenv() makes sense for VK_LAYER_PATH, VK_IMPLICIT_LAYER_PATH, VK_ADD_LAYER_PATH and VK_ADD_IMPLICIT_LAYER_PATH, so rogue layer DLL search paths can't be added for elevated processes, but I don't think it make sense for VK_LOADER_LAYERS_ENABLE, VK_LOADER_LAYERS_DISABLE and VK_LOADER_LAYERS_ALLOW which causes legitimate enabling/disabling of trusted layers impossible. In fact the documentation at https://github.com/KhronosGroup/Vulkan-Loader/blob/main/docs/LoaderInterfaceArchitecture.md#active-environment-variables agrees with me since the "Ignored when running Vulkan application with elevated privileges." statement hasn't been added for VK_LOADER_LAYERS_ENABLE, VK_LOADER_LAYERS_DISABLE and VK_LOADER_LAYERS_ALLOW.

If you agree with the above, can the Vulkan loader be modified to allow VK_LOADER_LAYERS_ENABLE, VK_LOADER_LAYERS_DISABLE and VK_LOADER_LAYERS_ALLOW to be used with elevated privilege processes. This requires the calls to loader_secure_getenv() in parse_generic_filter_environment_var() and parse_layers_disable_filter_environment_var() to be modified to loader_getenv().