Bug 190122 - --enable-dso results in bogus rpath
--enable-dso results in bogus rpath
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: proftpd (Show other bugs)
rawhide
All Linux
high Severity high
: ---
: ---
Assigned To: Matthias Saou
Fedora Extras Quality Assurance
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-04-27 15:38 EDT by Paul Howarth
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version: 1.3.0-2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-05-02 11:43:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Paul Howarth 2006-04-27 15:38:45 EDT
Description of problem:
Using --enable-dso in proftpd's configure script causes the following to be
included in the resulting Makefile:

MAIN_LDFLAGS=-L$(top_srcdir)/lib/libltdl -dlopen self -export-dynamic 
-rpath $(DESTDIR)$(sbindir)

This in turn results in a bogus rpath in the built binary:

$ rpmlint proftpd-1.3.0-1.fc6.i386.rpm
E: proftpd binary-or-shlib-defines-rpath /usr/sbin/proftpd 
['/var/tmp/proftpd-1.3.0-1.fc6-root/usr/sbin']
...

Version-Release number of selected component (if applicable):
1.3.0-1.fc6

How reproducible:
Every time.

Steps to Reproduce:
1. Build proftpd with --enable-dso and a buildroot
2. Check rpaths in resulting binary.
  
Actual results:
Bogus rpath

Expected results:
No bogus rpath :-)

Additional info:
I guess this is potentially a security issue. Is the rpath needed at all in
Linux? I don't know enough about the workings of linkers to say myself.
Comment 1 Matthias Saou 2006-04-28 05:18:44 EDT
Indeed, very very ugly. I'm no linking expert either, but I kind of fail to
understand the use -rpath can have in this case anyway.
I've pushed a rebuild with that very wrong rpath removed.
Comment 2 Paul Howarth 2006-04-28 05:23:36 EDT
(In reply to comment #1)
> Indeed, very very ugly. I'm no linking expert either, but I kind of fail to
> understand the use -rpath can have in this case anyway.

Perhaps it's related to this configure test?

checking whether a program can dlopen itself... yes

Maybe the rpath is needed for this in some environments?
Comment 3 Matthias Saou 2006-05-02 11:43:48 EDT
I doubt it's of any use here... I've removed that bogus rpath and rebuilt the
package. Even if it's needed, having $DESTDIR in it is plain wrong.

Note You need to log in before you can comment on or make changes to this bug.