Arch Linux

Hi,

(first: sorry my very bad english)

I see that many executables and libraries in Arch Linux don't take care about rpath in package creation step.

Then when executed, the ld-linux will find libraries first in the rpath , and if fails will go to search in the cache ld.so.cache, instead of directly search here) So for example if you execute the... setfacl/getfacl/chacl (in package from core/acl, and this is the only package in [core] that have this issue with binaries) will find in libs in varius incorrects paths for example:

$ readelf -d /usr/bin/getfacl | grep RPATH
0x0000000f (RPATH) Library rpath: [/home/thomas/arch/repos/core/base/acl/pkg/usr/lib]

$ LD_DEBUG=libs setfacl
10323: find library=libacl.so.1 [0]; searching
10323: search (*** stripped here same paths below... ***)
(RPATH from file setfacl)
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/tls/i686/sse2/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/tls/i686/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/tls/sse2/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/tls/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/i686/sse2/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/i686/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/sse2/libacl.so.1
10323: trying file=/home/thomas/arch/repos/core/base/acl/pkg/usr/lib/libacl.so.1
10323: search cache=/etc/ld.so.cache
10323: trying file=/lib/libacl.so.1
10323:


The issue here is for example if a user "thomas" in my system, create a libacl.so.1 in any of these paths, the setfacl will use them insteads of the correct libacl.so.1, and if the libacl.so.1 from thomas contain a malicious code, the user that execute it are in problem :(, root for example.

OK managing rpath at build time vary from package to package, some that uses autotools/libtool, the configure script, have a --disable-rpath for controling this behavior, and other don't have. Others require rpath at build time to linking executables from the same source, and other always hardcore it (gcc -Wl,--rpath...), etc, etc.
In libtool, can change a M4 macro to don't use rpath for example.

There is a simple tool, to remove rpath from ELF files called chrpath [#1] (seems that cmake build system can use an aproach based on chrpath to delete rpath from ELF)

For example:

# /bin/ls -l /usr/bin/setfacl
-rwxr-xr-x 1 root root 25052 2008-02-26 13:23 /usr/bin/setfacl
# chrpath -d /usr/bin/setfacl
# /bin/ls -l /usr/bin/setfacl
-rwxr-xr-x 1 root root 25052 2009-03-20 01:06 /usr/bin/setfacl
# LD_DEBUG=libs setfacl
11033: find library=libacl.so.1 [0]; searching
11033: search cache=/etc/ld.so.cache
11033: trying file=/lib/libacl.so.1

And now is correct and secure.

The minor problem here, _and don't make much sense_ is that will do some aditionals system calls open() and stat64() for each inexistent libs on loading.
Many others have /usr/lib (and many many others paths) as rpath, then when execute will look for the first library that need to load at /usr/lib/tls/i686/sse2:/usr/lib/tls/i686:/usr/lib/tls/sse2:/usr/lib/tls:/usr/lib/i686/sse2:/usr/lib/i686:/usr/lib/sse2 (and these are removed from search path for next libs), and then for all libs will look first in /usr/lib if fails do a /etc/ld.so.cache search.

The rpath is important when managing many versions of the same libs with same soname, for example for debuging/testing purposes, running from the builddir, etc.

For example i see googling that in some distros (like Debian[s]) and in some BSDs the rpath is removed from all ELF files, except that in that is necessary required.



Then my question: what is the position of arch-dev-team about rpath? (remember: don't take this as a mail as feature request, is just one
question)



[#1] chrpath: The original home don't work http://directory.fsf.org/project/chrpath/ i use a debian mirror in my PKGBUILD http://aur.archlinux.org/packages.php?ID=24818