FS#14000 - [subversion] insecure RPATHs

Attached to Project: Arch Linux
Opened by Allan McRae (Allan) - Sunday, 29 March 2009, 03:39 GMT
Last edited by Douglas Soares de Andrade (dsa) - Friday, 10 April 2009, 18:22 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Douglas Soares de Andrade (dsa)
Architecture All
Severity Critical
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
In the subversion package, a lot of the libraries in the /usr/lib/perl5/vendor_perl/auto/SVN/ have references to the build directory in their RPATH

e.g.
readelf -d /usr/lib/perl5/vendor_perl/auto/SVN/_Client/_Client.so | grep RPATH

File affected:
/usr/lib/perl5/vendor_perl/auto/SVN/_Client/_Client.so
/usr/lib/perl5/vendor_perl/auto/SVN/_Core/_Core.so
/usr/lib/perl5/vendor_perl/auto/SVN/_Delta/_Delta.so
/usr/lib/perl5/vendor_perl/auto/SVN/_Fs/_Fs.so
/usr/lib/perl5/vendor_perl/auto/SVN/_Ra/_Ra.so
/usr/lib/perl5/vendor_perl/auto/SVN/_Repos/_Repos.so
/usr/lib/perl5/vendor_perl/auto/SVN/_Wc/_Wc.so
This task depends upon

Closed by  Douglas Soares de Andrade (dsa)
Friday, 10 April 2009, 18:22 GMT
Reason for closing:  Fixed
Comment by Gerardo Exequiel Pozzi (djgera) - Thursday, 02 April 2009, 00:03 GMT
OK, here is the patch/workaround. The problem in this case is ExtUtils::MakeMaker can't control the rpath when generating Makefiles

This patch remove all references for LD_RUN_PATH for Makefiles* generated by ExtUtils::MakeMaker in subversion/bindings/swig/perl/native/
   subversion.fix.rpath.patch (0.7 KiB)

Loading...