Re: [libtool 2.2.6] linking -static with uninstalled shared library generates invalid rpath
Bob Friesenhahn <bfriesen <at> simple.dallas.tx.us>
2009-11-04 18:25:01 GMT
On Wed, 4 Nov 2009, Stanislav Brabec wrote:
> When linking a binary which contains -static in its LDFLAGS and the
> library is linked against an uninstalled library which does not contain
> -static in its LDFLAGS and configure was called with --disable-static,
> libtool generates invalid command line that embeds RPATH to the
> uninstalled shared library location.
>
> It could be considered even as a security issue, as such binary may load
> malicious library from a possibly world writable area.
Is this true after the library/program has been installed with libtool
using --mode=finish?
Bob
>
> Attachment shows an example, where the final linking expands to:
>
> /bin/sh ./libtool --tag=CC --mode=link gcc -g -O2 -static -o hallolib hallolib-hallolib.o ./libhallo/libhallo.la
> libtool: link: gcc -g -O2 -o hallolib hallolib-hallolib.o ./libhallo/.libs/libhallo.so -Wl,-rpath -Wl,/home/sbrabec/libinvalid/libhallo/.libs
>
> Guessing thet the correct line should be:
> libtool: link: gcc -g -O2 -o .libs/hallolib hallolib-hallolib.o ./libhallo/.libs/libhallo.so
> and wrapper should be written
>
> --
> Best Regards / S pozdravem,
>
> Stanislav Brabec
(Continue reading)
* root wrote on Mon, Oct 26, 2009 at 04:04:32PM CET: > ## ------------------------- ## > ## libtool 2.2.6 test suite. ## > ## ------------------------- ## > > testsuite: command line was: > $ /home/hzs/MyEclipseWorkspace/xine/libtool-2.2.6/tests/testsuite MAKE=make CC=gcc CFLAGS=-g -O2 CPP=gcc -E CPPFLAGS= LD=/usr/bin/ld LDFLAGS= LIBS=-ldl LN_S=ln -s NM=/usr/bin/nm -B RANLIB=ranlib STRIP=strip OBJEXT=o EXEEXT= SHELL=/bin/sh CONFIG_SHELL=/bin/sh CXX=g++ CXXFLAGS=-g -O2 CXXCPP=g++ -E F77=g77 FFLAGS=-g -O2 FC=gfortran FCFLAGS=-g -O2 GCJ=gcj GCJFLAGS=-g -O2 _lt_pkgdatadir=/home/hzs/MyEclipseWorkspace/xine/libtool-2.2.6 LIBTOOLIZE=/home/hzs/MyEclipseWorkspace/xine/libtool-2.2.6/libtoolize LIBTOOL=/home/hzs/MyEclipseWorkspace/xine/libtool-2.2.6/libtool tst_aclocaldir=/home/hzs/MyEclipseWorkspace/xine/libtool-2.2.6/libltdl/m4 [...] > ERROR: 72 tests were run, > 16 failed (3 expected failures). > 2 tests were skipped. > > ## ------------------------ ## > ## Summary of the failures. ## > ## ------------------------ ## > Failed tests: > libtool 2.2.6 test suite test groups: > > NUM: FILE-NAME:LINE TEST-GROUP-NAME > KEYWORDS
RSS Feed