[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #13062 [Tor bundles/installation]: Specifying tor's libevent and openssl directories adds -L/RPATH
#13062: Specifying tor's libevent and openssl directories adds -L/RPATH
-------------------------------------------------+-------------------------
Reporter: mikeperry | Owner: erinn
Type: defect | Status: new
Priority: normal | Milestone:
Component: Tor bundles/installation | Version:
Keywords: tbb-security, gitian, | Actual Points:
TorBrowserTeam201409 | Points:
Parent ID: |
-------------------------------------------------+-------------------------
The configure script to Tor has arguments that allow the specification of
a non-standard libevent and openssl (--with-libevent-dir=PATH and --with-
openssl-dir=PATH). Unfortunately, these arguments also add -L to the
linking step for these directories, which creates an RPATH entry in the
resulting tor binary such that these directories become part of the
library search path. For TBB, this results in creating the ability for
code injection via creation of .so files in /home/ubuntu/install/, as
reported by this troll`^W`concerned user:
https://blog.torproject.org/blog/tor-browser-365-and-40-alpha-2-are-
released#comment-74540
I suppose we can set LD_LIBRARY_PATH and C_INCLUDE_PATH prior to
configure/make instead, which I think will just cause gcc to search these
directories during build without emitting an RPATH for them.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13062>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs