ncoghlan created an issue (rpm-software-management/rpm#4266)
**Describe the bug**
Specifying `/usr/local/lib` or `/usr/local/lib64` (note the lack of a trailing
`/`) is confusingly reported as "invalid RPATHs; these are RPATHs which are
neither absolute nor relative filenames and can therefore be a SECURITY risk"
**To Reproduce**
Steps to reproduce the behavior:
1. In an RPM spec file, specify `/usr/local/lib` or `/usr/local/lib64` (no
trailing slashes) in a binary's `RPATH`
2. Get a 0x0002 error from `check-rpaths` when building that RPM
**Expected behavior**
These are absolute paths to root-owned directories that are not on the default
library loading path, so no error is expected.
**Output**
Standard error message for 0x0002.
**Environment**
- Rocky Linux 9.8
- RPM version 4.16.1.3
**Additional context**
As currently implemented, the nominal description of category 0x0002 is not
accurate, as there are plenty of absolute paths which are still not considered
valid by `check-rpaths` (anything under `/opt`, for example:
https://stackoverflow.com/questions/58372820/rpmbuild-check-rpath-reports-error-that-path-is-not-absolute-incorrectly).
The specific error described in this issue arises from the wildcard patterns in
https://github.com/rpm-software-management/rpm/blob/375bdcdca7652755cdfdd1035f9d34250af48eff/scripts/check-rpaths-worker#L118
all ending with `/*`, so they accept subdirectories as valid, but not the
named directories themselves (unless they are specified with a trailing slash)
For the standard directories that emit 0x0001 if listed in `RPATH`, that
restriction in the pattern matching makes sense. However, those have the
inverse problem, where including the trailing slash *bypasses* the 0x0001 error.
For the approved directories, the restriction is confusing as there's nothing
in the error message suggesting that `/usr/local/lib` and `/usr/local/lib/`
will be treated differently (the latter being acceptable, the former giving an
error)
Similarly, for unapproved prefixes like `/opt/`, there's nothing in the error
message suggesting that the problem is with `/opt` not being on the approved
list of library installation directories, even though the given `RPATH` entry
is an absolute path.
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/4266
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/issues/[email protected]>
_______________________________________________
Rpm-maint mailing list
[email protected]
https://lists.rpm.org/mailman/listinfo/rpm-maint
