Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Feb 2015 00:14:47 -0800
From: Paul Pluzhnikov <>
To: Rich Felker <>
Subject: Re: Fixing the glibc runtime linker

On Thu, Feb 19, 2015 at 11:57 PM, Rich Felker <> wrote:

> How is an empty or relative rpath easy?

all: foo
foo: foo.c
        ${CC} -Wl,-rpath=${VAR} -o $@ $^

If VAR is unset, or set to relative path, resulting binary will be "bad".

Quoting original Tim's message:

> Over the last couple of years I've spent a good deal of time dealing with
> vendors who, for one reason or another have shipped binaries where it is
> possible to inject "untrusted" code into running processes, notably but not
> exclusively via DT_RPATH.

I can easily believe that such binaries are fairly common.

Paul Pluzhnikov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.