Hi Everyone. I'm building ghostpdl-9.53.1.tar.gz on Ubuntu 18.04 x86_64 fully patched. It looks like the build system is mishandling ORIGIN-based runpaths.

This is from a script I use to audit binaries after installation:

  $ ./audit-rpath-bins.sh ~/tmp/ok2delete/bin
  ...
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/gxps:

  (RUNPATH) [/../lib:/home/jwalton/tmp/ok2delete/lib]
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/gs:

  (RUNPATH) [/../lib:/home/jwalton/tmp/ok2delete/lib]
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/gpcl6:

  (RUNPATH) [/../lib:/home/jwalton/tmp/ok2delete/lib]

My LDFLAGS has the following flags. It looks like '$ORIGIN/../lib' is being munged.

  LDFLAGS: -L/home/jwalton/tmp/ok2delete/lib -Wl,-R,'$ORIGIN/../lib' -Wl,-R,/home/jwalton/tmp/ok2delete/lib -Wl,--enable-new-dtags -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,origin

We have to pass '$ORIGIN/../lib' in LDFLAGS because Autotools features test runs its tests using LDFLAGS. However, later, when makefiles are written, the '$' (dollar sign) needs to be escaped because '$' is a special character in a makefile. That is, when makefiles are written, the makefile should use '$$ORIGIN/../lib'.

Autotools usually handles this for you (escaping '$' in makefiles). I'm not sure why it is not being handled for you in this case.

I have a script that fixes mishandled escapes in makefiles: https://github.com/noloader/Build-Scripts/blob/master/fix-makefiles.sh. I run it after './configure' to escape '$ORIGIN' to '$$ORIGIN'. The script is not fixing them either. That makes me believe _all_ makefiles are not written after './configure'. I've seen that happen when makefiles are written on the fly, and I never have an opportunity to fix them.

The other possibility is the makefiles don't have CPPFLAGS, CFLAGS and LDFLAGS written at configure time. In this case, a Makefile is called with the flags set at build time. That is, 'make CPPFLAGS=...' CFLAGS='...' LDFLAGS='...''. In this case, the dollar signs need to be escaped before calling make. GhostScript needs to something like this: https://github.com/noloader/Build-Scripts/blob/master/build-bzip.sh#L117.

You can manually audit RPATHs and RUNPATHs with:

    readelf -d "$file" | grep -E 'RPATH|RUNPATH'

**********

The mishandling of runpaths is a problem for two reasons. First, Musl's loader throws away all runpaths if one RPATH or RUNPATH is wrong. That means the wrong library will be loaded at runtime on systems like Alpine Linux.

Second, '/../lib' will probably evaluate to just '/lib' on some platforms. That means the wrong library will be loaded at runtime. On Solaris, that means '/lib/bzip.so' will be loaded. And as fate has it, Oracle did not patch '/lib/bzip.so', and there are two outstanding CVEs.

**********

Here is what a successful audit looks like:

  $ ./audit-rpath-bins.sh ~/tmp/ok2delete/bin
  ...
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/openssl:

  (RUNPATH) [$ORIGIN/../lib:/home/jwalton/tmp/ok2delete/lib]
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/tset:

  (RUNPATH) [$ORIGIN/../lib:/home/jwalton/tmp/ok2delete/lib]
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/msgen:

  (RUNPATH) [$ORIGIN/../lib:/home/jwalton/tmp/ok2delete/lib]
  ****************************************
  /home/jwalton/tmp/ok2delete/bin/infocmp:

  (RUNPATH) [$ORIGIN/../lib:/home/jwalton/tmp/ok2delete/lib]