Skip to contentSkip to conversation

build initramfs: uncontrolled LD_LIBRARY_PATH

DISCUSSION John Reiser 2 participants 3 messages Aug 19, 2011 2 messages not in the archive

lore
Share & tools
lore
#0 lore raw

dracut uses ldd when building an initramfs, but I cannot find where dracut controls LD_LIBRARY_PATH during the build. Thus I do not trust the results of ldd. The string "LD_LIBRARY_PATH" does not appear in the dracut source tree, there is no use of "env -i", dracut is not setuid, etc.

At a minimum, the built initramfs could fail to satisfy some DT_NEEDED entry during boot, leading to a crash. Some soname was satisfied by a library in a non-standard directory on the build-time LD_LIBRARY_PATH, and was copied into that non-standard directory of the initramfs, but is not findable using the boot-time (default standard) path list.

That might be the worst, because all users of the initramfs (namely:
booting only) do control LD_LIBRARY_PATH, so there might be "no possibility" of substituting an actual non-standard library. However, it would be safer to control LD_LIBRARY_PATH while building initramfs, or at least document why not.

A message that is not in the archive (sent off-list or not yet received): 4E4DDD15.30202-Po6cBsTGB2ZWk0Htik3J/[email protected]

#2 lore raw
Quoted 12 lines · John Reiser

dracut uses ldd when building an initramfs, but I cannot find where dracut controls LD_LIBRARY_PATH during the build. Thus I do not trust the results of ldd. The string "LD_LIBRARY_PATH" does not appear in the dracut source tree, there is no use of "env -i", dracut is not setuid, etc.

At a minimum, the built initramfs could fail to satisfy some DT_NEEDED entry during boot, leading to a crash. Some soname was satisfied by a library in a non-standard directory on the build-time LD_LIBRARY_PATH, and was copied into that non-standard directory of the initramfs, but is not findable using the boot-time (default standard) path list.

Quoted 6 lines

That might be the worst, because all users of the initramfs (namely:
booting only) do control LD_LIBRARY_PATH, so there might be "no possibility" of substituting an actual non-standard library. However, it would be safer to control LD_LIBRARY_PATH while building initramfs, or at least document why not.

good find!

dracut +1 -0
index cf27b23..dfa71a1 100755
@@ -265,6 +265,7 @@ fi
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin
 export PATH
+unset LD_LIBRARY_PATH
 
 [[ $debug ]] && {
     export PS4='${BASH_SOURCE}@${LINENO}(${FUNCNAME[0]}): ';

A message that is not in the archive (sent off-list or not yet received): [email protected]

#4 lore raw

dracut fi · line 268

Quoted 7 lines
dracut +1 -0
@@ -265,6 +265,7 @@ fi
 
 PATH=/sbin:/bin:/usr/sbin:/usr/bin
 export PATH
+unset LD_LIBRARY_PATH

Also unset LD_PRELOAD, although it's not quite as bad as LD_LIBRARY_PATH. [See "LD_PRELOAD=/lib64/libreadline.so.6 ldd /bin/date".]