build initramfs: uncontrolled LD_LIBRARY_PATH
dracut uses ldd when building an initramfs, but I cannot find where dracut controls LD_LIBRARY_PATH during the build. Thus I do not trust the results of ldd. The string "LD_LIBRARY_PATH" does not appear in the dracut source tree, there is no use of "env -i", dracut is not setuid, etc.
At a minimum, the built initramfs could fail to satisfy some DT_NEEDED entry during boot, leading to a crash. Some soname was satisfied by a library in a non-standard directory on the build-time LD_LIBRARY_PATH, and was copied into that non-standard directory of the initramfs, but is not findable using the boot-time (default standard) path list.
That might be the worst, because all users of the initramfs (namely:
booting only) do control LD_LIBRARY_PATH, so there might be "no possibility" of substituting an actual non-standard library. However, it would be safer to control LD_LIBRARY_PATH while building initramfs, or at least document why not.
A message that is not in the archive (sent off-list or not yet received): 4E4DDD15.30202-Po6cBsTGB2ZWk0Htik3J/[email protected]
Quoted 12 lines · John Reiser
dracut uses ldd when building an initramfs, but I cannot find where dracut controls
LD_LIBRARY_PATHduring the build. Thus I do not trust the results of ldd. The string "LD_LIBRARY_PATH" does not appear in the dracut source tree, there is no use of "env -i", dracut is not setuid, etc.At a minimum, the built initramfs could fail to satisfy some
DT_NEEDEDentry during boot, leading to a crash. Some soname was satisfied by a library in a non-standard directory on the build-timeLD_LIBRARY_PATH, and was copied into that non-standard directory of the initramfs, but is not findable using the boot-time (default standard) path list.
Quoted 6 lines
That might be the worst, because all users of the initramfs (namely:
booting only) do controlLD_LIBRARY_PATH, so there might be "no possibility" of substituting an actual non-standard library. However, it would be safer to controlLD_LIBRARY_PATHwhile building initramfs, or at least document why not.
good find!
dracut +1 -0
@@ -265,6 +265,7 @@ fi PATH=/sbin:/bin:/usr/sbin:/usr/bin export PATH +unset LD_LIBRARY_PATH [[ $debug ]] && { export PS4='${BASH_SOURCE}@${LINENO}(${FUNCNAME[0]}): ';
A message that is not in the archive (sent off-list or not yet received): [email protected]
dracut fi · line 268
Quoted 7 lines
dracut +1
-0@@ -265,6 +265,7 @@ fi PATH=/sbin:/bin:/usr/sbin:/usr/bin export PATH +unset LD_LIBRARY_PATH
Also unset LD_PRELOAD, although it's not quite as bad as LD_LIBRARY_PATH. [See "LD_PRELOAD=/lib64/libreadline.so.6 ldd /bin/date".]