[
https://issues.apache.org/jira/browse/PROTON-808?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14319194#comment-14319194
]
Rafael H. Schloming commented on PROTON-808:
--------------------------------------------
Ah, that makes sense as a general exploit. I'm not sure offhand how much it
matters in our case. What exactly constitutes a "privileged binary"?
Presumably for it to be an issue for us you would need
${CMAKE_INSTALL_PREFIX}/${LIB_INSTALL_DIR} to have different access rights than
${CMAKE_INSTALL_PREFIX}/${LIB_INSTALL_DIR}/proton/bindings/blah. This doesn't
seem likely on the face of it, but presumably someone could copy the stuff
underneath proton/bindings elsewhere and possibly get into trouble that way.
> Binaries have their library locations stripped
> ----------------------------------------------
>
> Key: PROTON-808
> URL: https://issues.apache.org/jira/browse/PROTON-808
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-c
> Reporter: Justin Ross
> Attachments: cmake.patch
>
>
> 1. Build proton
> 2. Install to /usr/local
> 3. Run "proton"
> -> Blows up, can't find its library
> https://paste.apache.org/gd56
> http://stackoverflow.com/questions/3352041/creating-binary-with-cmake-removes-runtime-path
> The default behavior of cmake is in my opinion wrong, and we should use the
> fix mentioned in that stackoverflow discussion.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
