From owner-svn-src-head@FreeBSD.ORG Sun Jun 22 01:41:08 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D11FCBD5; Sun, 22 Jun 2014 01:41:08 +0000 (UTC) Received: from mail-we0-x230.google.com (mail-we0-x230.google.com [IPv6:2a00:1450:400c:c03::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id F19E926A8; Sun, 22 Jun 2014 01:41:07 +0000 (UTC) Received: by mail-we0-f176.google.com with SMTP id u56so5233029wes.7 for ; Sat, 21 Jun 2014 18:41:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=MnEf57FaAHPlpos7++YI3g/XaMwnztZ2waa2wmhL37A=; b=p1J1xpzEzLrA87OwS66SNvHrznEzMnCIXnixBR46jpXJ9FGGVwG069agoTxxH3flN3 OuH7L8CcY6BFqYmk8V71ZRBqgewCa9RF+ft2IqFYbsZz0sRBDbwughF719YyXQVKYywS uJG+3cL2ZzBme2VH+AxjcuILUImXF1Lyl0YLedJNHWU8p5ZglgMVKlWiH5WBQTjAtaHK OGBkxN71qI6ukSId6bWF3WSjbAfWV8KoO2EL0jPI1EHJg3i6PcrddpJ+j1bBounVYL/Q KQ2oSZPYuN5ACrkDhy7pfooOZ2YEZoP7dQqzbZ5I2uypStp9VmGlw3ubsQA3RVL7XAwV Ke+Q== X-Received: by 10.194.189.230 with SMTP id gl6mr6516318wjc.118.1403401265950; Sat, 21 Jun 2014 18:41:05 -0700 (PDT) Received: from dft-labs.eu (n1x0n-1-pt.tunnel.tserv5.lon1.ipv6.he.net. [2001:470:1f08:1f7::2]) by mx.google.com with ESMTPSA id r5sm25878590wjq.26.2014.06.21.18.41.04 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Sat, 21 Jun 2014 18:41:05 -0700 (PDT) Date: Sun, 22 Jun 2014 03:41:02 +0200 From: Mateusz Guzik To: Jonathan Anderson Subject: Re: svn commit: r267678 - head/libexec/rtld-elf Message-ID: <20140622014102.GA26841@dft-labs.eu> References: <201406201708.s5KH8WVP017030@svn.freebsd.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <201406201708.s5KH8WVP017030@svn.freebsd.org> User-Agent: Mutt/1.5.21 (2010-09-15) Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Jun 2014 01:41:08 -0000 On Fri, Jun 20, 2014 at 05:08:32PM +0000, Jonathan Anderson wrote: > Author: jonathan > Date: Fri Jun 20 17:08:32 2014 > New Revision: 267678 > URL: http://svnweb.freebsd.org/changeset/base/267678 > > Log: > Add the LD_LIBRARY_PATH_FDS environmental variable. > > This variable allows the loading of shared libraries via directory descriptors > rather than via library paths. If LD_LIBRARY_PATH_FDS=3:4:12, the directories > represented by file descriptors 3, 4 and 12 will searched for shared libraries > before the normal path-based mechanisms are used. This allows us to execute > unprivileged binaries from within a Capsicum sandbox even if they require > shared libraries. > This is not a request, but a mere suggestion. Now there are 2 places where rtld opens requested libraries which is somewhat unfortunate. If find_library was changed to return directory fd to lookup the library in and the path, open could be done in load_object with openat. Old functions would return AT_FDCWD. As a side note load_object would really use an assert that only one of fd_u and name is set. Cheers, -- Mateusz Guzik