Makeconfig: Move -Wl,-rpath-link options before library references

Previously, the -Wl,-rpath-link options came after the libraries
injected using LDLIBS-* variables on the link editor command line for
main programs.  As a result, it could happen that installed libraries
that reference glibc libraries used the installed glibc from the system
directories, instead of the glibc from the build tree.  This can lead to
link failures if the wrong version of libpthread.so.0 is used, for
instance, due to differences in the internal GLIBC_PRIVATE interfaces,
as seen with memusagestat and -lgd after commit
f9b645b4b0a10c43753296ce3fa40053fa44606a ("memusagestat: use local glibc
when linking [BZ #18465]").

The isolation is necessarily imperfect because these installed
libraries are linked against the installed glibc in the system
directories.  However, in most cases, the built glibc will be newer
than the installed glibc, and this link is permitted because of the
ABI backwards compatibility glibc provides.

2 files changed, 29 insertions, 5 deletions

diff --git a/ChangeLog b/ChangeLog
index 697f937..a4f9c9e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,20 @@
 2019-04-26  Florian Weimer  <fweimer@redhat.com>
 
+	Makeconfig: Move -Wl,-rpath-link options before library references.
+	* Makeconfig (+link-pie, +link): Add $(link-libc-rpath-link).
+	(link-libc): Remove $(link-libc-rpath-link).
+
+2019-04-25  Florian Weimer  <fweimer@redhat.com>
+
+	* Makeconfig (+link-pie-before-libc): Remove $(CC).
+	(+link-pie, +link-pie-tests, +link-pie-printers-tests): Add $(CC).
+	(+link-static-before-libc): Remove $(CC).
+	(+link-static, +link-static-tests): Add $(CC).
+	(+link-before-libc): Remove $(CC).
+	(+link, +link-pie, +link-pie-printers): Add $(CC).
+
+2019-04-26  Florian Weimer  <fweimer@redhat.com>
+
 	* Makeconfig (+link-pie-before-libc): Remove $(CC).
 	(+link-pie, +link-pie-tests, +link-pie-printers-tests): Add $(CC).
 	(+link-static-before-libc): Remove $(CC).
diff --git a/Makeconfig b/Makeconfig
index 92c9b59..0e386fb 100644
--- a/Makeconfig
+++ b/Makeconfig
@@ -428,8 +428,8 @@ ifndef +link-pie
 	     $(link-extra-libs)
 +link-pie-after-libc = $(+postctorS) $(+postinit)
 define +link-pie
-$(CC) $(+link-pie-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) \
-  $(link-libc) $(+link-pie-after-libc)
+$(CC) $(link-libc-rpath-link) $(+link-pie-before-libc) $(rtld-LDFLAGS) \
+  $(link-extra-flags) $(link-libc) $(+link-pie-after-libc)
 $(call after-link,$@)
 endef
 define +link-pie-tests
@@ -490,8 +490,8 @@ else  # not build-pie-default
 	      $(link-extra-libs)
 +link-after-libc = $(+postctor) $(+postinit)
 define +link
-$(CC) $(+link-before-libc) $(rtld-LDFLAGS) $(link-extra-flags) $(link-libc) \
-  $(+link-after-libc)
+$(CC) $(link-libc-rpath-link) $(+link-before-libc) $(rtld-LDFLAGS) \
+  $(link-extra-flags) $(link-libc) $(+link-after-libc)
 $(call after-link,$@)
 endef
 define +link-tests
@@ -552,6 +552,15 @@ ifeq (yes,$(build-shared))
 link-libc-rpath = -Wl,-rpath=$(rpath-link)
 link-libc-rpath-link = -Wl,-rpath-link=$(rpath-link)
 
+# For programs which are not tests, $(link-libc-rpath-link) is added
+# directly in $(+link), $(+link-pie) above, so that -Wl,-rpath-link
+# comes before the expansion of LDLIBS-* and affects libraries added
+# there.  For shared objects, -Wl,-rpath-link is added via
+# $(build-shlib-helper) and $(build-module-helper) in Makerules (also
+# before the expansion of LDLIBS-* variables).
+
+# Tests use -Wl,-rpath instead of -Wl,-rpath-link for
+# build-hardcoded-path-in-tests.
 ifeq (yes,$(build-hardcoded-path-in-tests))
 link-libc-tests-rpath-link = $(link-libc-rpath)
 else
@@ -562,7 +571,7 @@ link-libc-before-gnulib = $(common-objpfx)libc.so$(libc.so-version) \
 			  $(common-objpfx)$(patsubst %,$(libtype.oS),c) \
 			  $(as-needed) $(elf-objpfx)ld.so \
 			  $(no-as-needed)
-link-libc = $(link-libc-rpath-link) $(link-libc-before-gnulib) $(gnulib)
+link-libc = $(link-libc-before-gnulib) $(gnulib)
 
 link-libc-tests-after-rpath-link = $(link-libc-before-gnulib) $(gnulib-tests)
 link-libc-tests = $(link-libc-tests-rpath-link) \