From 94bf958a9435b8d8fbf92c15d8cd5d310029a22c Mon Sep 17 00:00:00 2001 From: "Patrick 'P. J.' McDermott" Date: Wed, 11 Sep 2013 23:13:36 -0400 Subject: ldd: make try_trace more robust and portable It was noted in 2005 (BZ #832), 2006 (BZ #3266), and 2007 [1] that ldd fails on shells other than Bash >= 3.0 because of the pipefail option around try_trace (added on 2004-12-08). EGLIBC was patched in 2008 [2] (r6912) to make the pipefail check run only on shells that support it, but RTLD output would still be lost on other shells with certain SELinux policies. This patch rewrites try_trace to work on any POSIX-conformant shell in such a way as to also work with such SELinux policies. It also obviates one difference between glibc and EGLIBC. URL: https://sourceware.org/ml/libc-alpha/2007-01/msg00041.html URL: http://www.eglibc.org/archives/patches/msg00526.html 2013-09-11 P. J. McDermott [BZ #832] * elf/ldd.bash.in (try_trace): More robustly and portably work around SELinux terminal write permissions by using a command substitution instead of a pipeline and pipefail option. --- elf/ldd.bash.in | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) (limited to 'elf') diff --git a/elf/ldd.bash.in b/elf/ldd.bash.in index 39aeca2..c4a1a15 100644 --- a/elf/ldd.bash.in +++ b/elf/ldd.bash.in @@ -106,19 +106,18 @@ if test "$unused" = yes; then add_env="$add_env LD_DEBUG=\"$LD_DEBUG${LD_DEBUG:+,}unused\"" fi -# The following use of cat is needed to make ldd work in SELinux -# environments where the executed program might not have permissions -# to write to the console/tty. But only bash 3.x supports the pipefail -# option, and we don't bother to handle the case for older bash versions. -if set -o pipefail 2> /dev/null; then - try_trace() { - eval $add_env '"$@"' | cat - } -else - try_trace() { - eval $add_env '"$@"' - } -fi +# The following command substitution is needed to make ldd work in SELinux +# environments where the RTLD might not have permission to write to the +# terminal. The extra "x" character prevents the shell from trimming trailing +# newlines from command substitution results. This function is defined as a +# subshell compound list (using "(...)") to prevent parameter assignments from +# affecting the calling shell execution environment. +try_trace() ( + output=$(eval $add_env '"$@"' 2>&1; rc=$?; printf 'x'; exit $rc) + rc=$? + printf '%s' "${output%x}" + return $rc +) case $# in 0) -- cgit v1.1