linux-ext4 - Re: [PATCH] libss: add newer libreadline.so.8 to dlopen path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 Aug 2021 17:07:39 -0400
From:   "Theodore Ts'o" <tytso@....edu>
To:     Jan Kara <jack@...e.cz>
Cc:     linux-ext4@...r.kernel.org
Subject: Re: [PATCH] libss: add newer libreadline.so.8 to dlopen path

On Fri, Aug 20, 2021 at 06:15:02PM +0200, Jan Kara wrote:
> OpenSUSE Tumbleweed now has libreadline.so.8. Add it to the list of libs
> to look for.
> 
> Signed-off-by: Jan Kara <jack@...e.cz>
> ---
>  lib/ss/get_readline.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Hum, why don't we look for libreadline.so BTW? That way we could save adding
> now so version whenever one appears?

We do actually look for libreadline.so; it's right after
libreadline.so.4:

> -#define DEFAULT_LIBPATH "libreadline.so.7:libreadline.so.6:libreadline.so.5:libreadline.so.4:libreadline.so:libedit.so.2:libedit.so:libeditline.so.0:libeditline.so"

However, we still need the libreadline.so.N in the path because at
least for some distributions, they only install libreadline.so if you
install the -dev package.  For example, in Debian, libreadline.so.8 is
installed from the libreadline8 package, while libreadline.so is
installed from the libreadline-dev package (and it's not guaranteed to
be installed).

Fortunately for Debian users, openssh-client depends on libedit2,
which means that even if they don't have libreadline-dev installed, we
fall back to using libedit.so.2, which does work.  So apparently no
one noticed that a problem with debugfs on Debian Bullseye (which
ships libreadline.so.8).

But I agree that we should add libreadline.so.8 to the search path.

Thanks, applied.

      	    	    	       			- Ted