Re: DESTDIR install on hppa-hpux

[Michael Haubenwallner]

On Thu, 2009-06-04 at 23:45 +0200, Ralf Wildenhues wrote:
> * Michael Haubenwallner wrote on Thu, Jun 04, 2009 at 01:35:11PM CEST:
> > On Wed, 2009-06-03 at 20:54 +0200, Ralf Wildenhues wrote:
> > 
> > > > The most important part of the fix is already suggested in comments
> > > > around 'hardcode_minus_L=yes', as the encoded library path is used as
> > > > fallback location for a specific library when runpath lookup fails.
> > > > As this isn't really 'hardcoding' in libtool's sense, hardcode_minus_L
> > > > can safely be set to 'no' IMO, opening the door for DESTDIR support.
> > > 
> > > Hmm.  This does open a small security issue, no?  Imagine the following
> > > setup: user joe compiles some package, then uses 'sudo make install' to
> > > install it in a system location.  First issue: the path to the
> > > compilation location is revealed in the installed libraries and programs
> > > which have dependencies to newly-installed libraries.  Second, if those
> > > deplibs are removed for whatever reason, then the runtime linker will
> > > search in joe's build tree for the shared libraries.  This may not be
> > > likely to happen, but it's something to think about.
> > 
> > I've thought about this too, but how would the link command have to look
> > like to avoid this issue?
> 
> I don't know.  That's precisely the reason we haven't gone this way
> before.

Asking HP people (or more carefully reading the manpage) does help: The
linker does have the "+cdp" flag, which allows for changing the linktime
path of a library into something different being stored as fallback path
into the binary. It does even work on hpux10.20 (ld B.10.37 here)
although not mentioned in its manpage.

It should be enough to simply add "+cdp ${inst_prefix_dir}:" to each
relink line, to replace "${inst_prefix_dir}" with "".
But I still have to look how to integrate this into libtool - any help
appreciated.

Thanks!

/haubi/