FM / rpm

/usr/lib/rpm

Name	Size	Mode	Actions
macros.d/	-	0755	rm
platform/	-	0755	rm
redhat/	-	0755	rm
brp-compress	1466	0755	edit dl rm
brp-java-gcjcompile	1401	0755	edit dl rm
brp-python-bytecompile	3031	0755	edit dl rm
brp-strip	487	0755	edit dl rm
brp-strip-comment-note	696	0755	edit dl rm
brp-strip-shared	684	0755	edit dl rm
brp-strip-static-archive	389	0755	edit dl rm
check-buildroot	1231	0755	edit dl rm
check-files	663	0755	edit dl rm
check-prereqs	418	0755	edit dl rm
check-rpaths	1039	0755	edit dl rm
check-rpaths-worker	5045	0755	edit dl rm
config.guess	44941	0755	edit dl rm
config.sub	34423	0755	edit dl rm
debugedit	30544	0755	edit dl rm
desktop-file.prov	437	0755	edit dl rm
find-debuginfo.sh	9358	0755	edit dl rm
find-lang.sh	5621	0755	edit dl rm
find-provides	1559	0755	edit dl rm
find-requires	3505	0755	edit dl rm
fontconfig.prov	489	0755	edit dl rm
javadeps	23400	0755	edit dl rm
libtooldeps.sh	707	0755	edit dl rm
macros	43450	0644	edit dl rm
macros.perl	596	0644	edit dl rm
macros.php	313	0644	edit dl rm
macros.python	906	0644	edit dl rm
mkinstalldirs	3495	0755	edit dl rm
mono-find-provides	1105	0755	edit dl rm
mono-find-requires	1914	0755	edit dl rm
ocaml-find-provides.sh	1880	0755	edit dl rm
ocaml-find-requires.sh	2354	0755	edit dl rm
osgideps.pl	10591	0755	edit dl rm
perl.prov	5776	0755	edit dl rm
perl.req	7973	0755	edit dl rm
perldeps.pl	32900	0644	edit dl rm
pkgconfigdeps.sh	1171	0755	edit dl rm
pythondeps.sh	875	0755	edit dl rm
rpm.daily	284	0644	edit dl rm
rpm.log	61	0644	edit dl rm
rpm.xinetd	319	0644	edit dl rm
rpm2cpio.sh	1255	0755	edit dl rm
rpmdb_archive	-	0	edit dl rm
rpmdb_deadlock	-	0	edit dl rm
rpmdb_dump	-	0	edit dl rm
rpmdb_load	-	0	edit dl rm
rpmdb_loadcvt	1467	0755	edit dl rm
rpmdb_printlog	-	0	edit dl rm
rpmdb_recover	-	0	edit dl rm
rpmdb_stat	-	0	edit dl rm
rpmdb_upgrade	-	0	edit dl rm
rpmdb_verify	-	0	edit dl rm
rpmdeps	8616	0755	edit dl rm
rpmdiff	23977	0755	edit dl rm
rpmdiff.cgi	15674	0644	edit dl rm
rpmpopt-4.8.0	7920	0644	edit dl rm
rpmrc	13698	0644	edit dl rm
tcl.req	2069	0755	edit dl rm
tgpg	907	0755	edit dl rm

Edit: /usr/lib/rpm/check-rpaths-worker (5045B)

#! /bin/bash

# Copyright (C) 2004 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
#  
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#  
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#  
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

fail=
already_shown=0

# effect of this expression is obviously:
# * match paths beginning with:
#   - $SOMETHING/<something>/..
#   - /<something>/..
# * but not paths beginning with
#   - $SOMETHING/..
#   - $SOMETHING/../../../.....
BADNESS_EXPR_32='$\(\$[^/]\+$\?$/.*$\?/$\([^.][^/]*$\|$\.[^./][^/]*$\|$\.\.[^/]\+$\)\)/\.\.$/.*$\?$'

function showHint()
{
    test "$already_shown" -eq 0 || return
    already_shown=1
    
    cat <<EOF >&2
*******************************************************************************
*
* WARNING: 'check-rpaths' detected a broken RPATH and will cause 'rpmbuild'
*          to fail. To ignore these errors, you can set the '\$QA_RPATHS'
*          environment variable which is a bitmask allowing the values
*          below. The current value of QA_RPATHS is $(printf '0x%04x' $QA_RPATHS).
*
*    0x0001 ... standard RPATHs (e.g. /usr/lib); such RPATHs are a minor
*               issue but are introducing redundant searchpaths without
*               providing a benefit. They can also cause errors in multilib
*               environments.
*    0x0002 ... invalid RPATHs; these are RPATHs which are neither absolute
*               nor relative filenames and can therefore be a SECURITY risk
*    0x0004 ... insecure RPATHs; these are relative RPATHs which are a
*               SECURITY risk
*    0x0008 ... the special '\$ORIGIN' RPATHs are appearing after other
*               RPATHs; this is just a minor issue but usually unwanted
*    0x0010 ... the RPATH is empty; there is no reason for such RPATHs
*               and they cause unneeded work while loading libraries
*    0x0020 ... an RPATH references '..' of an absolute path; this will break
*               the functionality when the path before '..' is a symlink
*          
*
* Examples:
* - to ignore standard and empty RPATHs, execute 'rpmbuild' like
*   \$ QA_RPATHS=\$[ 0x0001|0x0010 ] rpmbuild my-package.src.rpm
* - to check existing files, set \$RPM_BUILD_ROOT and execute check-rpaths like
*   \$ RPM_BUILD_ROOT=<top-dir> /usr/lib/rpm/check-rpaths
*  
*******************************************************************************
EOF
}

function msg()
{
    local val=$1
    local cmp=$2
    local msg=
    local fail=
    local code

test $[ $val & $cmp ] -ne 0 || return 0

code=$(printf '%04x' $cmp)
    if test $[ $val & ~$QA_RPATHS ] -eq 0; then
	msg="WARNING"
    else
	showHint
	msg="ERROR  "
	fail=1
    fi

shift 2
    echo "$msg $code: $@" >&2

test -z "$fail"
}

: ${QA_RPATHS:=0}
old_IFS=$IFS

for i; do
    pos=0
    rpath=$(readelf -d "$i" 2>/dev/null | LANG=C grep '(RPATH).*:') || continue
    rpath=$(echo "$rpath" | LANG=C sed -e 's!.*(RPATH).*: \[$.*$\]!\1!p;d')
    tmp=aux:$rpath:/lib/aux || :
    IFS=:
    set -- $tmp
    IFS=$old_IFS
    shift

allow_ORIGIN=1
    for j; do
	new_allow_ORIGIN=0

if test -z "$j"; then
	    badness=16
	elif expr match "$j" "$BADNESS_EXPR_32" >/dev/null; then
	    badness=32
	else
	    case "$j" in
	        (/lib/*|/usr/lib/*|/usr/X11R6/lib/*|/usr/local/lib/*)
		    badness=0;;
	        (/lib64/*|/usr/lib64/*|/usr/X11R6/lib64/*|/usr/local/lib64/*)
		    badness=0;;

(\$ORIGIN|\${ORIGINX}|\$ORIGIN/*|\${ORIGINX}/*)
		    test $allow_ORIGIN -eq 0 && badness=8 || {
			badness=0
			new_allow_ORIGIN=1
		    }
		    ;;
		(/*\$PLATFORM*|/*\${PLATFORM}*|/*\$LIB*|/*\${LIB}*)
		    badness=0;;
	    	
	        (/lib|/usr/lib|/usr/X11R6/lib)
		    badness=1;;
	        (/lib64|/usr/lib64|/usr/X11R6/lib64)
		    badness=1;;
	    	
	        (.*)
		    badness=4;;
	        (*) badness=2;;
	    esac
	fi

allow_ORIGIN=$new_allow_ORIGIN

base=${i##$RPM_BUILD_ROOT}
	msg "$badness"  1 "file '$base' contains a standard rpath '$j' in [$rpath]"  || fail=1
	msg "$badness"  2 "file '$base' contains an invalid rpath '$j' in [$rpath]"  || fail=1
	msg "$badness"  4 "file '$base' contains an insecure rpath '$j' in [$rpath]" || fail=1
	msg "$badness"  8 "file '$base' contains the \$ORIGIN rpath specifier at the wrong position in [$rpath]" || fail=1
	msg "$badness" 16 "file '$base' contains an empty rpath in [$rpath]"         || fail=1
	msg "$badness" 32 "file '$base' contains an rpath referencing '..' of an absolute path [$rpath]" || fail=2
	let ++pos
    done
done

test -z "$fail"

cmd: