Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5826

Protect services from 'rogue' libraries

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Normal Normal
    • None
    • rhel-8.1.0
    • systemd
    • None
    • Moderate
    • rhel-plumbers
    • ssg_core_services
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None
    • 57,005

      Description of problem:

      Some products register their libraries in the library search path by
      creating an entry in /etc/ld.so.conf.d/ directory.
      This is not an issue unless a library conflicts with a system library in
      standard path /usr/lib64 (this is distribution dependent, may also be
      /usr/lib), which happens quite frequently.

      Adding LD_LIBRARY_PATH for system services guarantees that standard
      libraries will be used, preventing critical issues such as D-Bus daemon
      not starting when 'libexpat' has been overloaded by some non-system
      library for example, causing boot issues (nothing works then).

      See Upstream PR: https://github.com/systemd/systemd/pull/13640

      I doubt Upstream will want this patch, but IMHO RHEL needs this anyway
      to protect critical services from failing/hanging at boot
      (typically DBus is affected, which then impacts systemd, NetworkManager, ...).

      This would solve many boot failure cases we see.

      Version-Release number of selected component (if applicable):

      All releases of systemd

      How reproducible:

      Always

      Steps to Reproduce:
      1. Install an incompatible library (e.g. /broken/libexpat.so*, see private attachment)

      1. mkdir /broken && tar xzf libexpat.tar.gz -C /broken
      2. echo "/broken" > /etc/ld.so.conf.d/broken.conf
      3. ldconfig

      2. Reboot

      Actual results:

      Hang of the boot after starting D-Bus

      Expected results:

      No issue

              systemd-maint systemd maint mailing list
              rhn-support-rmetrich Renaud Métrich
              systemd maint mailing list systemd maint mailing list
              Frantisek Sumsal Frantisek Sumsal
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: