Re: Perl 5.32.0 mishandling of rpath and runpath tokens

[Phil Pennock <oss-security-phil () spodhuis org>]

On 2020-07-20 at 04:33 -0400, Jeffrey Walton wrote:
> On Mon, Jul 20, 2020 at 4:21 AM Jeffrey Walton <noloader () gmail com> wrote:
> >     -Wl,-R,$ORIGIN/../lib -Wl,-R,$HOME/tmp/ok2delete/lib
>
> My bad... It does not matter how this $ORIGIN token is quoted. Perl
> always expands it.

I've encountered this in build systems before, where the quoting is
inconsistent and apparently can result in different levels of dequoting
for a target depending upon how it was reached.

What I've used for building those has been to specify %ORIGIN instead of
$ORIGIN and then binary-edit the resulting binary to switch that % back
to a $.  All quoting issues disappear and all binary offsets are stable.
Just make sure the binary-edit step is before any binary signing. :)

At some point, it's also worth considering static linking.

-Phil