Gnu/Linux set path to shared libraries

JonB

@aha_1980 said in Gnu/Linux set path to shared libraries:

@JonB as said, for security reasons '.' is not in the linker search path - as that makes it easy to inject malicious libraries.

But just so I understand: LD_LIBRARY_PATH is just a user runtime environment variable which any user can set however they like? So how does that contribute to security?

aha_1980

@JonB said in Gnu/Linux set path to shared libraries:

But just so I understand: LD_LIBRARY_PATH is just a user runtime environment variable which any user can set however they like? So how does that contribute to security?

That's an interesting question. I surely cannot answer it completely, but here are my thoughts:

You never have '.' in the library search path, and it's easy to check if it is. If you do, you're on your own.
It may be easier to inject a library file (e.g. through a shared folder) than modifying someone elses environment (though not impossible).
Programs can clean the environment at startup, and I know some of them do so (especially those which run with elevated rights)

Back to topic:

For the OP, I would have thought the .pro & .conf settings are not relevant to the end-user's run-time environment, he needs to look at deployment not compilation. Correct?

I'd say yes. I don't know how linuxdeployqt works but that is definitely worth a look.

jsulm

@JonB For same reason . is usually not in PATH: if someone manages to put an executable for example in your home directory named "grep" and you then type "grep" in console while your current directory is your home this "bad" grep will be executed instead of the correct one. Sure, user can add . to PATH or LD_LIBRARY_PATH, but then it is up to the user. The default configuration should be as secure as possible.

jsulm

@cfdev Take a look at http://doc.qt.io/qt-5/linux-deployment.html

JonB

@aha_1980 said in Gnu/Linux set path to shared libraries:

You never have '.' in the library search path, and it's easy to check if it is. If you do, you're on your own.

OK, so it's a "user beware" protection. I come nowadays from a Windoze background, the thought that security could rely on what an environment variable might be set to would be strange there! And of course the first place it looks for a DLL, automatically, is in the same directory as the executable!

jsulm

@JonB Why would it be strange? If user changes something then it is up to him/her. Linux/UNIX gives you freedom with reasonable default configuration. If you change something then you're responsible.
And Windows is not the most secure OS out there :-)
LD_LIBRARY_PATH=. does not mean same directory as executable, but current directory what ever it currently is

cfdev

@JonB said in Gnu/Linux set path to shared libraries:

linuxdeployqt.

I had try LinuxDeployqt but it's so buggy, with sql my application crash.

With ldd command, I see my application search lib in the install Qt directory... I want to create an app directory standalone if possible.

Like QtCreator I try to create an qt.conf file with :

[Paths]
Prefix=lib/Qt
Libraries=lib
Plugins=plugins

But when I run my app, he tell me :

$ ./mApp
This application failed to start because it could not find or load the Qt platform plugin "xcb"
in "".

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, xcb.

Reinstalling the application may fix this problem.
Abandon (core dumped)

Strange because he found the libs available, if I change the path, he tell me not available...

JonB

@cfdev said in Gnu/Linux set path to shared libraries:

I had try LinuxDeployqt but it's so buggy, with sql my application crash.

Well that's a bit worrying, because so far as I know that is what anybody has to use to deploy Qt applications under Linux...

I take it you have read http://doc.qt.io/qt-5/linux-deployment.html

jsulm

@cfdev Please execute

ldd YOUR_APP_DIR/plugins/.../libqxcb.so

Is there any dependency not found?

cfdev

@jsulm Ok thanks, libs are missing by xcb plugin. :)
After I had a problem with Qt WebEngine

my qt.conf

[Paths]
Prefix=lib/Qt
Libraries=lib
LibraryExecutables=libexec
Plugins=plugins
Translations=translations

And When I run my application:

$ LD_LIBRARY_PATH=lib/Qt/lib ./mApp
Qt WebEngine ICU data not found at /home/cfdev/Qt5.9.3/5.9.3/gcc_64/resources. Trying parent directory...
Qt WebEngine ICU data not found at /home/cfdev/Qt5.9.3/5.9.3/gcc_64. Trying application directory...
Qt WebEngine ICU data not found at /home/cfdev/mApp/lib/Qt/libexec. Trying fallback directory... The application MAY NOT work.
Path override failed for key base::DIR_QT_LIBRARY_DATA and path '/home/cfdev/.QtWebEngineProcess'

Solution: I copy all ressources file of QtWebEngine in libexec dir and It's ok :) !

Pablo J. Rogina

@cfdev if your issue is solved, please don't forget to mark your post as such. Thanks.

cfdev

Ok many thanks all ! solved