Sample Header Ad - 728x90

Cannot chroot bash after setting RUNPATH in ld-linux-x86-64.so.2 with patchelf 0.6 and 0.8

1 vote
1 answer
824 views
I am testing how dynamic linking works with RUNPATH variable, and trying to run bash in a minimal chroot directory: $ find dir_chroot/ -type f dir_chroot/bin/bash dir_chroot/lib/x86_64-linux-gnu/libc.so.6 dir_chroot/lib/x86_64-linux-gnu/libdl.so.2 dir_chroot/lib/x86_64-linux-gnu/libtinfo.so.5 dir_chroot/lib64/ld-linux-x86-64.so.2 -- these are all dependencies of bash, and they are actual binaries (find -type f), not symbolic links. Also they don't have RUNPATH: $ find dir_chroot/ -type f -exec sh -c "readelf -d {} | grep RUNPATH" \; $ chroot works fine with this directory: $ sudo chroot dir_chroot /bin/bash bash-4.3# exit exit However, if I copy everything and set RUNPATH to $ORIGIN/ in lib64/ld-linux-x86-64.so.2 I get exit code 139 (segfault?) when running chroot: $ cp -R dir_chroot dir_chroot4 $ find dir_chroot4/ -type f -exec sh -c "echo {} readelf -d {} | grep RUNPATH" \; dir_chroot4/bin/bash dir_chroot4/lib/x86_64-linux-gnu/libc.so.6 dir_chroot4/lib/x86_64-linux-gnu/libdl.so.2 dir_chroot4/lib/x86_64-linux-gnu/libtinfo.so.5 dir_chroot4/lib64/ld-linux-x86-64.so.2 $ $ patchelf --set-rpath "\$ORIGIN/" dir_chroot4/lib64/ld-linux-x86-64.so.2 $ find dir_chroot4/ -type f -exec sh -c "echo {} readelf -d {} | grep RUNPATH" \; dir_chroot4/bin/bash dir_chroot4/lib/x86_64-linux-gnu/libc.so.6 dir_chroot4/lib/x86_64-linux-gnu/libdl.so.2 dir_chroot4/lib/x86_64-linux-gnu/libtinfo.so.5 dir_chroot4/lib64/ld-linux-x86-64.so.2 0x000000000000001d (RUNPATH) Library runpath: [$ORIGIN/] $ $ sudo chroot dir_chroot4 /bin/bash $ $ echo $status 139 -- $status is the status variable in fish shell. It happens only if ld-linux-x86-64.so.2 is patched, other libraries and bash executable work ok with RUNPATH. Why is it so?
Asked by xealits (2267 rep)
Nov 6, 2016, 01:54 AM
Last activity: Nov 16, 2016, 03:08 PM