-
Bug
-
Resolution: Fixed
-
P3
-
7
-
b140
-
generic
-
generic
-
Verified
With the purging of the LD_LIBRARY_PATH via 6367077, the JDK7 launcher is
vulnerable to the LD_LIBRARY_PATH picked up an ambient java on the path.
For example supposing ant is run with jdk6 to invoke a jdk7 exe say javac
then the LD_LIBRARY_PATH settings in the parent will be available to the
child. Due to the way the Solaris rtld works the libraries on the LLP
will take preceded over the libraries in jdk7, thus both libraries
could exist in the process address space, thus this will lead to
bizarre and unpredictable error conditions. See 6913237.
Though we are planning on Release noting this, the launcher must take
a defensive approach.
Ideally yes, 7021644 would be the right/ideal approach, but there seems
to be some issues with implementing that.
I think once the drive/path is on the LLP, the system will hit it
with stat(2), access(2), open(2) and mmap(2) calls on it. So what we
are doing here is adding one more stat call, more than likely it
will be lost in translation, considering the fact that rt.jar needs
to be loaded.
vulnerable to the LD_LIBRARY_PATH picked up an ambient java on the path.
For example supposing ant is run with jdk6 to invoke a jdk7 exe say javac
then the LD_LIBRARY_PATH settings in the parent will be available to the
child. Due to the way the Solaris rtld works the libraries on the LLP
will take preceded over the libraries in jdk7, thus both libraries
could exist in the process address space, thus this will lead to
bizarre and unpredictable error conditions. See 6913237.
Though we are planning on Release noting this, the launcher must take
a defensive approach.
Ideally yes, 7021644 would be the right/ideal approach, but there seems
to be some issues with implementing that.
I think once the drive/path is on the LLP, the system will hit it
with stat(2), access(2), open(2) and mmap(2) calls on it. So what we
are doing here is adding one more stat call, more than likely it
will be lost in translation, considering the fact that rt.jar needs
to be loaded.
- relates to
-
JDK-8217216 Launcher does not defend itself against LD_LIBRARY_PATH_64 (Solaris)
-
- Resolved
-
-
JDK-6367077 Purge LD_LIBRARY_PATH usage from the launcher
-
- Closed
-
-
JDK-8216532 tools/launcher/Test7029048.java fails (Solaris)
-
- Resolved
-
-
JDK-8026260 LD_LIBRARY_PATH takes precedence over a runpath (solaris)
-
- Closed
-
-
JDK-8178692 Clean up RequiresSetenv / LD_LIBRARY_PATH
-
- Closed
-