[SOLVED] Issues Compiling Portable OpenSSL

OstermanA · 07-12-2017, 09:00 PM

I'm trying to build a copy of HTTPD with mod_ssl and mod_security that's completely portable (IE, rpath relative to $ORIGIN) on a CentOS 7 x86_64 system.

I've got essentially everything working except openssl-1.0.2l. I absolutely cannot find a way to get the literal '$' into the rpath.

The command I'm using to test looks like this:

Code:

(./config --prefix=/sites/opt/HTTPD/httpd-2.4.27_modsecurity-2.9.1 --openssldir=/sites/opt/HTTPD/httpd-2.4.27_modsecurity-2.9.1 threads shared no-comp '-Wl,-z,origin,-rpath,\$\$\$ORIGIN/../lib,-rpath,\$ORIGIN/../../lib' && make depend && make && make install) &>/dev/null && readelf -d /sites/opt/HTTPD/httpd-2.4.27_modsecurity-2.9.1/lib/libssl.so.1.0.0

Variations I've tried:
-Wl,-z,origin,-rpath,\$ORIGIN/../lib,-rpath,\$ORIGIN/../../lib
-Wl,-z,origin,-rpath,\\\$ORIGIN/../lib,-rpath,\\\$ORIGIN/../../lib
-Wl,-z,origin,-rpath,\\\$ORIGIN/../lib,-rpath,\\$ORIGIN/../../lib
-Wl,-z,origin,-rpath,$$ORIGIN/../lib,-rpath,\$$ORIGIN/../../lib
-Wl,-z,origin,-rpath,$$ORIGIN/../lib,-rpath,\$\$ORIGIN/../../lib
-Wl,-z,origin,-rpath,$ORIGIN/../lib,-rpath,\\\$ORIGIN/../../lib
-Wl,-z,origin,-rpath,$$$ORIGIN/../lib,-rpath,\$ORIGIN/../../lib
-Wl,-z,origin,-rpath,\$\$\$ORIGIN/../lib,-rpath,\$ORIGIN/../../lib

Most variations end up with an rpath looking like either '/../lib' or 'RIGIN/../../lib' using 'readelf -d'

OstermanA · 07-14-2017, 04:04 PM

So, I'm pretty sure this is flat out impossible to do. OpenSSL ignores the normal environment variables (LDFLAGS, CFLAGS, LD_RUN_PATH, etc) and will only listen to what you feed in via ./config. I tried this:

Code:

./config --prefix=/sites/opt/HTTPD/httpd-2.4.27_modsecurity-2.9.1 --openssldir=/sites/opt/HTTPD/httpd-2.4.27_modsecurity-2.9.1 threads shared no-comp '-Wl,-z,origin,-rpath,$$ORIGIN01/../lib,-rpath,$$$ORIGIN02/../lib,-rpath,$$$$ORIGIN03/../lib,-rpath,$$$$$ORIGIN04/../lib,-rpath,\$$ORIGIN05/../lib,-rpath,\$$$ORIGIN06/../lib,-rpath,\$$$$ORIGIN07/../lib,-rpath,\$$$$$ORIGIN08/../lib,-rpath,\$$$$$ORIGIN09/../lib,-rpath,\\$$ORIGIN10/../lib,-rpath,\\$$$ORIGIN11/../lib,-rpath,\\$$$$ORIGIN12/../lib,-rpath,\\$$$$$ORIGIN13/../lib,-rpath,\\$$$$$$$ORIGIN14/../lib,-rpath,\\\$$ORIGIN15/../lib,-rpath,\\\$$$ORIGIN16/../lib,-rpath,\\\$$$$ORIGIN17/../lib,-rpath,\\\$$$$$ORIGIN18/../lib,-rpath,\\\$$$$$$ORIGIN19/../lib,-rpath,\$\$ORIGIN/../../lib' && make depend && make && make install

and got this:

Code:

 0x000000000000000f (RPATH)              Library rpath: [/../lib:18761ORIGIN03/../lib:18761RIGIN04/../lib:RIGIN05/../lib:IGIN06/../lib:../lib:\/../lib:\18761ORIGIN12/../lib:\18761RIGIN13/../lib:\18761/../lib:\RIGIN15/../lib:\IGIN16/../lib:\../lib:\8761ORIGIN19/../lib:\RIGIN/../../lib]

I have no idea what the '1876' thing is about. It's interesting that some of them flat out disappeared. Has anyone, anywhere, managed to compile a copy of OpenSSL with a relative runpath? Ever?

OstermanA · 07-14-2017, 05:33 PM

Expletive. I wanted to do it the 'pure' way and just use flags and such to get it all working, but I'm just gonna brute force it with chrpath instead. It's been fun, but forget this.