Avoid '.' as runpath on AIX

[haubi]

BPO	11172
Nosy	@pitrou, @haubi
Superseder	bpo-941346: AIX shared library fix
Files	python-2.7.1-aix-safe-runpath.patch: Avoid recording insecure runpath on AIX.

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2011-02-26.08:13:30.190>
created_at = <Date 2011-02-10.14:02:59.809>
labels = ['type-security', 'build']
title = "Avoid '.' as runpath on AIX"
updated_at = <Date 2011-02-26.08:13:30.188>
user = 'https://github.com/haubi'

bugs.python.org fields:

activity = <Date 2011-02-26.08:13:30.188>
actor = 'pitrou'
assignee = 'none'
closed = True
closed_date = <Date 2011-02-26.08:13:30.190>
closer = 'pitrou'
components = ['Build']
creation = <Date 2011-02-10.14:02:59.809>
creator = 'haubi'
dependencies = []
files = ['20730']
hgrepos = []
issue_num = 11172
keywords = ['patch']
message_count = 3.0
messages = ['128293', '128649', '129509']
nosy_count = 3.0
nosy_names = ['pitrou', 'sable', 'haubi']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '941346'
type = 'security'
url = 'https://bugs.python.org/issue11172'
versions = ['Python 3.1', 'Python 2.7', 'Python 3.2', 'Python 3.3']

[haubi]

Spotted in issue#941346 msg#128214, the "-L$(srcdir)" should be removed from BLDSHARED on AIX:

The problem is that '-L$(srcdir)' adds '$(srcdir)' to the runpath too (as there is no '-blibpath' argument), opening a security hole for libpythonX.Y.so as well as the modules.so.

As LDLIBRARY points to the immediate file 'libpython$(VERSION).so' instead of '-lpython$(VERSION)', I don't see the need for '-L$(srcdir)' at all.

[sable]

This has been corrected for python 3.2 in bpo-941346.
Need to be tested on python 2.7.

[pitrou]

Now backported as part of bpo-941346.