xmlsec1: make crypto backend search relocatable

libltdl's lt_dlopenext() doesn't consult the calling binary's DT_RPATH
or DT_RUNPATH. When xmlsec1 is shipped under $OMD_ROOT, libltdl instead
finds the distro-installed /usr/lib/x86_64-linux-gnu/libxmlsec1-openssl
and loads that, hitting an ABI mismatch against the bundled 1.3.8.

We only get an error if there is a mismatch in versions of
libxmlsec1-openssl on some platforms this worked previously without
LD_LIBRARY_PATH being specified.

Patched xmlsec1's src/dl.c to use dladdr() on a libxmlsec1 data symbol
to locate libxmlsec1.so at runtime and register its directory via
lt_dladdsearchdir(). libxmlsec1.so is installed which is the same
directory that libxmlsec1-openssl.so is installed.

libxmlsec1.so is loaded normally so using RUNPATH on the binrary is fine
in this case.

Drop force_rpath=True from xmlsec1_deployable_bin: the misleading "RPATH
is required for dlopen()" comment was wrong for libltdl (which ignores
both RPATH and RUNPATH), so RUNPATH on the binary is sufficient for its
direct DT_NEEDED libs. Rewrite the BUILD comment accordingly.

Also fix the same copy-pasted comment on nagios_bin_runpath: there
force_rpath=True *is* justified, but for a different reason (DT_RPATH,
unlike DT_RUNPATH, is inherited when the loader resolves transitive
DT_NEEDED of dlopen()ed NEB modules).

CMK-33201

Change-Id: Ie429875d434998998fa939dba69e56e7eed76b04
(cherry picked from commit 08b6cca)

Author: nigelgbanks

MODULE.bazel

@@ -414,6 +414,11 @@ snap7_repository(
 http_archive(
     name = "xmlsec1",
     build_file = "//omd/packages/xmlsec1:BUILD.xmlsec1.bazel",
+    patch_args = ["-p1"],
+    patch_tool = "patch",
+    patches = [
+        "//omd/packages/xmlsec1/patches:0001-relocatable-crypto-module-search.dif",
+    ],
     sha256 = "d0180916ae71be28415a6fa919a0684433ec9ec3ba1cc0866910b02e5e13f5bd",
     strip_prefix = "xmlsec1-1.3.8",
     urls = [

omd/packages/nagios/BUILD

@@ -65,8 +65,12 @@ pkg_filegroup(
 add_runpath(
     name = "nagios_bin_runpath",
     srcs = ["@nagios//:nagios_bin"],
-    # nagios links libltdl to load NEB event broker modules. DT_RUNPATH is not
-    # searched for dlopen() calls; DT_RPATH is required.
+    # nagios dlopen()s NEB event broker modules (e.g. livestatus.o) with absolute
+    # paths from nagios.cfg. That load doesn't consult this rpath, but DT_RPATH
+    # (unlike DT_RUNPATH) is inherited when the loader resolves those modules'
+    # own transitive DT_NEEDED. Kept as force_rpath so any NEB module whose
+    # dependencies aren't reachable via its own runpath can still fall back to
+    # $OMD_ROOT/lib.
     force_rpath = True,
     rpaths = ["$ORIGIN/../lib"],
     tags = ["manual"],

omd/packages/xmlsec1/BUILD

@@ -29,9 +29,11 @@ copy_file(
 set_runpath(
     name = "xmlsec1_deployable_bin",
     srcs = [":xmlsec1_bin_copy"],
-    # xmlsec1 uses libltdl to dlopen() its crypto backend (libxmlsec1-openssl).
-    # DT_RUNPATH is not searched for dlopen() calls; DT_RPATH is required.
-    force_rpath = True,
+    # RUNPATH here only resolves the binary's direct DT_NEEDED libs (libxmlsec1,
+    # libltdl, libxml2, libxslt, libstdc++). The crypto backend (libxmlsec1-openssl)
+    # is dlopen()ed by libltdl, which ignores RPATH/RUNPATH entirely -- that lookup
+    # is handled by a source patch (see //omd/packages/xmlsec1/patches) which calls
+    # lt_dladdsearchdir() with the libxmlsec1.so directory at runtime.
     rpaths = ["$ORIGIN/../lib"],
     tags = ["manual"],
 )

omd/packages/xmlsec1/patches/0001-relocatable-crypto-module-search.dif

@@ -0,0 +1,68 @@
+Make the crypto backend search relocatable.
+
+libltdl does not consult the calling binary's DT_RPATH/DT_RUNPATH when
+resolving lt_dlopenext() modules; it uses LTDL_LIBRARY_PATH,
+LD_LIBRARY_PATH and the compiled-in sys_lib_dlsearch_path_spec.  When
+xmlsec1 is shipped to a non-standard prefix (e.g. $OMD_ROOT/lib), the
+crypto backend (libxmlsec1-openssl.so) cannot be found, and libltdl
+may instead pick up a version from a distro-installed xmlsec1 in
+/usr/lib/x86_64-linux-gnu, with predictable ABI-mismatch failures.
+
+Use dladdr() on a libxmlsec1 symbol to locate libxmlsec1.so itself and
+register the directory containing it with lt_dladdsearchdir().  The
+crypto backends are shipped alongside libxmlsec1.so, so this makes
+the install self-contained regardless of prefix, without relying on
+environment variables or wrapper scripts.
+
+--- a/src/dl.c
++++ b/src/dl.c
+@@ -6,6 +6,11 @@
+  *
+  * Copyright (C) 2002-2024 Aleksey Sanin <aleksey@aleksey.com>. All Rights Reserved.
+  */
++/* dladdr() is a GNU extension; needed here to locate libxmlsec1.so at runtime
++ * so libltdl can find crypto backends bundled next to it. */
++#ifndef _GNU_SOURCE
++#  define _GNU_SOURCE 1
++#endif
+ /**
+  * SECTION:dl
+  * @Short_description: Dynamic crypto-engine library loading functions.
+@@ -40,6 +45,12 @@
+ #include <ltdl.h>
+ #endif /* XMLSEC_DL_LIBLTDL */
+
++#if defined(XMLSEC_DL_LIBLTDL) && defined(__linux__)
++#include <dlfcn.h>
++#include <libgen.h>
++#include <limits.h>
++#endif /* XMLSEC_DL_LIBLTDL && __linux__ */
++
+ #if defined(XMLSEC_WINDOWS) && defined(XMLSEC_DL_WIN32)
+ #include <windows.h>
+ #endif /* defined(XMLSEC_WINDOWS) && defined(XMLSEC_DL_WIN32) */
+@@ -373,6 +384,24 @@ xmlSecCryptoDLInit(void) {
+         xmlSecIOError("lt_dlinit", NULL, NULL);
+         return(-1);
+     }
++
++#if defined(__linux__)
++    /* libltdl does not consult DT_RPATH/DT_RUNPATH of the calling binary.
++     * Tell it about the directory that holds libxmlsec1.so so that crypto
++     * backends shipped next to it are preferred over any system-installed
++     * copies in /usr/lib. */
++    {
++        Dl_info info;
++        char path[PATH_MAX];
++        size_t len;
++        if(dladdr((const void *)&gXmlSecCryptoDLLibraries, &info) != 0
++           && info.dli_fname != NULL
++           && (len = strlen(info.dli_fname)) < sizeof(path)) {
++            memcpy(path, info.dli_fname, len + 1);
++            (void)lt_dladdsearchdir(dirname(path));
++        }
++    }
++#endif /* __linux__ */
+ #endif /* XMLSEC_DL_LIBLTDL */
+
+     return(0);