Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

This CL tweaks the ldflag configs for chrome_sandbox to make
sure we don't accidentally pick up -rpath=$ORIGIN, which can
be a security hole for a setuid binary.

R=brettw@chromium.org,llozano@chromium.org
BUG=612647
Committed: https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c
Cr-Commit-Position: refs/heads/master@{#399050}

[Dirk Pranke, 2016-06-09 00:41:49]

https://codereview.chromium.org/2050763004/diff/1/build/config/gcc/BUILD.gn
File build/config/gcc/BUILD.gn (right):

https://codereview.chromium.org/2050763004/diff/1/build/config/gcc/BUILD.gn#n...
build/config/gcc/BUILD.gn:77: # if they should be added to that target as well.
In theory I could split this out into two configs and have them both be applied
in BUILDCONFIG.gn, or at least have the logic all live in a single file, but we
only need this in one place and there's really only one flag that I think might
matter at all, so it seemed like overkill.

Let me know if you disagree.

[Dirk Pranke, 2016-06-09 00:45:24]

On 2016/06/09 00:41:49, Dirk Pranke wrote:
> https://codereview.chromium.org/2050763004/diff/1/build/config/gcc/BUILD.gn
> File build/config/gcc/BUILD.gn (right):
> 
>
https://codereview.chromium.org/2050763004/diff/1/build/config/gcc/BUILD.gn#n...
> build/config/gcc/BUILD.gn:77: # if they should be added to that target as
well.
> In theory I could split this out into two configs and have them both be
applied
> in BUILDCONFIG.gn, or at least have the logic all live in a single file, but
we
> only need this in one place and there's really only one flag that I think
might
> matter at all, so it seemed like overkill.
> 
> Let me know if you disagree.

Also, I think the chrome setuid binary's lifespan is limited at this point; it's
only really
used on CrOS and I'm not sure for how much longer it'll be needed there, either.

[Dirk Pranke, 2016-06-09 21:51:08]

The CQ bit was checked by dpranke@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-06-09 21:51:49]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2050763004/1

[brettw, 2016-06-09 21:51:51]

lgtm

[commit-bot: I haz the power, 2016-06-09 23:29:38]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-06-09 23:29:39]

Dry run: This issue passed the CQ dry run.

[Dirk Pranke, 2016-06-09 23:34:07]

The CQ bit was checked by dpranke@chromium.org

[commit-bot: I haz the power, 2016-06-09 23:34:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2050763004/1

[commit-bot: I haz the power, 2016-06-09 23:40:05]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-06-09 23:40:09]

CQ bit was unchecked

[commit-bot: I haz the power, 2016-06-09 23:41:31]

Description was changed from

==========
Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

This CL tweaks the ldflag configs for chrome_sandbox to make
sure we don't accidentally pick up -rpath=$ORIGIN, which can
be a security hole for a setuid binary.

R=brettw@chromium.org,llozano@chromium.org
BUG=612647
==========

to

==========
Ensure that chrome_sandbox doesn't have -rpath=$ORIGIN.

This CL tweaks the ldflag configs for chrome_sandbox to make
sure we don't accidentally pick up -rpath=$ORIGIN, which can
be a security hole for a setuid binary.

R=brettw@chromium.org,llozano@chromium.org
BUG=612647

Committed: https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c
Cr-Commit-Position: refs/heads/master@{#399050}
==========

[commit-bot: I haz the power, 2016-06-09 23:41:32]

Patchset 1 (id:??) landed as
https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c
Cr-Commit-Position: refs/heads/master@{#399050}

[Evgeniy Stepanov, 2016-06-13 17:22:09]

On 2016/06/09 23:41:32, commit-bot: I haz the power wrote:
> Patchset 1 (id:??) landed as
> https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c
> Cr-Commit-Position: refs/heads/master@{#399050}

Hi,

this bot says there is something wrong with this change, and that "ldflags" is
not a thing. Could you please take a look?

https://build.chromium.org/p/chromium.fyi/builders/ClangToTLinuxLLD/builds/81...

[Dirk Pranke, 2016-06-13 17:52:20]

On 2016/06/13 17:22:09, Evgeniy Stepanov wrote:
> On 2016/06/09 23:41:32, commit-bot: I haz the power wrote:
> > Patchset 1 (id:??) landed as
> > https://crrev.com/3ea22b3a4855512be84da4bc186392434e14de7c
> > Cr-Commit-Position: refs/heads/master@{#399050}
> 
> Hi,
> 
> this bot says there is something wrong with this change, and that "ldflags" is
> not a thing. Could you please take a look?
> 
>
https://build.chromium.org/p/chromium.fyi/builders/ClangToTLinuxLLD/builds/81...

Ah, that should be "ldflags =", not "ldflags +=". Fix coming shortly.

[Dirk Pranke, 2016-06-13 17:56:23]

On 2016/06/13 17:52:20, Dirk Pranke wrote:
> On 2016/06/13 17:22:09, Evgeniy Stepanov wrote:
> > Hi,
> > 
> > this bot says there is something wrong with this change, and that "ldflags"
is
> > not a thing. Could you please take a look?
> > 
> >
>
https://build.chromium.org/p/chromium.fyi/builders/ClangToTLinuxLLD/builds/81...
> 
> Ah, that should be "ldflags =", not "ldflags +=". Fix coming shortly.

Fix: https://codereview.chromium.org/2059343002/