From 8aea307b4f0dbe179588be71464da771ab85fdbc Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 20 Jul 2020 12:00:23 +0200
Subject: [PATCH] ld.so.8: List more places in which dynamic string tokens are
 expanded

This happens for more than just DT_RPATH/DT_RUNPATH.

Signed-off-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
---
 man8/ld.so.8 | 42 +++++++++++++++++++++++++++++++++++++-----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/man8/ld.so.8 b/man8/ld.so.8
index 2e98b7f5a..80f57a541 100644
--- a/man8/ld.so.8
+++ b/man8/ld.so.8
@@ -97,12 +97,41 @@ and then
 If the binary was linked with the
 .B \-z nodeflib
 linker option, this step is skipped.
-.SS Rpath token expansion
+.SS Dynamic string tokens
 .PP
-The dynamic linker
-understands certain token strings in an rpath specification
-(DT_RPATH or DT_RUNPATH).
-Those strings are substituted as follows:
+In several places, the dynamic linker expands dynamic string tokens:
+.IP o 3
+In the environment variables
+.BR LD_LIBRARY_PATH ,
+.BR LD_PRELOAD ,
+and
+.BR LD_AUDIT ,
+.IP o 3
+inside the values of the dynamic section tags
+.BR DT_NEEDED ,
+.BR DT_RPATH ,
+.BR DT_RUNPATH ,
+.BR DT_AUDIT ,
+and
+.BR DT_DEPAUDIT
+of ELF binaries,
+.IP o 3
+in the arguments to the
+.B ld.so
+command line options
+.BR \-\-audit ,
+.BR \-\-library-path ,
+and
+.B \-\-preload
+(see below), and
+.IP o 3
+in the file name arguments to the
+.BR dlopen (3)
+and
+.BR dlmopen (3)
+functions.
+.PP
+The substituted tokens are as follows.
 .TP
 .IR $ORIGIN " (or equivalently " ${ORIGIN} )
 This expands to
@@ -156,6 +185,9 @@ value in the auxiliary vector (see
 .\"
 .\" ld.so lets names be abbreviated, so $O will work for $ORIGIN;
 .\" Don't do this!!
+.PP
+Note that the dynamic string tokens have to be quoted properly when
+set from a shell, to prevent their expension as environment variables.
 .SH OPTIONS
 .TP
 .BI \-\-audit " list"