1 2 ProFTPD 1.3.x README.AIX 3 ======================== 4 5Introduction 6------------ 7 8There are two issues when compiling on AIX systems that can be worked 9around using the proper configure command lines. 10 11One problem involves the less than optimal default shared object search 12path that the IBM linker inserts into executables. The second problem is 13compilaton failure stemming from an incompatibility with the <string.h> 14header file when the IBM compiler attempts to inline some string functions. 15 16Also, a minor usage note: do NOT use the --enable-autoshadow or --enable-shadow 17configure options when configuring ProFTPD for AIX. AIX does not use 18the shadow libraries. 19 20 21Executive Summary 22----------------- 23 24If you are using the IBM xlc/cc compiler with the IBM ld linker: 25 26 % env CC=cc \ 27 CFLAGS='-D_NO_PROTO' \ 28 LDFLAGS='-blibpath:/usr/lib:/lib:/usr/local/lib' \ 29 ./configure ... 30 31If you are using the GNU gcc compiler with the IBM ld linker: 32 33 % env CC=gcc \ 34 LDFLAGS='-Wl,-blibpath:/usr/lib:/lib:/usr/local/lib' \ 35 ./configure ... 36 37If you are using the GNU gcc compiler with the GNU ld linker, 38something like this ought to work (untested): 39 40 % env CC=gcc \ 41 LDFLAGS='-Wl,-rpath,/usr/lib,-rpath,/lib,-rpath,/usr/local/lib' \ 42 ./configure ... 43 44Note that the library paths shown here are for example use only. 45You may need to use different paths on your system, particularly when 46linking with any optional libraries (e.g. krb5, ldap, mysql, etc.). 47 48 49Compiling with the GNU compiler 50------------------------------- 51 52It is recommend that gcc-3.3.2 *not* be used when compiling proftpd on AIX. 53There were problems reported of session processes going into endless loops. 54Using gcc-4.1.0 should work properly. 55 56 57Linking with the IBM or GNU linker 58---------------------------------- 59 60There is a potential security problem when using the IBM linker. 61Unlike other Unix systems, by default the IBM linker automatically will 62use the compile time library search path as the runtime shared library 63search path. The use of relative paths in the runtime library search 64path is an especially acute security problem for suid or sgid programs. 65This default behavior is documented, so it is not considered a bug by IBM. 66However, some suid programs that have shipped with AIX have included insecure 67library search paths and are vulnerable to privilege elevation exploits. 68 69This may not be such a serious a security problem for ProFTPD, since it 70is not installed suid or sgid. Nonetheless, it is wise to configure the 71runtime shared library search path with a reasonable setting. For instance, 72consider potential problems from searching NFS mounted directories. 73 74An existing AIX executable's library search path can be displayed: 75 76 % dump -H progname 77 78The runtime library search patch should be specified explicitly at 79build time using the -blibpath option: 80 81 % cc -blibpath:/usr/lib:/lib:/usr/local/lib 82 83 % gcc -Wl,-blibpath:/usr/lib:/lib:/usr/local/lib 84 85See the ld documentation, not just that of xlc/cc, for further information 86on the IBM linker flags. Alternatively, an insecure library search path 87can be avoided using -bnolibpath, which causes the default path to be used 88(either the value of the LIBPATH environment variable, if defined, or 89/usr/lib:/lib, if not). 90 91It has been reported that at least some versions of GNU ld (e.g. 2.9.1) 92have emulated this default linking behavior on AIX platforms. However, 93GNU ld uses -rpath to set the runtime library search path, rather than 94the IBM ld -blibpath or the Sun ld -R options: 95 96 % gcc -Wl,-rpath,/usr/lib,-rpath,/lib,-rpath,/usr/local/lib 97 98Again, consult the GNU ld documentation for further information. 99Note that using the gcc compiler does not imply that it uses the GNU 100ld linker. In fact, it is more common to use the IBM system linker. 101 102The upshot of all this is that you should tell configure what to use 103for the runtime shared library search path. This can be done by setting 104LDFLAGS on the configure command line, possibly like this: 105 106 % env CC=cc LDFLAGS='-blibpath:/usr/lib:/lib:/usr/local/lib' \ 107 ./configure ... 108 109 % env CC=gcc LDFLAGS='-Wl,-blibpath:/usr/lib:/lib:/usr/local/lib' \ 110 ./configure ... 111 112In addition to setting the runtime library search path during the original 113software build, the IBM linker can relink an existing *unstripped* executable 114using a new runtime library search path: 115 116 % cc -blibpath:/usr/lib:/lib:/usr/local/lib -lm -ldl \ 117 -o progname.new progname 118 119 % gcc -Wl,-blibpath:/usr/lib:/lib:/usr/local/lib -lm -ldl \ 120 -o progname.new progname 121 122where the "-l" options refer to shared libraries, which can be determined 123from the output of: 124 125 % dump -Hv progname 126 127which displays shared library information. A basic proftpd executable 128probably will not require any "-l" options at all. 129 130 131Compiling with the IBM xlc/cc compiler 132-------------------------------------- 133 134There is a problem with the index and rindex macros defined in <string.h>. 135Apparently, these are used as part of an attempt to inline string functions 136when the __STR__ C preprocessor macro is defined. Conflicts with these 137definitions will cause compilation failures. 138 139The work-around is to undefine the __STR__ C preprocessor macro, which 140is predefined by the IBM compiler. This can be done on the configure 141command line by adding '-U__STR__' to the CPPFLAGS variable: 142 143 % env CC=cc CPPFLAGS='-U__STR__' ./configure ... 144 145However, with newer versions of proftpd, it has been found that the following 146combination works better when compiling: 147 148 % env CC=cc CFLAGS='-D_NO_PROTO' ./configure ... 149 150 151Sendfile support in AIX 152----------------------- 153 154It appears that the sendfile() function in AIX 5.3 155(specifically AIX 5300-04-02) is faulty. If you are running proftpd-1.3.0 156or later on AIX, place the following in your proftpd.conf: 157 158 UseSendfile off 159 160Failure to do so can result in downloads of files that end up being 161the wrong size (downloaded files being far too large, etc). 162 163