Work in the presence of capabilities

Include a hardcoded install path in RPATH in binaries. This is used
as fallback when $ORIGIN is ignored. $ORIGIN is ignored for when
linux capabilities are added to the binary.

Fix launcher to treat the case where capabilities are set as
identical to a setuid binary: don't expect LD_LIBRARY_PATH to be
set.
diff -r b85872bd06da Makefile.am
--- a/Makefile.am	Thu Apr 09 20:20:00 2015 +0100
+++ b/Makefile.am	Thu Apr 09 20:41:52 2015 +0100
@@ -815,7 +815,8 @@
 	BUILD_GCC=gcc$(GCC_SUFFIX) \
 	BUILD_CXX=g++$(GCC_SUFFIX) \
 	COMPILER_WARNINGS_FATAL="$(WERROR_STATUS)" \
-	UNLIMITED_CRYPTO="true"
+	UNLIMITED_CRYPTO="true" \
+	INSTALL_LOCATION="${INSTALL_LOCATION}"
 
 if ENABLE_CACAO
 ICEDTEA_ENV += \
diff -r b85872bd06da patches/add-final-location-rpaths.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/patches/add-final-location-rpaths.patch	Thu Apr 09 20:41:52 2015 +0100
@@ -0,0 +1,121 @@
+diff -Nru openjdk.orig/corba/make/common/Defs-linux.gmk openjdk/corba/make/common/Defs-linux.gmk
+--- openjdk.orig/corba/make/common/Defs-linux.gmk	2015-04-09 20:37:21.682577260 +0100
++++ openjdk/corba/make/common/Defs-linux.gmk	2015-04-09 20:38:35.115295051 +0100
+@@ -209,8 +209,8 @@
+   #   The environment variable LD_LIBRARY_PATH will over-ride these runpaths.
+   #   Try: 'readelf -d lib*.so' to see these settings in a library.
+   #
+-  LDFLAGS_COMMON += -Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN
+-  LDFLAGS_COMMON += $(LD_RUNPATH_EXTRAS:%=-Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN/%)
++  LDFLAGS_COMMON += -Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN:$(INSTALL_LOCATION)/jre/lib/$(LIBARCH)
++  LDFLAGS_COMMON += $(LD_RUNPATH_EXTRAS:%=-Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN/:$(INSTALL_LOCATION)/jre/lib/$(LIBARCH)%)
+ endif
+ 
+ EXTRA_LIBS += -lc
+diff -Nru openjdk.orig/jdk/make/common/Defs-linux.gmk openjdk/jdk/make/common/Defs-linux.gmk
+--- openjdk.orig/jdk/make/common/Defs-linux.gmk	2015-04-09 20:37:21.962579996 +0100
++++ openjdk/jdk/make/common/Defs-linux.gmk	2015-04-09 20:38:35.115295051 +0100
+@@ -233,8 +233,8 @@
+   #   The environment variable LD_LIBRARY_PATH will over-ride these runpaths.
+   #   Try: 'readelf -d lib*.so' to see these settings in a library.
+   #
+-  LDFLAGS_COMMON += -Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN
+-  LDFLAGS_COMMON += $(LD_RUNPATH_EXTRAS:%=-Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN/%)
++  LDFLAGS_COMMON += -Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN:$(INSTALL_LOCATION)/jre/lib/$(LIBARCH)
++  LDFLAGS_COMMON += $(LD_RUNPATH_EXTRAS:%=-Xlinker -z -Xlinker origin -Xlinker -rpath -Xlinker \$$ORIGIN/:$(INSTALL_LOCATION)/jre/lib/$(LIBARCH)%)
+ endif
+ 
+ EXTRA_LIBS += -lc
+diff -Nru openjdk.orig/jdk/make/common/Program.gmk openjdk/jdk/make/common/Program.gmk
+--- openjdk.orig/jdk/make/common/Program.gmk	2015-04-09 20:37:28.862647438 +0100
++++ openjdk/jdk/make/common/Program.gmk	2015-04-09 20:39:08.779624149 +0100
+@@ -83,9 +83,10 @@
+ 	endif
+     endif
+     ifeq ($(PLATFORM), linux)
++	LDFLAGS += -lcap
+ 	LDFLAGS += $(ZLIB_LIBS) -Wl,-z -Wl,origin
+ 	LDFLAGS += -Wl,--allow-shlib-undefined
+-	LDFLAGS += -Wl,-rpath -Wl,\$$ORIGIN/../lib/$(LIBARCH)/jli
++	LDFLAGS += -Wl,-rpath -Wl,\$$ORIGIN/../lib/$(LIBARCH)/jli:$(INSTALL_LOCATION)/jre/lib/$(LIBARCH)/jli
+     endif
+ endif
+ ifeq ($(PLATFORM), windows)
+diff -Nru openjdk.orig/jdk/make/java/instrument/Makefile openjdk/jdk/make/java/instrument/Makefile
+--- openjdk.orig/jdk/make/java/instrument/Makefile	2015-04-09 02:19:17.000000000 +0100
++++ openjdk/jdk/make/java/instrument/Makefile	2015-04-09 20:38:35.115295051 +0100
+@@ -111,7 +111,7 @@
+   ifeq ($(PLATFORM), linux)
+     LDFLAGS += -Wl,-z -Wl,origin
+     LDFLAGS += -Wl,--allow-shlib-undefined
+-    LDFLAGS += -Wl,-rpath -Wl,\$$ORIGIN/jli
++    LDFLAGS += -Wl,-rpath -Wl,\$$ORIGIN/jli:$(INSTALL_LOCATION)/jre/lib/$(LIBARCH)/jli
+   endif
+ endif
+ 
+diff -Nru openjdk.orig/jdk/src/solaris/bin/java_md.c openjdk/jdk/src/solaris/bin/java_md.c
+--- openjdk.orig/jdk/src/solaris/bin/java_md.c	2015-04-09 02:19:52.000000000 +0100
++++ openjdk/jdk/src/solaris/bin/java_md.c	2015-04-09 20:38:35.115295051 +0100
+@@ -39,6 +39,7 @@
+ 
+ #ifdef __linux__
+ #include <pthread.h>
++#include <sys/capability.h>
+ #else
+ #include <thread.h>
+ #endif
+@@ -169,6 +170,19 @@
+     return LIBARCHNAME;
+ }
+ 
++#ifdef __linux
++static int
++have_caps() {
++    int have_cap = 0;
++    cap_t no_caps = cap_init();
++    cap_t my_caps = cap_get_proc();
++    have_cap = cap_compare(no_caps, my_caps);
++    cap_free(my_caps);
++    cap_free(no_caps);
++    return have_cap;
++}
++#endif
++
+ void
+ CreateExecutionEnvironment(int *_argcp,
+                            char ***_argvp,
+@@ -413,20 +427,24 @@
+ 
+ #ifdef __linux
+       /*
+-       * On linux, if a binary is running as sgid or suid, glibc sets
+-       * LD_LIBRARY_PATH to the empty string for security purposes.  (In
+-       * contrast, on Solaris the LD_LIBRARY_PATH variable for a
+-       * privileged binary does not lose its settings; but the dynamic
+-       * linker does apply more scrutiny to the path.) The launcher uses
+-       * the value of LD_LIBRARY_PATH to prevent an exec loop.
+-       * Therefore, if we are running sgid or suid, this function's
+-       * setting of LD_LIBRARY_PATH will be ineffective and we should
+-       * return from the function now.  Getting the right libraries to
+-       * be found must be handled through other mechanisms.
++       * On linux, if a binary is running as sgid or suid, or has
++       * capabilities set, glibc sets LD_LIBRARY_PATH to the empty
++       * string for security purposes. (In contrast, on Solaris the
++       * LD_LIBRARY_PATH variable for a privileged binary does not lose
++       * its settings; but the dynamic linker does apply more scrutiny
++       * to the path.) The launcher uses the value of LD_LIBRARY_PATH to
++       * prevent an exec loop.  Therefore, if we are running sgid or
++       * suid, or have linux capabilities set,  this function's setting
++       * of LD_LIBRARY_PATH will be ineffective and we should return
++       * from the function now. Getting the right libraries to be found
++       * must be handled through other mechanisms.
+        */
+       if((getgid() != getegid()) || (getuid() != geteuid()) ) {
+         return;
+       }
++      if (have_caps()) {
++        return;
++      }
+ #endif
+ 
+       /* runpath contains current effective LD_LIBRARY_PATH setting */