+ /* For SUID/GUID programs we normally ignore the path with
+ a DST in DT_RUNPATH, or DT_RPATH. However, there is
+ one exception to this rule, and it is:
+
+ * $ORIGIN appears first in the path element, and is
+ the only thing in the element or is immediately
+ followed by a path separator and the rest of the
+ path.
+
+ * The path element is rooted in a trusted directory.
+
+ This exception allows such programs to reference
+ shared libraries in subdirectories of trusted
+ directories. The use case is one of general
+ organization and deployment flexibility.
+ Trusted directories are usually such paths as "/lib64"
+ or "/lib". */
+ if (__glibc_unlikely (__libc_enable_secure)
+ && !((input == start + 1
+ || (input > start + 1 && input[-2] == '\0'))
+ && (input[len] == '\0' || input[len] == '/')))
+ repl = (const char *) -1;