Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 509242 - net-libs/serf-1.3.5: RUNPATH broken
Summary: net-libs/serf-1.3.5: RUNPATH broken
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Arfrever Frehtes Taifersar Arahesis
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-05-01 08:56 UTC by Michał Górny
Modified: 2014-11-05 15:51 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Build log (build.log,25.41 KB, text/x-log)
2014-05-01 08:56 UTC, Michał Górny
Details
Patch fixing the issue and possibly more (serf-1.3.7-list-vars.patch,3.49 KB, patch)
2014-08-12 08:23 UTC, Michał Górny
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-05-01 08:56:09 UTC
Created attachment 376128 [details]
Build log

$ readelf -d /usr/lib64/libserf-1.so.1.3.0

[...]

 0x000000000000001d (RUNPATH)            Library runpath: [/usr/lib64:$:O:P:E:N:S:L:/:l:i:b]


--
emerge --info:

Portage 2.2.10 (default/linux/amd64/13.0/desktop, gcc-4.8.2, glibc-2.19, 3.14.0-pf1-mgorny-amd64+ x86_64)
=================================================================
System uname: Linux-3.14.0-pf1-mgorny-amd64+-x86_64-AMD_Athlon-tm-_64_X2_Dual_Core_Processor_3800+-with-gentoo-2.2
KiB Mem:     4048668 total,   2241464 free
KiB Swap:    1502072 total,   1502072 free
Timestamp of tree: Thu, 01 May 2014 07:30:01 +0000
ld GNU ld (GNU Binutils) 2.24
distcc 3.2rc1 x86_64-pc-linux-gnu [enabled]
ccache version 3.1.9 [disabled]
app-shells/bash:          4.2_p47
dev-java/java-config:     2.2.0
dev-lang/python:          2.7.6-r1, 3.2.5-r3, 3.3.5, 3.4.0
dev-util/ccache:          3.1.9-r3
dev-util/cmake:           2.8.12.2
sys-apps/baselayout:      2.2
sys-apps/openrc:          0.12.4
sys-apps/sandbox:         2.6-r1
sys-devel/autoconf:       2.13, 2.69
sys-devel/automake:       1.11.6, 1.13.4, 1.14.1
sys-devel/binutils:       2.24-r2
sys-devel/gcc:            4.8.2
sys-devel/gcc-config:     1.8
sys-devel/libtool:        2.4.2
sys-devel/make:           4.0-r1
sys-kernel/linux-headers: 3.14 (virtual/os-headers)
sys-libs/glibc:           2.19
Repositories: gentoo okupy sunrise x11 science gentoo-cvs mgorny
Installed sets: @system
ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="* -@EULA"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=athlon64 -O2 -pipe -frecord-gcc-switches"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=athlon64 -O2 -pipe -frecord-gcc-switches"
DISTDIR="/srv/nfs/common/distfiles"
EMERGE_DEFAULT_OPTS="--with-bdeps y --ask --keep-going --quiet-build=n"
FCFLAGS="-march=athlon64 -O2 -pipe -frecord-gcc-switches"
FEATURES="assume-digests binpkg-logs buildpkg cgroup collision-protect config-protect-if-modified distcc distcc-pump distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms sign strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync"
FFLAGS="-march=athlon64 -O2 -pipe -frecord-gcc-switches"
GENTOO_MIRRORS="http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/ http://gentoo.mirror.web4u.cz/ http://mirror.netcologne.de/gentoo/ http://ftp.snt.utwente.nl/pub/os/linux/gentoo http://gd.tuwien.ac.at/opsys/linux/gentoo/ http://gentoo.mirror.pw.edu.pl/ http://ftp.vectranet.pl/gentoo/ http://ftp.fi.muni.cz/pub/linux/gentoo/"
INSTALL_MASK=""
LANG="pl_PL.utf8"
LC_ALL="pl_PL.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu"
MAKEOPTS="-j12"
PKGDIR="/srv/nfs/common/packages/athlon64"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --times --compress --force --whole-file --delete --stats --timeout=45 --exclude=/distfiles --exclude=/packages --exclude=/local --exclude=CVS --exclude=/metadata/cache --omit-dir-times"
PORTAGE_TMPDIR="/tmp"
PORTDIR="/var/db/repos/gentoo"
PORTDIR_OVERLAY="/var/db/repos/okupy /var/db/repos/sunrise /var/db/repos/x11 /var/db/repos/science /usr/src/gx86 /home/mgorny/git/mgorny-repo"
USE="3dnow 3dnowext X a52 aac acl adns aio alsa amd64 bash-completion bluetooth branding btrfs bzip2 cairo caps cdda cdr cli crypt cups curl cxx dbus djvu dri dts dvb dvd dvdr egl emboss exif fftw firefox flac fontconfig fortran gd gif glamor gles2 gmp gnuplot gnutls gphoto2 gstreamer gtk iconv idn imagemagick ipv6 jpeg jpeg2k kate latex lcms libass libatomic liblockfile libnotify libproxy libsamplerate libsecret libtiger lz4 lzma lzo mad mmap mmx mmxext mng modules mp3 mp4 mpeg multilib ncurses nls nptl ogg openal opencl opengl openmp openvg opus osmesa pam pango pch pcre pcre-jit pdf plotutils png postscript ppds qt3support readline sdl session slang smp sndfile speex spell sse sse2 sse3 ssl startup-notification svg systemd t1lib tcpd threads tiff truetype udev udisks unicode upower usb v4l2 vhosts vim-syntax vorbis wavpack wayland webp wmf wxwidgets x264 xattr xcb xft xml xpm xv xvid xvmc zlib" ABI_X86="32 64" ALSA_CARDS="hda-intel emu10k1 virmidi mpu401 pcsp" APACHE2_MODULES="actions alias deflate filter mime mime_magic negotiation rewrite socache_shmcb unixd" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="pl" LIRC_DEVICES="serial" NGINX_MODULES_HTTP="gzip limit_conn limit_req rewrite spdy uwsgi" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4 python3_3 python3_2 python3_1 jython2_7 pypy" QEMU_SOFTMMU_TARGETS="i386 x86_64 ppc ppc64 ppc64abi32 arm aarch64" QEMU_USER_TARGETS="ppc ppc64 arm aarch64" RUBY_TARGETS="ruby19 ruby20" SANE_BACKENDS="artec_eplus48u" USERLAND="GNU" VIDEO_CARDS="nouveau vesa radeon r600 s3" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7 3.3 3.2"
Unset:  CPPFLAGS, CTARGET, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, SYNC
Comment 1 Arfrever Frehtes Taifersar Arahesis 2014-05-01 10:03:16 UTC
I cannot reproduce it.
RUNPATH is "/usr/lib64:/usr/lib" for me. (I will think about how to delete "/usr/lib" from it.)
There were no changes in SConstruct between 1.3.4 and 1.3.5.
Which version of dev-util/scons do you use?
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-05-01 10:39:34 UTC
(In reply to Arfrever Frehtes Taifersar Arahesis from comment #1)
> I cannot reproduce it.
> RUNPATH is "/usr/lib64:/usr/lib" for me. (I will think about how to delete
> "/usr/lib" from it.)
> There were no changes in SConstruct between 1.3.4 and 1.3.5.
> Which version of dev-util/scons do you use?

2.3.1-r1
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-08-12 08:23:08 UTC
Created attachment 382718 [details, diff]
Patch fixing the issue and possibly more

Long story short, upstream is using strings and lists interchangeably in env.Append() and then expecting list to magically come out of it.

And it does, unless you hit a code path with strings only -- then you get a string, possibly including random concatenated flags like '/usr/lib64/usr/lib64'... then the string is passed to function expecting list, iterator gets it per-character and you get what I get.

The attached patch makes sure that lists are appended consistently everywhere. I left only RPATH since it seemed to really want to be a string instead.
Comment 4 Nikos Chantziaras 2014-08-12 13:31:33 UTC
I get a big, fat, yellow warning during emerge. No one else gets that? I don't need to use readelf to see it.

scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='O:P:E:N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='P:E:N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='E:N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='O:P:E:N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='P:E:N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='E:N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='N:S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='S:L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='L:/:l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='l:i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='i:b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
scanelf: rpath_security_checks(): Maybe? sec problem with DT_RUNPATH='b' in /var/tmp/portage/net-libs/serf-1.3.7/image/usr/lib64/libserf-1.so.1.3.0
Comment 5 Hans de Graaff gentoo-dev Security 2014-08-26 05:09:57 UTC
(In reply to Nikos Chantziaras from comment #4)
> I get a big, fat, yellow warning during emerge. No one else gets that? I
> don't need to use readelf to see it.

I see this too with serf 1.3.7.
Comment 6 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2014-08-26 06:52:46 UTC
Upstream has applied my patch and it will be in 1.4.0.
Comment 7 Arfrever Frehtes Taifersar Arahesis 2014-11-05 15:51:55 UTC
Fix backported to net-libs/serf-1.3.8.