76423 – set[ug]id, dynamic linking and lazy bindings in sys-fs/fuse

Bug 76423 - set[ug]id, dynamic linking and lazy bindings in sys-fs/fuse

Summary: set[ug]id, dynamic linking and lazy bindings in sys-fs/fuse

Status:	VERIFIED FIXED

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Current packages (show other bugs)
Hardware:	All Linux

Importance:	High minor (vote)
Assignee:	Stefan Schweizer (RETIRED)

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2005-01-02 09:04 UTC by Gen Zhang
Modified:	2009-10-06 12:00 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Gen Zhang 2005-01-02 09:04:24 UTC

The wonderful portage gives the following:

QA Notice: /usr/bin/fusermount is setXid, dynamically linked and using lazy bindings.
This combination is generally discouraged. Try: LDFLAGS='-Wl,-z,now' emerge fuse

To be fair, it's pretty self-explanatory for anyone who is running an unstable ebuild and likes to watch the emerge process. On the otherhand, it is a pretty serious security hole, in something that is close to the kernel.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1 Stefan Schweizer (RETIRED) gentoo-dev

2005-01-03 00:01:36 UTC

Thank you for reporting, fixed in cvs.

Comment 2 Samuli Suominen (RETIRED) gentoo-dev

2009-10-06 12:00:37 UTC

+*fuse-2.7.4-r1 (06 Oct 2009)
+
+  06 Oct 2009; Samuli Suominen <ssuominen@gentoo.org> +fuse-2.7.4-r1.ebuild:
+  Drop fuse-fix-lazy-binding.patch wrt #226935, thanks to Rafał Mużyło
+  for reporting.