Bug 116795 - dev-lang/pike: insecure runpath
|
Bug#:
116795
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: normal
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: axxo@gentoo.org
|
|
Component: Runpath Issues
|
|
|
URL:
|
|
Summary: dev-lang/pike: insecure runpath
|
|
Keywords:
|
|
Status Whiteboard: B3 [stable?] DerCorny
|
|
Opened: 2005-12-26 10:52 0000
|
QA Notice: the following files contain insecure RUNPATH's
Please file a bug about this at http://bugs.gentoo.org/
For more information on this issue, kindly review:
http://bugs.gentoo.org/81745
/var/tmp/portage/pike-7.6.24/work/Pike-v7.6.24/build/linux-2.6.14-gentoo-r5-i686/bundles/lib:/usr/local/lib:/usr/X11R6/lib
usr/bin/pike
QA Notice: the following files contain executable stacks
Files with executable stacks will not work properly (or at all!)
on some architectures/operating systems. A bug should be filed
at http://bugs.gentoo.org/ to make sure the file is fixed.
RWX --- --- usr/lib/pike/modules/Image.so
... oh yeah, how i love it. dev-lang/pike Herd: no-herd Maintainer: no-herd
and the guy in the changelog is no longer a dev. i hope that kloeri might take
a look, though
This problem also occurred with the (unstable) pike-7.6.50 ebuild.
*** Bug 118258 has been marked as a duplicate of this bug. ***
*** Bug 118770 has been marked as a duplicate of this bug. ***
Created an attachment (id=77034) [details]
pike-7.6.24.ebuild runpath fix
This is a fix to runpath. I disable the bundles at configure time (actually
dunno what they are, I guess plugins). The directory where bundles should be is
not there, in the broken build, and rpath pointed to a wrong place
(/var/tmp/portage/...)
So removing bundles should not degrade.
Now emerge cleanly
Thx for the analysis, now we just need to find some herd/dev in Gentoo that
accepts to take that package :)
I found someone in the forum that did a manual install of Pike when the ebuild
crashes. Just a simple "make install" in the
/var/tmp/portage/pike-7.6.50/work/Pike-v7.6.50 dir.
Now, I know that's breaking the rules, but for testing the mkdvd script I had I
did so. It installed fine and works just great.
I hope someone can fix the ebuild so it can be installed properly through
portage.
*** Bug 124015 has been marked as a duplicate of this bug. ***
The next ~arch portage revision will auto repair evil rpaths and not bail.
Maintainers should still fix the packages they maintain as portage will only
die
with FEATURES=stricter (but that is a maintainer & QA problem) no longer
security@
http://bugs.gentoo.org/show_bug.cgi?id=124962
I just fixed this problem in the two latest versions.
We still need the fixed versions to be marked stable.
Arches please test.
I am closing this bug, since the original issue of the report is pretty much
solved now. We can move the arch testing reports to bug #136065.