Bug 117297 - dev-games/cegui-0.4.1 contains insecure RUNPATH
Bug#: 117297 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: folken@folkwolf.net
Component: Runpath Issues
URL: 
Summary: dev-games/cegui-0.4.1 contains insecure RUNPATH
Keywords:  
Status Whiteboard: ~2 [ebuild]
Opened: 2005-12-31 11:33 0000
Description:   Opened: 2005-12-31 11:33 0000
QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/cegui-0.4.1/work/cegui_mk2/src/renderers/OpenGLGUIRenderer/.libs:/usr/lib/gcc/i686-pc-linux-gnu/3.4.4
usr/share/doc/cegui-0.4.1/Samples/common/src/.libs/libCEGUISampleHelper.so
/var/tmp/portage/cegui-0.4.1/work/cegui_mk2/src/renderers/OpenGLGUIRenderer/.libs:/usr/lib/gcc/i686-pc-linux-gnu/3.4.4
usr/share/doc/cegui-0.4.1/Samples/common/src/.libs/libCEGUISampleHelper.so.0.0.0
/var/tmp/portage/cegui-0.4.1/work/cegui_mk2/src/renderers/OpenGLGUIRenderer/.libs:/usr/lib/gcc/i686-pc-linux-gnu/3.4.4
usr/share/doc/cegui-0.4.1/Samples/common/src/.libs/libCEGUISampleHelper.so.0

------- Comment #1 From Nick "folken" Matthews 2005-12-31 11:35:55 0000 -------
Portage 2.0.53 (default-linux/x86/2005.0, gcc-3.4.4, glibc-2.3.5-r2,
2.6.14-gent
oo-r2 i686)   
=================================================================
System uname: 2.6.14-gentoo-r2 i686 AMD Sempron(tm) Processor 2600+
Gentoo Base System version 1.6.13
dev-lang/python:     2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.10
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.20
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium3 -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.3/env
/usr/kde/3.3/share/config /usr/kde/3.3/shutdown /usr/kde/3.4/env
/usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3.5/env
/usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/kde/3/share/config
/usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref /usr/share/config
/usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/
/usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/
/usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=pentium3 -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 16bit 3dnow 3dnowext X a52 aac accounting acl acpi alsa apache2 apm
arts audiofile bash-completion berkdb bitmap-fonts bootsplash bzip2 cegui
chroot cjk crypt cscope cups curl devil devmap dga dnd doc dts dvd dxr3 ecc eds
encode enscript erandom esd exif expat fam ffmpeg flac font-server foomaticdb
fortran gd gdbm gif glut gmp gnome gnomedb gphoto2 gpm gstreamer gtk gtk2
high-ints idn ieee1394 imagemagick imap imlib intl ipv6 j2ee jack java javadoc
jce jikes jpeg junit kde lcms libcaca libg++ libwww lm_sensors logitech-mouse
lzw lzw-tiff mad mailbox maildir matrox mbox mikmod mime mmx mmxext mng motif
mozilla mp3 mpeg mpeg2 mpeg4 ncurses network nls nptl ogg oggvorbis openal
opengl oss pam pcre pdflib perforce perl pg-intdatetime png postgres ppds
python qt readline recode ruby samba sdl skey slang speex spell sql sqlite sse
sse2 ssl subversion svg svga svgz tcpd tetex theora threads tiff truetype
truetype-fonts type1-fonts udev unicode usb userlocales utf8 v4l v4l2 vdesktop
vidix vim-pager visualization vorbis win32codecs xine xinerama xml2 xrandr xv
xvid xvmc zlib video_cards_matrox userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, MAKEOPTS

------- Comment #2 From Stefan Cornelius (RETIRED) 2005-12-31 20:39:15 0000 -------
please provide a fixed ebuild, thx.

------- Comment #3 From Mike Nelson 2006-01-05 11:34:32 0000 -------
I have this same issue.

Portage 2.0.53 (default-linux/x86/2005.1, gcc-3.4.4, glibc-2.3.5-r2,
2.6.14-gentoo-r5 i686)
=================================================================
System uname: 2.6.14-gentoo-r5 i686 Intel(R) Pentium(R) 4 CPU 3.60GHz
Gentoo Base System version 1.6.13
dev-lang/python:     2.2.3-r5, 2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.20
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O3 -march=pentium4 -funroll-loops -fprefetch-loop-arrays -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.1/share/config
/usr/kde/3.2/share/config /usr/kde/3.3/env /usr/kde/3.3/share/config
/usr/kde/3.3/shutdown /usr/kde/3.4/env /usr/kde/3.4/share/config
/usr/kde/3.4/shutdown /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb
/usr/lib/mozilla/defaults/pref /usr/share/config
/usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/
/usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/
/usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O3 -march=pentium4 -funroll-loops -fprefetch-loop-arrays -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="ftp://ftp.ussg.iu.edu/pub/linux/gentoo
http://gentoo.chem.wisc.edu/gentoo/ http://cudlug.cudenver.edu/gentoo/
ftp://ftp.ndlug.nd.edu/pub/gentoo/ ftp://ftp.wwc.edu/pub/mirrors/ftp.gentoo.org
"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.namerica.gentoo.org/gentoo-portage"
USE="x86 X aac alsa apm arts audiofile avi berkdb bitmap-fonts browserplugin
bzip2 cdparanoia cdr cegui cg crypt cups curl devil doc dvd dvdr dvdread eds
emboss encode esd exif expat fam flac foomaticdb fortran gd gdbm gif glut gnome
gpm gstreamer gt gtk gtk2 idn imagemagick imlib ipv6 java jpeg junit kde lcms
libg++ libwww mad matroska mikmod mng motif mozilla mp3 mpeg mplayer music
ncurses nls nptl offensive ogg oggvorbis openal opengl oss pam pcre pdflib perl
png ppds python qt quicktime readline real recode samba sdl slang speex spell
sqlite ssl svga tcltk tcpd tetex tiff truetype truetype-fonts type1-fonts udev
unicode voice vorbis win32codecs xine xml xml2 xmms xv zlib userland_GNU
kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY

------- Comment #4 From Mr. Bones. 2006-01-05 13:52:04 0000 -------
I can't reproduce this.

Can you try building with CFLAGS="-pipe" CXXFLAGS="-pipe" only and see if it
still happens please?

------- Comment #5 From Nick "folken" Matthews 2006-01-05 20:00:06 0000 -------
(In reply to comment #4)
> I can't reproduce this.
> 
> Can you try building with CFLAGS="-pipe" CXXFLAGS="-pipe" only and see if it
> still happens please?
> 

I can still reproduce this when CFLAGS="-pipe" and CXXFLAGS="-pipe"

------- Comment #6 From Mike Nelson 2006-01-06 09:53:10 0000 -------
(In reply to comment #4)
> I can't reproduce this.
> 
> Can you try building with CFLAGS="-pipe" CXXFLAGS="-pipe" only and see if it
> still happens please?
> 

Failed for me as well. Same error.

I think I did this right, this is what I ran,

CFAGS="-pipe" CXXFLAGS="-pipe" emerge cegui

------- Comment #7 From SpanKY 2006-01-06 15:30:17 0000 -------
CFLAGS wouldnt have anything to do with it

someone run `emerge cegui >& log` and post the log as an attachment

------- Comment #8 From Mike Nelson 2006-01-06 20:39:25 0000 -------
Created an attachment (id=76429) [details]
Output of `emerge cegui >& log`

------- Comment #9 From basic 2006-01-09 07:37:39 0000 -------
Created an attachment (id=76640) [details]
cause of the problem

this is a libtool file found in Samples/common/src seems to be the cause. One
way to work around it is to patch this file, during the install phase so that
it doesn't add the rpath when relinking.

------- Comment #10 From Tupone Alfredo 2006-01-10 16:27:59 0000 -------
Created an attachment (id=76790) [details]
patch to cegui-0.4.0 ebuild

This is a patch to the cegui-0.4.0.ebuild The version 0.4.1 is basically
identical, so the same apply.
Fixed some problem with documentation.
What raised the RUNPATH issues is the raw copy of all the Samples directory,
where autotool generate one of the shared library. Autotool use to fix the
runpath during install, and this library is effectively installed. The library
raising the issue was the not installed: simply copied to the Sample tree. I
removed from the image tree, before leaving the src_install

------- Comment #11 From Mike Nelson 2006-01-14 09:31:17 0000 -------
(In reply to comment #10)
> Created an attachment (id=76790) [edit] [details]
> patch to cegui-0.4.0 ebuild
> 
> This is a patch to the cegui-0.4.0.ebuild The version 0.4.1 is basically
> identical, so the same apply.
> Fixed some problem with documentation.
> What raised the RUNPATH issues is the raw copy of all the Samples directory,
> where autotool generate one of the shared library. Autotool use to fix the
> runpath during install, and this library is effectively installed. The library
> raising the issue was the not installed: simply copied to the Sample tree. I
> removed from the image tree, before leaving the src_install
> 

This fixed it for me on cegui-0.4.1. Thanks!

------- Comment #12 From Thierry Carrez (RETIRED) 2006-01-15 09:20:02 0000 -------
Alfredo: many thx for figuring it out.
Games team: please evaluate and bump with patch.

------- Comment #13 From Michael Kedzierski 2006-02-24 17:52:51 0000 -------
Hi, this patch does indeed fix the issue on two different machines (amd64 and
x86) that I've tried, on version 0.4.1.

------- Comment #14 From SpanKY 2006-02-25 20:34:03 0000 -------
thanks, ive converted the ebuild to utilize USE=examples and install a clean
sample source tree