Bugzilla Bug 116611

And this is obviously a bad thing.  As strict is set in profile, it makes it
really hard.

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/usr/lib/m3/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3config/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3templates/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3driver/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3linker/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3front/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3quake/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3middle/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/libm3/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3core/LINUXLIBC6
usr/bin/m3ship
/usr/lib/m3/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/libm3/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3core/LINUXLIBC6
usr/bin/m3bundle
/usr/lib/m3/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3config/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3templates/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3driver/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3linker/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3front/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3quake/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3middle/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/libm3/LINUXLIBC6:/var/tmp/portage/ezm3-1.2/work/ezm3-1.2/src/../binaries/LINUXLIBC6/usr/lib/m3/pkg/m3core/LINUXLIBC6
usr/bin/m3build 

along with 

QA Notice: the following files contain executable stacks
 Files with executable stacks will not work properly (or at all!)
 on some architectures/operating systems.  A bug should be filed
 at http://bugs.gentoo.org/ to make sure the file is fixed.
RWX --- --- usr/bin/m3ship
RWX --- --- usr/bin/m3bundle
RWX --- --- usr/bin/m3build


!!! ERROR: dev-lang/ezm3-1.2 failed.
!!! Function dyn_install, Line 1113, Exitcode 0
!!! Aborting due to serious QA concerns
!!! If you need support, post the topmost build error, NOT this status message.

Having to run with FEATURES="-strict" is sketchy

(hydrogen@meglomaniac:~)$ emerge --info
Portage 2.1_pre1 (default-linux/x86/2005.1, gcc-3.4.4, glibc-2.3.5-r2,
2.6.14-ck5-stable i686)
=================================================================
System uname: 2.6.14-ck5-stable i686 AMD Athlon(tm) XP 2500+
Gentoo Base System version 1.6.13
ccache version 2.3 [enabled]
dev-lang/python:     2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.20
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=athlon-xp -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env
/usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3.5/env
/usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/kde/3/share/config
/usr/share/X11/xkb /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/splash /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=athlon-xp -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache confcache distlocks sandbox sfperms"
GENTOO_MIRRORS="http://gentoo.mirrors.pair.com http://gentoo.mirrors.tds.net"
LANG="en_US.UTF-8"
LC_ALL="en_US.UTF-8"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X alsa apache2 apm arts audiofile avi berkdb bitmap-fonts bzip2 cdb
cdr crypt curl dri emboss encode exif expat fam ffmpeg flac foomaticdb fortran
gd gdbm gif glut gpm gstreamer gtk2 idn imlib ipv6 java jpeg kde lcms libg++
libwww logitech-mouse mad mhash mikmod mng motif mp3 mpeg mysql ncurses nls ogg
oggvorbis opengl oss pam pcre pdflib perl pic png postgres python qt quicktime
readline ruby sdl spell sql ssl subversion tcpd tiff truetype truetype-fonts
type1-fonts udev unicode usb vorbis xine xml2 xmms xv xvid zlib elibc_glibc
kernel_linux userland_GNU"
Unset:  ASFLAGS, CTARGET, LDFLAGS, LINGUAS, MAKEOPTS

Created an attachment (id=76866) [details]
files/ezm3-1.2-RUNPATH.patch

Patch to build ezm3 statically. That seems to me the only way to remove the
runpath security issue. As is only used to build cvsup is not a great deal.

Created an attachment (id=76867) [details]
ezm3-1.2-r1.ebuild.patch

Patch to ebuild to apply runpath patch

vapier: your opinion as maintainer ? Any other solution ?

The next ~arch portage revision will auto repair evil rpaths and not bail. 
Maintainers should still fix the packages they maintain as portage will only
die
with FEATURES=stricter (but that is a maintainer & QA problem) no longer
security@

http://bugs.gentoo.org/show_bug.cgi?id=124962

No longer a security issue with current stable portage, re-assigning to
maintainer

masked to be punted