Bug 105719 – dev-db/qt-unixODBC contains insecure RUNPATH's

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Ashu Tiwary 2005-09-12 12:16:30 UTC]

when emerging edv-db/qt-unixODBC-3.3.4, the emerge fails w/ "insecure
RUNPATH's":

>>> Install qt-unixODBC-3.3.4 into /portage/tmp/portage/qt-unixODBC-3.3.4/image/
category dev-db
man:
prepallstrip:
strip: i686-pc-linux-gnu-strip --strip-unneeded
   usr/qt/3/plugins/sqldrivers/libqsqlodbc.so

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/portage/tmp/portage/qt-unixODBC-3.3.4/work/qt-x11-free-3.3.4/plugins/sqldrivers
usr/qt/3/plugins/sqldrivers/libqsqlodbc.so


!!! ERROR: dev-db/qt-unixODBC-3.3.4 failed.
!!! Function dyn_install, Line 1044, Exitcode 0
!!! Insecure binaries detected
!!! If you need support, post the topmost build error, NOT this status message.



Reproducible: Always
Steps to Reproduce:
1. emerge "dev-db/qt-unixODBC"
2.
3.

Actual Results:  
see above

Expected Results:  
should emerge successfully

liberte insecure_runpaths # emerge --info
Portage 2.0.52-r1 (default-linux/x86/2005.1, gcc-3.4.4, glibc-2.3.5-r1,
2.6.13-gentoo i686)
=================================================================
System uname: 2.6.13-gentoo i686 Intel(R) Pentium(R) M processor 1700MHz
Gentoo Base System version 1.12.0_pre8
dev-lang/python:     2.3.5, 2.4.1-r1
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.20
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O3 -pipe -march=pentium-m -mtune=pentium-m -fweb -ftracer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /opt/openjms/config /usr/kde/2/share/config
/usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown
/usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref
/usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/texmf/web2c /etc/env.d"
CXXFLAGS="-O3 -pipe -march=pentium-m -mtune=pentium-m -fweb -ftracer"
DISTDIR="/portage/distfiles"
FEATURES="autoconfig distlocks fixpackages sandbox sfperms strict userpriv"
GENTOO_MIRRORS="http://gentoo.osuosl.org/
ftp://distro.ibiblio.org/pub/linux/distributions/gentoo/
ftp://ftp.gtlib.cc.gatech.edu/pub/gentoo http://mirror.datapipe.net/gentoo
ftp://mirror.mcs.anl.gov/pub/gentoo/"
LINGUAS="en ar bg bn br bs ca cs cy da de el en_GB eo es et eu fi fr fy ga he hi
hsb hu is it ja lt mk nb nds nl nn pa pl pt pt_BR ro ru se sk sl sr sr@Latn sv
ta tg tr uk zh_CN zh_TW"
PKGDIR="/portage/packages"
PORTAGE_TMPDIR="/portage/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X aalib alsa apm arts avi bash-completion berkdb bitmap-fonts cdr crypt
cscope cups curl directfb doc eds emboss encode erandom esd fam flac foomaticdb
fortran freetds g++ g77 gcj gd gdbm ggi gif gjava gnat gnome gobjc gpm gstreamer
gtk gtk2 guile imagemagick imlib ipv6 jack java jpeg junit kde ldap libg++
libwww lirc mad mcal mikmod motif mozilla mp3 mpeg mysql nas ncurses nls nptl
nptlonly objc odbc ogg oggvorbis opengl oss pam pdflib perl pic png postgres
python qt quicktime readline ruby samba sdl slang snmp speex spell sqlite ssl
svga tcltk tcpd tetex tiff truetype truetype-fonts type1-fonts unicode
userlocales vorbis xml xml2 xmms xv zlib linguas_en linguas_ar linguas_bg
linguas_bn linguas_br linguas_bs linguas_ca linguas_cs linguas_cy linguas_da
linguas_de linguas_el linguas_en_GB linguas_eo linguas_es linguas_et linguas_eu
linguas_fi linguas_fr linguas_fy linguas_ga linguas_he linguas_hi linguas_hsb
linguas_hu linguas_is linguas_it linguas_ja linguas_lt linguas_mk linguas_nb
linguas_nds linguas_nl linguas_nn linguas_pa linguas_pl linguas_pt linguas_pt_BR
linguas_ro linguas_ru linguas_se linguas_sk linguas_sl linguas_sr
linguas_sr@Latn linguas_sv linguas_ta linguas_tg linguas_tr linguas_uk
linguas_zh_CN linguas_zh_TW userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, MAKEOPTS, PORTDIR_OVERLAY

liberte insecure_runpaths # grep -E "dev-db/qt-unixODBC" /etc/portage/package.use
dev-db/qt-unixODBC

[Comment 1 Ashu Tiwary 2005-09-12 12:17:05 UTC]

Created attachment 68280 [details]
logfile for "emerge dev-d/qt-unixODBC"

[Comment 2 Ashu Tiwary 2005-09-12 12:17:47 UTC]

i was able to successfully emerge qt-unixODBC using the makemaker perl hack
described in bug id 105054

[Comment 3 Ashu Tiwary 2005-09-12 19:18:35 UTC]

(In reply to comment #2)
> i was able to successfully emerge qt-unixODBC using the makemaker perl hack
> described in bug id 105054

actually - i lied - in the hurry of copy/n/paste'ing to report these issues, i
had copied this section as well - the only one that has worked w/ the makemaker
perl hack has been "emerge media-gfx/imagemagick-6.2.4.2"

[Comment 4 Thierry Carrez (RETIRED) 2005-09-14 03:02:02 UTC]

CCing maintainers

[Comment 5 Caleb Tennis (RETIRED) 2005-09-19 19:04:10 UTC]

I've put qt's no-rpath.patch in this ebuild as well (as 3.3.4-r1).  Please try it again and see if it fixes this 
for you, and if so please close the bug.

[Comment 6 Ashu Tiwary 2005-09-21 00:24:29 UTC]

yep - that worked

[Comment 7 Sune Kloppenborg Jeppesen (RETIRED) 2005-09-21 00:33:12 UTC]

Reopening for GLSA decision. Though it is rated B2 I guess we could need a 
vote. I tend to vote YES. 

[Comment 8 Thierry Carrez (RETIRED) 2005-09-21 01:23:42 UTC]

Since the fix is shipped in QT rather than in qt-unix-odbc maybe a common GLSA
with bug 105695 is preferable ?

[Comment 9 Sune Kloppenborg Jeppesen (RETIRED) 2005-09-22 04:06:14 UTC]

Let's do a common GLSA with qt. 

[Comment 10 Thierry Carrez (RETIRED) 2005-09-23 13:26:42 UTC]

We'll rather do a common GLSA with other RUNPATH portage -> root priv escalation
issues.

[Comment 11 Thierry Carrez (RETIRED) 2005-10-15 03:11:41 UTC]

Let's make a GLSA with those that are ready.

[Comment 12 Thierry Carrez (RETIRED) 2005-10-17 01:25:47 UTC]

GLSA 200510-14