I have compiled my standard system utilities (much of /bin) with the "static" option to avoid potential problems with the configuration of shared libraries making programs unusable. (Running ldconfig with a somewhat outdated /usr/local/bin library mounted can break most utilities, including python, due to SEGVs when loading shared libraries from /usr/local/bin). Recently running emerge (ebuild?) has started putting out large number of messages of the form "QA: Static ELF: ..." apparently commenting on the static binaries being run (/bin/tr, /bin/find, /bin/rm, etc.) This is something which seems to have cropped up within the last month (Feb-Mar 2009). What program(s) need to be downgraded or compiled to fix this problem? (Or can it be fixed by upgrading the package causing this problem?) Reproducible: Always Steps to Reproduce: 1. emerge any package with largely static binaries in /bin. (Static binaries are a legitimate build option -- they should not be generating error messages unless requested.) Actual Results: Packages should emerge without spewing tons of messages.
It seems to come from recent versions of sandbox, originating in libsandbox/wrapper-funcs/execve.c: SB_EWARN("QA: Static ELF", " %s\n", filename);
sandbox is operating as expected. if you build things statically, sandbox cannot protect you and you might as well disable sandbox support. also, libraries dont belong in /usr/local/bin ... either you've made a typo, or you're doing it wrong
also, i dont really buy the "i need to build /bin statically to keep things recoverable". every Gentoo system has a static busybox recovery shell on it that should be more than sufficient to recover a completely trashed filesystem (well, not filesystem corruption it self, but a `rm -rf /lib` kind of thing). i know because ive trashed my glibc installs a few times by accident (as in every dynamic binary crashed because it needed glibc), and running `bb` to launch the busybox static shell and recover things manually worked perfectly.
you can try sandbox-1.7 and see if it gives you any hassles ... it has initial support for tracing of static binaries which means you shouldnt see the QA notice anymore ...
