Currently, FEATURES=sfperms (seeming to be enabled by default) causes Portage to drop the 'readable by others' bit from files installed setuid&setgid. This is fine with plain setuid/setgid executables but not with LD_PRELOAD-ed libraries. The point is that ld.so requires the library to be marked setuid (and/or setgid) to be used with setuid (and/or setgid) executables, while still requiring it to be readable to the calling user. Thus, FEATURES=sfperms causes LD_PRELOAD libraries to be installed in a way that makes it impossible to use them not only with setuid/setgid executables but also with normal ones. Currently, I use a simple workaround: calling 'chmod o+r' in pkg_postinst(). But Portage should either allow ebuilds to disable sfperms for particular files -or- make it even smarter, ignoring libraries. That would probably cause problems with files being both a library and a executable at the same time but I don't think we really install anything like that setuid right now.
Portage 2.2_rc69 (default/linux/amd64/10.0/desktop, gcc-4.4.4, glibc-2.12.1-r0, 2.6.35-pomiocik+ x86_64) ================================================================= System uname: Linux-2.6.35-pomiocik+-x86_64-Intel-R-_Pentium-R-_Dual_CPU_T2330_@_1.60GHz-with-gentoo-2.0.1 Timestamp of tree: Wed, 25 Aug 2010 15:00:21 +0000 ccache version 2.4 [disabled] app-shells/bash: 4.1_p7 dev-java/java-config: 2.1.11 dev-lang/python: 2.4.6, 2.5.4-r4, 2.6.5-r3, 2.7, 3.0.1::python, 3.1.2-r4, 3.2_pre20100815::python dev-util/ccache: 2.4-r8 dev-util/cmake: 2.8.1-r2 sys-apps/baselayout: 2.0.1 sys-apps/openrc: 9999 sys-apps/sandbox: 2.3-r1 sys-devel/autoconf: 2.13, 2.65-r1 sys-devel/automake: 1.9.6-r3, 1.10.3, 1.11.1 sys-devel/binutils: 2.20.1-r1 sys-devel/gcc: 4.4.4-r1 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.10 sys-devel/make: 3.81-r2 virtual/os-headers: 2.6.35 (sys-kernel/linux-headers) ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=core2 -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=core2 -O2 -pipe" DISTDIR="/usr/local/portage/distfiles" EMERGE_DEFAULT_OPTS="--ask --keep-going" FEATURES="assume-digests collision-protect distlocks fixlafiles fixpackages news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="pl_PL.UTF-8" LC_ALL="pl_PL.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu" LINGUAS="" MAKEOPTS="-j3" PKGDIR="/usr/local/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --times --compress --force --whole-file --delete --stats --timeout=45 --exclude=/distfiles --exclude=/packages --exclude=/local" PORTAGE_TMPDIR="/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/portage/local/gamerlay /usr/portage/local/games /usr/portage/local/java-overlay /usr/portage/local/kde-sunset /usr/portage/local/qting-edge /usr/portage/local/x11 /usr/portage/local/perl-experimental /usr/portage/local/python /usr/portage/local/sunrise /usr/portage/local/science /usr/portage/local/gnome /home/mgorny/git/emdzientoo" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="X a52 aac acl acpi alsa amd64 avahi bash-completion bluetooth branding bzip2 cairo caps cdr cli consolekit cracklib crypt cups curl cxx dbus dirac directfb djvu dri dts dvd dvdr emboss encode exif expat fam fbcon fftw filecaps firefox flac fontconfig fortran gd gdbm gif gmp gnome-keyring gnutls gpm graphviz gtk iconv icu idn imagemagick ipv6 java6 jbig jpeg jpeg2k kate lapack lcms libedit libnotify libproxy mad matroska mikmod mmap mmx mmxext mng modules mp3 mp4 mpeg mtp mudflap multilib ncurses nptl nptlonly ogg opencore-amr openexr opengl openmp pam pango pch pcre pdf perl png ppds pppd python qt3support qt4 raw readline reflection schroedinger sdl session slang smp sndfile speex spell spl sse sse2 ssl ssse3 startup-notification svg sysfs tcpd theora threads tiff timidity truetype unicode usb v4l2 vcd vim-syntax vorbis wavpack wifi wmf x264 xcb xcomposite xml xorg xpm xulrunner xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" RUBY_TARGETS="ruby18 ruby19" SANE_BACKENDS="artec_eplus48u" USERLAND="GNU" VIDEO_CARDS="fbdev r300 r600 radeon vesa" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, FFLAGS, INSTALL_MASK, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
do you have an example of an actual package broken by this ?
(In reply to comment #2) > do you have an example of an actual package broken by this ? net-misc/autoupnp in Sunrise [1]. But that can be any LD_PRELOAD-based package allowing user to install itself with setuid/setgid. [1] http://overlays.gentoo.org/proj/sunrise/browser/sunrise/net-misc/autoupnp
