Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 562044 - media-libs/jasper-1.900.1-r9 has world writable folder /var/tmp/portage/media-libs/jasper-1.900.1-r9/work/jasper-1.900.1 before running ./configure
Summary: media-libs/jasper-1.900.1-r9 has world writable folder /var/tmp/portage/media...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-02 12:32 UTC by abandoned account disabled email
Modified: 2015-10-10 11:19 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description abandoned account disabled email 2015-10-02 12:32:29 UTC 
During emerge, will fail with: 
/var/tmp/portage/media-libs/jasper-1.900.1-r9/work/jasper-1.900.1/configure --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --libdir=/usr/lib64 --enable-shared --disable-static --enable-libjpeg --disable-opengl
/usr/lib/portage/python3.4/phase-helpers.sh: /var/tmp/portage/media-libs/jasper-1.900.1-r9/work/jasper-1.900.1/configure: /bin/sh: bad interpreter: Permission denied

because jasper-1.900.1/ folder is writable by others (aka world writable) and grsec doesn't allow that unless it has the same perms like the other folder: jasper-1.900.1-abi_x86_64.amd64/ (so writeable only by portage)

# ls -la /var/tmp/portage/media-libs/jasper-1.900.1-r9/work/
total 112
drwx------ 4 portage portage    100 02.10.2015 14:07 ./
drwxr-xr-x 7 portage portage    280 02.10.2015 14:07 ../
drwxrwxrwx 8 portage portage    460 02.10.2015 14:13 jasper-1.900.1/
drwxr-xr-x 2 portage portage     40 02.10.2015 14:07 jasper-1.900.1-abi_x86_64.amd64/
-rw-r--r-- 1 portage portage 110971 02.10.2015 14:07 jasper-1.900.1-fixes-20120611.patch



Reproducible: Always

Steps to Reproduce:
1. emerge -av media-libs/jasper
2.
3.
Actual Results:  
directory /var/tmp/portage/media-libs/jasper-1.900.1-r9/work/jasper-1.900.1/
has drwxrwxrwx  permissions 
during ./configure

Expected Results:  
directory /var/tmp/portage/media-libs/jasper-1.900.1-r9/work/jasper-1.900.1/
to have drwxr-xr-x  permissions
during ./configure

# emerge --info
Portage 2.2.22 (python 3.4.3-final-0, hardened/linux/amd64/no-multilib, gcc-5.2.0, glibc-2.21-r1, 4.1.7-hardened-r1-g45b4b78 x86_64)
=================================================================
System uname: Linux-4.1.7-hardened-r1-g45b4b78-x86_64-AMD_A6-3400M_APU_with_Radeon-tm-_HD_Graphics-with-gentoo-2.2
KiB Mem:    15870032 total,  12811764 free
KiB Swap:   33554428 total,  33554428 free
Timestamp of repository gentoo: Fri, 02 Oct 2015 00:45:01 +0000
sh bash 4.4_alpha-r1
ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1
ccache version 3.2.3 [enabled]
app-shells/bash:          4.4_alpha-r1::gentoo
dev-lang/perl:            5.22.0::gentoo
dev-lang/python:          2.7.10::gentoo, 3.4.3::gentoo
dev-util/ccache:          3.2.3::gentoo
dev-util/cmake:           3.3.2::gentoo
dev-util/pkgconfig:       0.29::gentoo
sys-apps/baselayout:      2.2::gentoo
sys-apps/openrc:          0.17::gentoo
sys-apps/sandbox:         2.9::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r1::gentoo
sys-devel/automake:       1.11.6-r1::gentoo, 1.13.4::gentoo, 1.14.1::gentoo, 1.15::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo
sys-devel/gcc:            5.2.0::gentoo
sys-devel/gcc-config:     1.8::gentoo
sys-devel/libtool:        2.4.6-r1::gentoo
sys-devel/make:           4.1-r1::gentoo
sys-kernel/linux-headers: 4.2::gentoo (virtual/os-headers)
sys-libs/glibc:           2.21-r1::gentoo
Repositories:

gentoo
    location: /usr/portage
    priority: -1000

tox-overlay
    location: /var/lib/layman/tox-overlay
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="@FREE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native -ggdb -fvar-tracking-assignments -fno-omit-frame-pointer -ftrack-macro-expansion=2 -fstack-protector-all -fPIC"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=native -ggdb -fvar-tracking-assignments -fno-omit-frame-pointer -ftrack-macro-expansion=2 -fstack-protector-all -fPIC"
DISTDIR="/usr/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs binpkg-multi-instance ccache cgroup collision-protect config-protect-if-modified distlocks downgrade-backup ebuild-locks fakeroot fixlafiles force-mirror installsources ipc-sandbox merge-sync multilib-strict network-sandbox news nostrip parallel-fetch parallel-install prelink-checksums preserve-libs sandbox sfperms split-elog split-log strict unknown-features-warn unmerge-backup unmerge-logs userfetch userpriv usersandbox webrsync-gpg"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://gd.tuwien.ac.at/opsys/linux/gentoo/ http://ftp.romnet.org/gentoo/ http://tux.rainside.sk/gentoo/ http://de-mirror.org/gentoo/  http://www.las.ic.unicamp.br/pub/gentoo/"
INSTALL_MASK="/lib/systemd /lib32/systemd /lib64/systemd /usr/lib/systemd /usr/lib32/systemd /usr/lib64/systemd /etc/systemd"
LANG="C"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
USE="3dnow 3dnowext X acl amd64 berkdb bindist btrfs bzip2 cli consolekit cracklib crypt cryptsetup cscope cxx dbus device-mapper dri egl extensions gdbm git gpg gpm gtk3 hardened iconv jpeg justify lm_sensors lock mmx mmxext modules mosh-hardening ncurses nptl ogg openmp opus pam pax_kernel pcre pie png policykit popcnt pulseaudio qt4 readline seccomp session smp sse sse2 sse3 sse4a ssl ssp startup-notification strong-security system-icu system-jpeg system-libvpx system-sqlite urandom xattr xcomposite xtpax zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="3dnow 3dnowext mmx mmxext popcnt sse sse2 sse3 sse4a" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="keyboard synaptics evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" RUBY_TARGETS="ruby20 ruby21" USERLAND="GNU" VIDEO_CARDS="radeon" XFCE_PLUGINS="brightness clock trash battery power" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7"
Unset:  CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS



# equery m jasper
 * media-libs/jasper [gentoo]
Herd:        sci (sci@gentoo.org)
Maintainer:  None specified
Upstream:    None specified
Homepage:    http://www.ece.uvic.ca/~mdadams/jasper/
Location:    /usr/portage/media-libs/jasper
Keywords:    1.900.1-r9:0: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 ~amd64-fbsd ~amd64-linux ~arm-linux ~arm64 ~mips ~ppc-macos
                           ~s390 ~sh ~sparc-fbsd ~x64-macos ~x64-solaris ~x86-fbsd ~x86-linux ~x86-macos ~x86-solaris
License:     JasPer2.0
Comment 1 abandoned account disabled email 2015-10-02 12:37:40 UTC 
jasper is pulled by gimp when jpeg2k USE flag is enabled
Comment 2 Justin Lecher (RETIRED) gentoo-dev 2015-10-10 11:19:51 UTC 
commit 40a2e880a960dfacc4df91eecdd20f6d9e5ae4e4
Author: Justin Lecher <jlec@gentoo.org>
Date:   Sat Oct 10 09:56:47 2015 +0200

    media-libs/jasper: Drop world writable permission to work on hardened

    Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=562044

    Package-Manager: portage-2.2.22
    Signed-off-by: Justin Lecher <jlec@gentoo.org>

    https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=40a2e880a960dfacc4df91eecdd20f6d9e5ae4e4