Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 58486 - env-update should filter harmful environment variables
Summary: env-update should filter harmful environment variables
Status: RESOLVED WONTFIX
Alias: None
Product: Portage Development
Classification: Unclassified
Component: Core (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Portage team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-07-26 19:29 UTC by Jason A. Mobarak (RETIRED)
Modified: 2004-08-02 20:45 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jason A. Mobarak (RETIRED) gentoo-dev 2004-07-26 19:29:49 UTC
Several users have had trouble with the environment file for Sun JDK version 1.3.1.04 [1].

Two forum threads describe users encountering this problem, [2], and [3]. There
was also a bug report filed [4], but it has since been resolved as invalid, as the
ebuild in question was removed from portage long ago.

Basic break down is: if LD_ASSUME_KERNEL is set in
/etc/env.d/java/20SomeJVM-0.0.0 it has the potential to render a system
unusable. I don't know how this happens specifically since I'm not aware of how
the different files for dynamic libs are generated, but the end result was the
user's dynamic libs were broken.

Point is: be careful what you put in a JVM's environment file.

I think a bug should be filed against env-update to filter out or somehow
decide whether something in the environment is going to destroy a users dynamic
libraries.

References:
[1]
http://www.gentoo.org/cgi-bin/viewcvs.cgi/*checkout*/dev-java/sun-jdk/files/Attic/sun-jdk-1.3.1.04?r
ev=HEAD&root=gentoo-x86&content-type=text/plain
[2] http://forums.gentoo.org/viewtopic.php?t=198170
[3] http://forums.gentoo.org/viewtopic.php?t=119706
[4] http://bugs.gentoo.org/show_bug.cgi?id=58088



Reproducible: Always
Steps to Reproduce:
1. Have a java developer accidentally set LD_ASSUME_KERNEL for some reason
2. java-config doesn't recognize the variable as anything special so it throws it into the generated /etc/env.d/20java
3. user runs "env-update && source /etc/profile"

Actual Results:  
User's system is broken.

Expected Results:  
env-update should exit and complain that /etc/env.d/20java is setting a
potentially harmful environment variable and a -f flag should be used to force
env-update to run
Comment 1 Jason A. Mobarak (RETIRED) gentoo-dev 2004-07-26 19:31:53 UTC
The above is my email to gentoo-java regarding LD_ASSUME_KERNEL blowing up users system -- my ideas regarding env-update my not be correct but the point of this bug it to bring up the possibility of env-update recognizing potentionally harmful situations.
Comment 2 SpanKY gentoo-dev 2004-08-02 20:45:06 UTC
unless the portage peeps disagree i say this is a java bug