Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 671344 - app-emulation/virtualbox-6.0.0_beta2: The application binary appears to be running setuid, this is a security hole.
Summary: app-emulation/virtualbox-6.0.0_beta2: The application binary appears to be ru...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Lars Wendler (Polynomial-C) (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-17 13:39 UTC by Perfect Gentleman
Modified: 2018-11-17 15:29 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Perfect Gentleman 2018-11-17 13:39:32 UTC
Qt FATAL: FATAL: The application binary appears to be running setuid, this is a security hole. 
-------------
emerge --info
Portage 2.3.51 (python 3.7.1-final-0, default/linux/amd64/17.1/no-multilib, gcc-8.2.0, glibc-2.28-r2, 4.19.2-gentoo x86_64)
=================================================================
System uname: Linux-4.19.2-gentoo-x86_64-Intel-R-_Core-TM-_i7-4770K_CPU_@_3.50GHz-with-gentoo-2.6
KiB Mem:    15822524 total,    866876 free
KiB Swap:   13904892 total,  13904892 free
Head commit of repository gentoo: 272a2ed2ca91c94420669d0318566aacaefb2ddd

Head commit of repository gnome: 8b53f1d94092e8fa279539f49222ea3ddd001177

Head commit of repository mozilla: 024d909331852111122e78c935882ef5c579465a

Head commit of repository qt: fb4ee29e3ed5d9eb62f7613e897ff277b320a10f

Head commit of repository kde: d4c24ad577554f7ce49276ce4ae5c03a4a122991

Head commit of repository pg_overlay: 6dd3bcd7bc7a5477a60bfd7cebfbb88c75d8d7c6

sh bash 4.4_p23
ld GNU gold (Gentoo 2.31.1 p3 2.31.1) 1.16
ccache version 3.5 [disabled]
app-shells/bash:          4.4_p23::gentoo
dev-lang/perl:            5.28.0::gentoo
dev-lang/python:          2.7.15::gentoo, 3.7.1_pre::pg_overlay
dev-util/ccache:          3.5-r1::gentoo
dev-util/cmake:           3.12.3::gentoo
dev-util/pkgconfig:       0.29.2::gentoo
sys-apps/baselayout:      2.6-r1::gentoo
sys-apps/openrc:          0.39.2::gentoo
sys-apps/sandbox:         2.13::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r4::gentoo
sys-devel/automake:       1.16.1-r1::gentoo
sys-devel/binutils:       2.31.1-r1::gentoo
sys-devel/gcc:            8.2.0-r4::gentoo
sys-devel/gcc-config:     2.0::gentoo
sys-devel/libtool:        2.4.6-r5::gentoo
sys-devel/make:           4.2.1-r4::gentoo
sys-kernel/linux-headers: 4.19::gentoo (virtual/os-headers)
sys-libs/glibc:           2.28-r2::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: git
    sync-uri: https://anongit.gentoo.org/git/repo/gentoo.git
    priority: 1
    eclass-overrides: gnome mozilla gentoo qt kde pg_overlay
    sync-git-clone-extra-opts: --single-branch --branch master

gnome
    location: /usr/portage/proj/gnome
    sync-type: git
    sync-uri: https://anongit.gentoo.org/git/proj/gnome.git
    masters: gentoo
    priority: 3
    eclass-overrides: gnome mozilla gentoo qt kde pg_overlay

mozilla
    location: /usr/portage/proj/mozilla
    sync-type: git
    sync-uri: https://anongit.gentoo.org/git/proj/mozilla.git
    masters: gentoo
    priority: 5
    eclass-overrides: gnome mozilla gentoo qt kde pg_overlay

qt
    location: /usr/portage/proj/qt
    sync-type: git
    sync-uri: https://anongit.gentoo.org/git/proj/qt.git
    masters: gentoo
    priority: 7
    eclass-overrides: gnome mozilla gentoo qt kde pg_overlay

kde
    location: /usr/portage/proj/kde
    sync-type: git
    sync-uri: https://anongit.gentoo.org/git/proj/kde.git
    masters: gentoo
    priority: 9
    eclass-overrides: gnome mozilla gentoo qt kde pg_overlay

pg_overlay
    location: /usr/portage/overlay/pg_overlay
    sync-type: git
    sync-uri: https://github.com/perfect7gentleman/pg_overlay.git
    masters: gentoo
    priority: 11
    eclass-overrides: gnome mozilla gentoo qt kde pg_overlay

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=native -mtune=native -O2 -pipe -fomit-frame-pointer -fno-stack-protector -ftree-vectorize -finline-functions -funswitch-loops -s"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-march=native -mtune=native -O2 -pipe -fomit-frame-pointer -fno-stack-protector -ftree-vectorize -finline-functions -funswitch-loops -s"
DISTDIR="/usr/portage/distfiles"
ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch parallel-install preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LANG="en_US.utf8"
LDFLAGS="-Wl,-O2 -Wl,--as-needed -Wl,--sort-common -Wl,--strip-debug"
LINGUAS="en en_US ru ru_RU"
MAKEOPTS="-j9"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/tmp"
USE="X acl alsa amd64 bash-completion bzip2 cairo cli cups custom-cflags cxx dbus dri elogind encode ffmpeg flac fontconfig gmp gzip iconv icu idn inotify introspection jabber jit jpeg libass libffi libnotify libtirpc lm_sensors lzma lzo matroska mmap mtp ncurses nls nptl ntpl ogg opengl openmp orc pam pch pcre pulseaudio readline seccomp smp ssl symlink szip taglib tcmalloc threads tiff truetype udev udisks unicode usb v4l vaapi vorbis wavpack webp x264 xattr xcb xmpp zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon plan sheets stage words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput" KERNEL="linux" L10N="en en-US ru" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6 php7-1" POSTGRES_TARGETS="postgres9_5 postgres10" PYTHON_SINGLE_TARGET="python3_7" PYTHON_TARGETS="python3_7" RUBY_TARGETS="ruby25" USERLAND="GNU" VIDEO_CARDS="intel i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Perfect Gentleman 2018-11-17 13:40:08 UTC
the same bug with app-emulation/virtualbox-bin-6.0.0_beta2
Comment 2 Larry the Git Cow gentoo-dev 2018-11-17 15:29:01 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=72eece56e1391a5f92572998d33ccf846d6f4059

commit 72eece56e1391a5f92572998d33ccf846d6f4059
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2018-11-17 15:20:39 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2018-11-17 15:28:52 +0000

    app-emulation/virtualbox: Don't install VirtualBox binary SUID.
    
    Closes: https://bugs.gentoo.org/671344
    Package-Manager: Portage-2.3.51, Repoman-2.3.12
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 app-emulation/virtualbox/virtualbox-6.0.0_beta2.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)