Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 121162

Summary: gnome-extra/libgsf-1.12.1: insecure RUNPATH
Product: Gentoo Security Reporter: Abraham Marin Perez <abraham>
Component: Runpath IssuesAssignee: Gentoo Linux Gnome Desktop Team <gnome>
Severity: normal    
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: ? [ebuild?] DerCorny
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 81745    

Description Abraham Marin Perez 2006-02-01 04:43:00 UTC
Error message: 

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at
 For more information on this issue, kindly review:
/var/tmp/portage/libgsf-1.12.1/image//usr/lib usr/lib/
Comment 1 Abraham Marin Perez 2006-02-01 04:43:44 UTC
emerge --info:

Portage 2.0.54 (default-linux/x86/2005.0, gcc-3.3.6, glibc-2.3.5-r2, 2.6.14-gentoo-r5 i686)
System uname: 2.6.14-gentoo-r5 i686 AMD Athlon(tm) XP 1700+
Gentoo Base System version 1.6.14
distcc 2.16 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled]
ccache version 2.3 [enabled]
dev-lang/python:     2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:, 2.6.11-r2
CFLAGS="-O2 -pipe -march=athlon-xp -fomit-frame-pointer -fforce-addr -frerun-loop-opt -floop-optimize -frerun-cse-after-loop -falign-functions=4"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -pipe -march=athlon-xp -fomit-frame-pointer -fforce-addr -frerun-loop-opt -floop-optimize -frerun-cse-after-loop -falign-functions=4"
FEATURES="autoconfig ccache distlocks sandbox sfperms strict"
LINGUAS="es en"
USE="3dnow X acpi alsa apache2 audiofile avi bash-completion bidi bitmap-fonts browserplugin bzip2 bzlib canna cdr cjk crypt cups curl dga directfb divx4linux doc dvb dvd dvdr eds emboss encode esd ethereal evo exif expat fam fbcon ffmpeg fftw flac foomaticdb freewnn ftp gb gcj gd gdbm gif glut gmp gnome gpm gstreamer gtk gtk2 gtkhtml hal iconv idn imagemagick imlib iodbc java jikes jpeg kde lcms libg++ libwww mad memlimit mikmod mime mmx mng motif mozilla mp3 mpeg msn nas nls nptl odbc offensive ogg oggvorbis openal opengl pam pcre pdflib perl png pnp posix ppds quicktime readline samba sdl sharedmem simplexml spell ssl svg svga sysvipc szip tcltk tcpd tetex theora threads tiff truetype truetype-fonts type1-fonts udev unicode usb userlocales videos vorbis wmf x86 xml xmms xv xvid zlib video_cards_nvidia linguas_es linguas_en userland_GNU kernel_linux elibc_glibc"
Comment 2 Abraham Marin Perez 2006-02-01 05:08:43 UTC
There's a workaround for all inscure RUNPATH problems in

shall we include this comment on bug #81745?
Comment 3 Stefan Cornelius (RETIRED) gentoo-dev 2006-02-01 08:37:55 UTC
gnome herd please verify and provide fixed ebuilds, thank you.
Comment 4 solar (RETIRED) gentoo-dev 2006-03-05 08:03:14 UTC
The next ~arch portage revision will auto repair evil rpaths and not bail. 
Maintainers should still fix the packages they maintain as portage will only die
with FEATURES=stricter (but that is a maintainer & QA problem) no longer security@
Comment 5 Jakub Moc (RETIRED) gentoo-dev 2006-09-21 03:47:42 UTC
No longer a security issue with current stable portage, re-assigning to maintainer.
Comment 6 Leonardo Boshell (RETIRED) gentoo-dev 2006-11-09 09:02:26 UTC
No longer reproducible.