Bug 125003 – gnome-base/gnome-libs-1.4.2 insecure RUNPATH's

• Product: Gentoo Security
• Status: RESOLVED WONTFIX

[Description Mikael Leiviskä 2006-03-04 12:10:40 UTC]

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/gnome-libs-1.4.2/image//usr/lib usr/bin/gnome_segv
/var/tmp/portage/gnome-libs-1.4.2/image//usr/lib usr/bin/loadshlib
/var/tmp/portage/gnome-libs-1.4.2/image//usr/lib usr/bin/goad-browser


!!! ERROR: gnome-base/gnome-libs-1.4.2 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
!!! Insecure binaries detected
!!! If you need support, post the topmost build error, NOT this status message.

Portage 2.0.54 (default-linux/x86/2005.1, gcc-3.4.5, glibc-2.3.5-r2, 2.6.15-ck2 i686)
=================================================================
System uname: 2.6.15-ck2 i686 AMD Athlon(tm) XP 2800+
Gentoo Base System version 1.6.14
ccache version 2.3 [enabled]
dev-lang/python:     2.3.5, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=athlon-xp -O2 -pipe -fomit-frame-pointer -msse -mfpmath=sse"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-march=athlon-xp -O2 -pipe -fomit-frame-pointer -msse -mfpmath=sse"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache distlocks parallel-fetch sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://www.ibiblio.org/pub/Linux/distributions/gentoo"
LANG="en_US.utf8"
LC_ALL="en_US.utf8"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage-xgl"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="x86 3dnow 3dnowext X alsa anthy apm audiofile avi berkdb bitmap-fonts bzip2 cdr cjk crypt cups curl dbus eds emacs emboss encode esd exif expat fam ffmpeg flac font-server foomaticdb fortran gdbm gif glibc-omitfp glut gmp gnome gpm gstreamer gtk gtk2 gtkhtml hal idn imagemagick imlib jack java jpeg junit lcms libg++ libwww lua mad mikmod mmx mmxext mng motif mozilla mp3 mpeg ncurses nls nptl ogg oggvorbis opengl pam pdflib perl png python quicktime readline sdl spell sse ssl svg tcpd tiff truetype truetype-fonts type1-fonts ucs2 ucs4 udev unicode usb userlocales utf8 vorbis xine xml2 xprint xv xvid zlib video_cards_nvidia input_devices_mouse input_devices_keyboard userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LDFLAGS, LINGUAS

[Comment 1 solar (RETIRED) 2006-03-05 08:03:20 UTC]

The next ~arch portage revision will auto repair evil rpaths and not bail. 
Maintainers should still fix the packages they maintain as portage will only die
with FEATURES=stricter (but that is a maintainer & QA problem) no longer security@

http://bugs.gentoo.org/show_bug.cgi?id=124962

[Comment 2 Jakub Moc (RETIRED) 2006-09-21 03:50:09 UTC]

No longer a security issue with current stable portage, re-assigning to maintainer.

[Comment 3 Saleem Abdulrasool (RETIRED) 2006-11-27 20:30:08 UTC]

Marked for removal.  Please migrate to gnome-2.x.