Bug 131324 – insecure RPATHs in perl ebuilds

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Arthur Spitzer 2006-04-26 05:16:03 UTC]

I get the following emerging dev-perl/Digest-SHA1-2.11
-----
>>> emerge (1 of 1) dev-perl/Digest-SHA1-2.11 to /
>>> md5 files   ;-) Digest-SHA1-2.11.ebuild
>>> md5 files   ;-) Digest-SHA1-2.07.ebuild
>>> md5 files   ;-) Digest-SHA1-2.10.ebuild
>>> md5 files   ;-) files/digest-Digest-SHA1-2.07
>>> md5 files   ;-) files/digest-Digest-SHA1-2.10
>>> md5 files   ;-) files/digest-Digest-SHA1-2.11
>>> md5 src_uri ;-) Digest-SHA1-2.11.tar.gz
>>> Unpacking source...
>>> Unpacking Digest-SHA1-2.11.tar.gz to /var/tmp/portage/Digest-SHA1-2.11/work
>>> Source unpacked.
 * Using ExtUtils::MakeMaker
Checking if your kit is complete...
Looks good
Writing Makefile for Digest::SHA1
cp SHA1.pm blib/lib/Digest/SHA1.pm
/usr/bin/perl5.8.7 /usr/lib/perl5/5.8.7/ExtUtils/xsubpp  -typemap /usr/lib/perl5/5.8.7/ExtUtils/typemap -typemap typemap  SHA1.xs > SHA1.xsc && mv SHA1.xsc SHA1.c
i686-pc-linux-gnu-gcc -c   -fno-strict-aliasing -pipe -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -march=pentium-m -pipe -fomit-frame-pointer -fno-delayed-branch -fcaller-saves -freorder-blocks -freorder-functions -falign-jumps -finline-functions -frename-registers -fweb -falign-functions=64   -DVERSION=\"2.11\" -DXS_VERSION=\"2.11\" -fPIC "-I/usr/lib/perl5/5.8.7/i686-linux/CORE"   SHA1.c
Running Mkbootstrap for Digest::SHA1 ()
chmod 644 SHA1.bs
rm -f blib/arch/auto/Digest/SHA1/SHA1.so
LD_RUN_PATH="" i686-pc-linux-gnu-gcc  -shared -L/usr/local/lib SHA1.o  -o blib/arch/auto/Digest/SHA1/SHA1.so
chmod 755 blib/arch/auto/Digest/SHA1/SHA1.so
cp SHA1.bs blib/arch/auto/Digest/SHA1/SHA1.bs
chmod 644 blib/arch/auto/Digest/SHA1/SHA1.bs
>>> Test phase [not enabled]: dev-perl/Digest-SHA1-2.11

>>> Install Digest-SHA1-2.11 into /var/tmp/portage/Digest-SHA1-2.11/image/ category dev-perl
Installing /var/tmp/portage/Digest-SHA1-2.11/image/usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/SHA1.bs
Installing /var/tmp/portage/Digest-SHA1-2.11/image/usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/SHA1.so
Files found in blib/arch: installing files in blib/lib into architecture dependent library tree
Installing /var/tmp/portage/Digest-SHA1-2.11/image/usr/lib/perl5/vendor_perl/5.8.7/i686-linux/Digest/SHA1.pm
Writing /var/tmp/portage/Digest-SHA1-2.11/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/.packlist
Appending installation info to /var/tmp/portage/Digest-SHA1-2.11/image//usr/lib/perl5/5.8.7/i686-linux/perllocal.pod
man:
prepallstrip:
strip: i686-pc-linux-gnu-strip --strip-unneeded
   usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/SHA1.so
scanelf: rpath_security_checks(): Security problem NULL DT_RPATH in /var/tmp/portage/Digest-SHA1-2.11/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/SHA1.so
scanelf: rpath_security_checks(): Security problem NULL DT_RUNPATH in /var/tmp/portage/Digest-SHA1-2.11/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/SHA1.so

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
 usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/Digest/SHA1/SHA1.so


!!! ERROR: dev-perl/Digest-SHA1-2.11 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
!!! Insecure binaries detected
-----
I get Similar Errors for 
dev-perl/DBI-1.50:
-----
scanelf: rpath_security_checks(): Security problem NULL DT_RPATH in /var/tmp/portage/DBI-1.50/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/DBI/DBI.so
scanelf: rpath_security_checks(): Security problem NULL DT_RUNPATH in /var/tmp/portage/DBI-1.50/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/DBI/DBI.so

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
 usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/DBI/DBI.so


!!! ERROR: dev-perl/DBI-1.50 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
-----

dev-perl/HTML-Parser3.48
-----
scanelf: rpath_security_checks(): Security problem NULL DT_RPATH in /var/tmp/portage/HTML-Parser-3.48/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/HTML/Parser/Parser.so
scanelf: rpath_security_checks(): Security problem NULL DT_RUNPATH in /var/tmp/portage/HTML-Parser-3.48/image//usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/HTML/Parser/Parser.so

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
 usr/lib/perl5/vendor_perl/5.8.7/i686-linux/auto/HTML/Parser/Parser.so


!!! ERROR: dev-perl/HTML-Parser-3.48 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
-----

[Comment 1 Jakub Moc (RETIRED) 2006-04-26 05:20:16 UTC]

Reopen with emerge --info and emerge -pv perl output.

[Comment 2 Arthur Spitzer 2006-04-27 08:21:40 UTC]

Sorry. Was my first Report. emerge --info says:
Portage 2.0.54 (default-linux/x86/2006.0, gcc-3.4.5, glibc-2.3.6-r3, 2.6.15-suspend2-r8 i686)
=================================================================
System uname: 2.6.15-suspend2-r8 i686 Intel(R) Pentium(R) M processor 1600MHz
Gentoo Base System version 1.6.14
dev-lang/python:     2.3.5, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=pentium-m -pipe -fomit-frame-pointer -fno-delayed-branch -fcaller-saves -freorder-blocks -freorder-functions -falign-jumps -finline-functions -frename-registers -fweb -falign-functions=64"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/eselect/compiler /etc/gconf /etc/splash /etc/terminfo /etc/env.d"
CXXFLAGS="-march=pentium-m -pipe -fomit-frame-pointer -fno-delayed-branch -fcaller-saves -freorder-blocks -freorder-functions -falign-jumps -finline-functions -frename-registers -fweb -falign-functions=64"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="de_DE.utf8"
LC_ALL="de_DE.utf8"
LINGUAS="de.utf8"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dfx X acpi alsa apache2 audiofile automount avi berkdb bitmap-fonts bluetooth bzip2 cairo cdr cli crypt cups curl dbus directfb dri dvd dvdr dvdread dvi eds emboss encode esd exif expat fam fbcon fbsplash firefox flac foomaticdb fortran gd gdbm gif glut gnome gpm gstreamer gtk gtk2 gtkhtml hal howl i8x0 idn imagemagick imlib ipv6 isdnlog jack java jpeg junit kde lcms ldap libg++ libwww lirc mad mikmod mmx mng motif mp3 mpeg mysql ncurses ncusers nls nptl nsplugin ogg opengl pam pcmcia pcre pdflib perl php png pppd python qt quicktime readline reflection ruby samba sdl session spell spl ssl svg svga tcltk tcpd tetex tidy tiff truetype truetype-fonts type1-fonts udev unicode usb userlocales vcd vorbis win32codecs x86 xine xml xml2 xmms xorg xv xvid zlib video_cards_i810 linguas_de.utf8 userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, INSTALL_MASK, LDFLAGS, MAKEOPTS


emerge -pv perl says:

[ebuild   R   ] dev-lang/perl-5.8.7-r3  +berkdb -build -debug -doc +gdbm -ithreads -minimal -perlsuid 0 kB

[Comment 3 Arthur Spitzer 2006-04-27 08:23:32 UTC]

forgot to Reopen bug

[Comment 4 Arthur Spitzer 2006-04-30 02:39:49 UTC]

It's all fixed after an update to portage-2.0.54-r1.
Thanks.