Bug 217036

Summary:	games-arcade/thinktanks-demo dangerous permissions on internal copy of openal library
Product:	Gentoo Linux	Reporter:	Gordon Malm (RETIRED) <gengor>
Component:	[OLD] Games	Assignee:	Gentoo Games <games>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Gordon Malm (RETIRED) gentoo-dev

2008-04-09 16:51:28 UTC

games-arcade/thinktanks-demo bundles its own internal copy of libopenal.so that is installed writeable by anyone in the games group:

-rwxrwx--- 1 root games 281812 Jul 31  2003 /opt/thinktanks-demo/lib/libopenal.so

Also, looks old and should probably be checked for CVE.

Reproducible: Always

Comment 1 Tupone Alfredo gentoo-dev

2008-04-17 05:43:32 UTC

game work enough well removing the directory /opt/thinktanks-demo/lib that contains the libraries.

Me wonders if doing a remove and adding some RDEPEND inside the ebuild is the good things to do.

Comment 2 Chris Gianelloni (RETIRED) gentoo-dev

2008-04-25 15:02:15 UTC

That was actually my intention, to see if we could use the system libraries, instead.  I just haven't had much time.  If it is working for you, I say go for it.

Comment 3 Tupone Alfredo gentoo-dev

2008-04-25 21:55:28 UTC

copies of system libraries removed in the 1.1-r1 ebuild.
I'm postponing test on correct building of depending packages, waiting for a better portage support on that.