Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 349034

Summary: dev-lang/ruby: remove RPATHFLAG from rbconfig.rb
Product: Gentoo Linux Reporter: W. Trevor King <wking>
Component: Current packagesAssignee: Gentoo Ruby Team <ruby>
Status: RESOLVED FIXED    
Severity: normal    
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard:
Package list:
Runtime testing required: ---

Description W. Trevor King 2010-12-18 20:14:59 UTC
I've been working the kinks out of the comedilib package [1], which
installs ruby bindings (effectively a C extension to Ruby).  The
SWIG-generated extension source is compiled using a Makefile
genenerated by a simple extconf.rb:

  require 'mkmf'
  dir_config('comedilib')
  have_library('comedi')
  create_makefile("comedi")

The resulting Makefile sets the RUNPATH:

  ...
  LIBPATH =  -L. -L$(libdir) -Wl,-R$(libdir) ...
  ...
  $(DLLIB): $(OBJS) Makefile
    @-$(RM) $@
    $(LDSHARED) -o $@ $(OBJS) $(LIBPATH) $(DLDFLAGS) $(LOCAL_LIBS) $(LIBS)

Because I compile against the version of libcomedi in the source tree,
installation gives me this error:

 * QA Notice: The following files contain insecure RUNPATHs
 *  Please file a bug about this at http://bugs.gentoo.org/
 *  with the maintaining herd of the package.
 * /usr/lib:/var/tmp/portage/sci-libs/comedilib-9999/work/comedilib-9999/lib/.libs
+usr/lib/ruby/site_ruby/1.8/i686-linux/comedi.so

There are a number of ways I could deal with this, ranging from the
current hackish [2]

  chrpath -d "{$S}/swig/ext/comedi.so"

to the more general solution I'm proposing here: remove (optionally?)
the RUNPATH settings from

  /usr/lib/ruby/1.8/i686-linux/rbconfig.rb

by patching it before installing.  I've compared my Gentoo version
with one from an Ubuntu system, and relevant excerpts from the diff
are

  --- GENTOO/usr/lib/ruby/1.8/i686-linux/rbconfig.rb    2010-10-28 21:40:24.000000000 -0400
  +++ UBUNTU/usr/lib/ruby/1.8/i486-linux/rbconfig.rb    2010-03-19 13:44:11.000000000 -0400
  ...
  @@ -32,7 +32,7 @@
     CONFIG["ENABLE_SHARED"] = "yes"
     CONFIG["DLDLIBS"] = " -lc"
     CONFIG["SOLIBS"] = "$(LIBS)"
  -  CONFIG["LIBRUBYARG_SHARED"] = "-Wl,-R -Wl,$(libdir) -L$(libdir) -l$(RUBY_SO_NAME)"
  +  CONFIG["LIBRUBYARG_SHARED"] = "-l$(RUBY_SO_NAME)"
     CONFIG["LIBRUBYARG_STATIC"] = "-l$(RUBY_SO_NAME)-static"
     CONFIG["LIBRUBYARG"] = "$(LIBRUBYARG_SHARED)"
     CONFIG["LIBRUBY"] = "$(LIBRUBY_SO)"
  ...
  @@ -56,8 +56,8 @@
     CONFIG["STRIP"] = "strip -S -x"
     CONFIG["TRY_LINK"] = ""
     CONFIG["LIBPATHENV"] = "LD_LIBRARY_PATH"
  -  CONFIG["RPATHFLAG"] = " -Wl,-R%1$-s"
  -  CONFIG["LIBPATHFLAG"] = " -L%1$-s"
  +  CONFIG["RPATHFLAG"] = ""
  +  CONFIG["LIBPATHFLAG"] = " -L%s"
     CONFIG["LINK_SO"] = ""
     CONFIG["LIBEXT"] = "a"
     CONFIG["DLEXT2"] = ""
 ...

It seems like fixing this at the system level would reduce the risk of
similar QA issues in other packages.  However if people are linking
against libraries outside the standard search path, it might just end
up breaking lots of packages.  I don't have enough experience to know
which of these should qualify as the default.

[1]: http://bugs.gentoo.org/348206
[2]: http://www.physics.drexel.edu/~wking/code/git/gitweb.cgi?p=wtk-overlay.git;a=tree;f=sci-libs/comedilib;hb=HEAD
Comment 1 Hans de Graaff gentoo-dev Security 2017-07-23 07:07:54 UTC
It looks like this has been fixed quite some time ago by using the --disable-rpath configuration option for dev-lang/ruby.

All current ruby versions have settings similar to Ubuntu.