Bug 536970

Summary:	dev-python/gmpy-2.0.5 - QA Security Notice: world writable file(s): /usr/lib/python2.7/site-packages/gmpy2.so (and others)
Product:	Gentoo Linux	Reporter:	Marc Burkhardt <marc>
Component:	[OLD] Development	Assignee:	Python Gentoo Team <python>
Status:	RESOLVED DUPLICATE
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=537374
Whiteboard:
Package list:		Runtime testing required:	---

Description Marc Burkhardt 2015-01-18 13:16:23 UTC

Yet another package that leaves world-writable files on the system:

 * Messages for package dev-python/gmpy-2.0.5:

 * QA Security Notice: world writable file(s):
 *   /usr/lib/python2.7/site-packages/gmpy2.so
 *   /usr/lib/python3.4/site-packages/gmpy2.cpython-34.so
 *   /usr/lib/python3.3/site-packages/gmpy2.cpython-33.so
 * This may or may not be a security problem, most of the time it is one.
 * Please double check that gmpy-2.0.5 really needs a world writeable bit and file bugs accordingly.
 * 


Reproducible: Always

Comment 1 Marc Burkhardt 2015-01-18 13:18:08 UTC

I have #533898 reported here as well, but no feedback so far as it may result in my system's setup. Some system infos are attached to the other bug.

Comment 2 Ian Delaney (RETIRED) gentoo-dev

2015-01-19 08:16:30 UTC

~/cvsPortage/gentoo-x86/dev-python/gmpy $ ebuild gmpy-2.0.5.ebuild clean install

running install_egg_info
Writing /mnt/gen2/TmpDir/portage/dev-python/gmpy-2.0.5/image//_python2.7/usr/lib64/python2.7/site-packages/gmpy2-2.0.5-py2.7.egg-info
 * python2_7: running distutils-r1_run_phase python_install_all
>>> Completed installing gmpy-2.0.5 into /mnt/gen2/TmpDir/portage/dev-python/gmpy-2.0.5/image/

strip: x86_64-pc-linux-gnu-strip --strip-unneeded -R .comment -R .GCC.command.line -R .note.gnu.gold-version
   usr/lib64/python3.3/site-packages/gmpy2.cpython-33.so
   usr/lib64/python3.4/site-packages/gmpy2.cpython-34.so
   usr/lib64/python2.7/site-packages/gmpy2.so
ecompressdir: bzip2 -9 /usr/share/doc

~/cvsPortage/gentoo-x86/dev-python/gmpy $ grep "Security Notice" /mnt/gen2/TmpDir/portage/dev-python/gmpy-2.0.5/temp//build.log 

yields blank.

All things are not equal

Comment 3 Marc Burkhardt 2015-01-28 05:50:32 UTC

See bug 533898, ccache/portage bug.

*** This bug has been marked as a duplicate of bug 533898 ***