Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 117422 - gnome-base/libbonoboui-2.10.1 insecure RUNPATHs
Summary: gnome-base/libbonoboui-2.10.1 insecure RUNPATHs
Status: RESOLVED WORKSFORME
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Runpath Issues (show other bugs)
Hardware: x86 Linux
: High minor (vote)
Assignee: Gentoo Linux Gnome Desktop Team
URL:
Whiteboard: [needpatch]
Keywords:
: 119988 120980 (view as bug list)
Depends on:
Blocks: 81745
  Show dependency tree
 
Reported: 2006-01-02 00:12 UTC by charles quarra
Modified: 2006-11-09 08:37 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description charles quarra 2006-01-02 00:12:38 UTC 
after doing emerge libbonoboui i get the following error:

  prepallstrip:
  strip: i686-pc-linux-gnu-strip --strip-unneeded
  usr/lib/libbonoboui-2.so.0.0.0
  usr/lib/libglade/2.0/libbonobo.so
  usr/lib/bonobo-2.0/samples/bonobo-sample-controls-2
  usr/bin/test-moniker
  usr/bin/bonobo-browser
  making executable: /usr/lib/libbonoboui-2.so.0.0.0
  
  QA Notice: the following files contain insecure RUNPATH's
  Please file a bug about this at http://bugs.gentoo.org/
  For more information on this issue, kindly review:
  http://bugs.gentoo.org/81745
  /var/tmp/portage/libbonoboui-2.10.1/image//usr/lib usr/lib/libglade/2.0/libbonobo.so
  /var/tmp/portage/libbonoboui-2.10.1/image//usr/lib usr/lib/bonobo-2.0/samples/bonobo-sample-controls-2
  /var/tmp/portage/libbonoboui-2.10.1/image//usr/lib usr/bin/test-moniker
  /var/tmp/portage/libbonoboui-2.10.1/image//usr/lib usr/bin/bonobo-browser
  
  
  !!! ERROR: gnome-base/libbonoboui-2.10.1 failed.
  !!! Function dyn_install, Line 1057, Exitcode 0
  !!! Insecure binaries detected
  !!! If you need support, post the topmost build error, NOT this status   message. 

 

 Here is my emerge --info

Portage 2.0.53 (default-linux/x86/2005.1, gcc-3.3.5-20050130, glibc-2.3.4.20041102-r1, 2.6.12-gentoo-r6 i686)
=================================================================
System uname: 2.6.12-gentoo-r6 i686 Intel(R) Celeron(R) M processor         1.40GHz
Gentoo Base System version 1.6.12
dev-lang/python:     2.3.5
sys-apps/sandbox:    1.2.11
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.5
sys-devel/binutils:  2.15.92.0.2-r10
sys-devel/libtool:   1.5.18-r1
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=i686"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X alsa apm arts audiofile avi berkdb bitmap-fonts bzip2 crypt cups directfb eds emboss encode expat fam foomaticdb fortran gdbm gif gnome gpm gstreamer gtk gtk2 idn imlib ipv6 jpeg kde lcms libg++ libwww mad mikmod mng motif mp3 mpeg ncurses nls ogg oggvorbis opengl oss pam pcre pdflib perl png python qt quicktime readline sdl spell ssl tcpd tiff truetype truetype-fonts type1-fonts udev vorbis xml2 xmms xv zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY
Comment 1 charles quarra 2006-01-02 00:15:14 UTC 
Portage 2.0.53 (default-linux/x86/2005.1, gcc-3.3.5-20050130, glibc-2.3.4.20041102-r1, 2.6.12-gentoo-r6 i686)
=================================================================
System uname: 2.6.12-gentoo-r6 i686 Intel(R) Celeron(R) M processor         1.40GHz
Gentoo Base System version 1.6.12
dev-lang/python:     2.3.5
sys-apps/sandbox:    1.2.11
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.5
sys-devel/binutils:  2.15.92.0.2-r10
sys-devel/libtool:   1.5.18-r1
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=i686"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X alsa apm arts audiofile avi berkdb bitmap-fonts bzip2 crypt cups directfb eds emboss encode expat fam foomaticdb fortran gdbm gif gnome gpm gstreamer gtk gtk2 idn imlib ipv6 jpeg kde lcms libg++ libwww mad mikmod mng motif mp3 mpeg ncurses nls ogg oggvorbis opengl oss pam pcre pdflib perl png python qt quicktime readline sdl spell ssl tcpd tiff truetype truetype-fonts type1-fonts udev vorbis xml2 xmms xv zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY
Comment 2 Tupone Alfredo gentoo-dev 2006-01-12 11:13:48 UTC 
works to me
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2006-01-15 09:40:10 UTC 
Does anyone lese reproduce this ?
Comment 4 m8ryx 2006-01-16 10:01:40 UTC 
(In reply to comment #3)
> Does anyone lese reproduce this ?
> 
Yes, I have been having this problem for several days.  It looks to compile, but fail during the install phase.  I'd paste my output, but it's identical to the original reporter's.

Here's my portage stuff:
cassady ~ # emerge --info
Portage 2.0.53 (default-linux/x86/2005.0, gcc-3.3.6, glibc-2.3.5-r2, 2.6.13-gentoo-r3 i686)
=================================================================
System uname: 2.6.13-gentoo-r3 i686 AMD Athlon(tm)
Gentoo Base System version 1.12.0_pre14
ccache version 2.3 [disabled]
dev-lang/python:     2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=athlon-xp -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=athlon-xp -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://gentoo.osuosl.org/ http://gentoo.binarycompass.org ftp://chod.cwru.edu/gentoo ftp://ftp6.uni-erlangen.de/pub/mirrors/gentoo"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl adns alsa apm arts audiofile avi bash-completion berkdb bitmap-fonts bonobo bzip2 cdr crypt cups curl eds emboss encode esd exif expat fam ffmpeg flac foomaticdb fortran gd gdbm gif gimpprint glut gmp gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml guile idn imagemagick imlib ipv6 java jpeg kde lcms libg++ libwww lm_sensors mad mikmod mng motif mozilla mp3 mpeg ncurses nls ogg oggvorbis opengl oss pam pcre pdflib perl png ppds python qt quicktime readline recode ruby samba scanner sdl snmp spell ssl svga symlink tcpd tiff truetype truetype-fonts type1-fonts udev usb vorbis win32codecs x86 xine xml xml2 xmms xv xvid zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, MAKEOPTS

thanks for taking a look!
Comment 5 m8ryx 2006-01-18 14:30:24 UTC 
oh, and I'm following this so feel free to follow-up with any questions that might be relevant (or email if you have access to my email address).  cheers!
Comment 6 m8ryx 2006-01-23 19:44:32 UTC 
the -r1 revision installs on my system.  I think we're golden, thanks much!  If the fix was mortal-accessible, please post and I'll be more useful next time.


(In reply to comment #5)
> oh, and I'm following this so feel free to follow-up with any questions that
> might be relevant (or email if you have access to my email address).  cheers!
>
Comment 7 Philipp Toelke 2006-01-29 11:57:43 UTC 
Neither 2.10.1 nor -r1 work for me

I did a "perl-cleaner as proposed in #81745.

Here is my emerge --info

Portage 2.0.54 (default-linux/x86/2005.1, gcc-3.3.5-20050130, glibc-2.3.4.20041102-r1, 2.6.15.1 i686)
=================================================================
System uname: 2.6.15.1 i686 AMD Athlon(tm) Processor
Gentoo Base System version 1.6.14
dev-lang/python:     2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.15.92.0.2-r10
sys-devel/libtool:   1.5.18-r1
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-mcpu=athlon-tbird -O3 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-mcpu=athlon-tbird -O3 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://www.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="x86 3dnow X Xaw3d a52 aac aalib acpi aim alsa apache2 apm arts audiofile avi bash bash-completion bcmath berkdb bidi bitmap-fonts bmp bzip2 calendar cdinstall cdparanoia cdr crypt cscope ctype cups curl curlwrappers dbus dbx dio doc dri dts dv dvb dvd dvdr dvdread eds emboss encode esd esoob ethereal exif expat fam ffmpeg flac flash foomaticdb fortran freetds ftp gb gd gdbm gif glut gnome gnutls gphoto2 gpm gstreamer gtk gtk2 hal iconv icq imagemagick imap imlib innodb ipv6 jabber java javascript joystick jpeg jpeg2k junit kde lcms lesstif libcaca libedit libg++ libwww lirc lm_sensors mad matroska matrox mikmod mime ming mmap mmx mng motif mozilla mp3 mpeg msn mysql mysqli ncurses nls nptl nsplugin ocaml offensive ogg oggvorbis openal opengl oscar oss pam pcre pdf pdflib perl plotutils png posix ppds prelude profile python qdbm qt quicktime readline ruby samba scanner sdl slang slp sndfile snmp soap sockets sox spell ssl svg svga symlink tcltk tcpd tetex threads tiff truetype truetype-fonts type1-fonts udev usb v4l vcd videos vorbis win32codecs wmf wxwindows xface xine xinerama xml2 xmms xosd xpm xsl xv xvid yahoo zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTDIR_OVERLAY
Comment 8 SpanKY gentoo-dev 2006-01-30 15:46:30 UTC 
*** Bug 120980 has been marked as a duplicate of this bug. ***
Comment 9 SpanKY gentoo-dev 2006-01-30 15:46:53 UTC 
*** Bug 119988 has been marked as a duplicate of this bug. ***
Comment 10 Seth 2006-01-30 21:57:25 UTC 
A workaround was posted to:
http://forums.gentoo.org/viewtopic-p-3072660.html#3072660

Thanks to whoever posted it I can at least get my machine working again.
Comment 11 Philipp Toelke 2006-02-02 11:12:59 UTC 
Works for me
Comment 12 solar (RETIRED) gentoo-dev 2006-03-05 08:02:56 UTC 
The next ~arch portage revision will auto repair evil rpaths and not bail. 
Maintainers should still fix the packages they maintain as portage will only die
with FEATURES=stricter (but that is a maintainer & QA problem) no longer security@

http://bugs.gentoo.org/show_bug.cgi?id=124962
Comment 13 Jakub Moc (RETIRED) gentoo-dev 2006-09-21 03:41:54 UTC 
No longer a security issue with current stable portage, re-assigning to maintainer.
Comment 14 Leonardo Boshell (RETIRED) gentoo-dev 2006-11-09 08:37:33 UTC 
No longer reproducible.