Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 117535 - media-video/mjpegtools-1.8.0-r1 contains insecure RUNPATHs
Summary: media-video/mjpegtools-1.8.0-r1 contains insecure RUNPATHs
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Runpath Issues (show other bugs)
Hardware: x86 Linux
: High minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: [needpatch]
Keywords:
Depends on:
Blocks: 81745
  Show dependency tree
 
Reported: 2006-01-02 21:28 UTC by Peyman Pourkermani
Modified: 2006-02-12 09:50 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge log of mjpegtools-1.8.0-r1 (mjpegtools-1.8.0-r1.log,239.20 KB, text/plain)
2006-01-07 11:26 UTC, Peyman Pourkermani
Details
New emerge log showing libtool warnings (mjpegtools.log,249.50 KB, text/plain)
2006-02-11 07:53 UTC, Peyman Pourkermani
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Peyman Pourkermani 2006-01-02 21:28:00 UTC
This is another ebuild that seems to be having insecure RUNPATH error:

...

making executable: /usr/lib/liblavfile-1.8.so.0.0.0
making executable: /usr/lib/liblavjpeg-1.8.so.0.0.0
making executable: /usr/lib/liblavplay-1.8.so.0.0.0
making executable: /usr/lib/liblavrec-1.8.so.0.0.0
making executable: /usr/lib/libmjpegutils-1.8.so.0.0.0
making executable: /usr/lib/libmpeg2encpp-1.8.so.0.0.0
making executable: /usr/lib/libmplex2-1.8.so.0.0.0

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/mjpegtools-1.8.0-r1/image//usr/lib:/usr/lib/gcc-lib/i386-pc-linux-gnu/3.3.6 usr/bin/lavplay


My emerge --info:

Portage 2.0.53 (default-linux/x86/2005.1, gcc-3.4.4, glibc-2.3.5-r2, 2.6.14-gentoo-r2 i686)
=================================================================
System uname: 2.6.14-gentoo-r2 i686 Intel(R) Pentium(R) M processor 1.86GHz
Gentoo Base System version 1.6.13
dev-lang/python:     2.3.5-r2, 2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.20
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium-m -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/splash /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=pentium-m -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig candy digest distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X aac aalib acpi alsa apm arts audiofile avi berkdb bitmap-fonts bzip2 cdparanoia cdr cdrom crypt cups curl dbus divx4linux dv dvd dvdread eds emboss encode epiphany esd ethereal exif expat fam fbcon ffmpeg firefox flac flash foomaticdb fortran freetype gd gdbm gif glut gnome gphoto2 gpm gstreamer gtk gtk2 guile hal howl idn imagemagick imlib ipv6 java jpeg junit lame lcms ldap libg++ libwww live mad mikmod mjpeg mmx mng mono motif mozilla mp3 mpeg mpeg4 mplayer mysql ncurses nls ogg oggvorbis opengl oss pam pcre pdflib perl png python qt quicktime readline real rtc samba scanner sdl speex spell sqlite sse sse2 ssl svg svga tcltk tcpd theora tiff truetype truetype-fonts type1 type1-fonts udev usb vcd vidix vorbis vorbix webservices win32codecs xine xml xml2 xmms xrandr xscreensaver xv xvid zeroconf zlib userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS




!!! ERROR: media-video/mjpegtools-1.8.0-r1 failed.
!!! Function dyn_install, Line 1057, Exitcode 0
!!! Insecure binaries detected
!!! If you need support, post the topmost build error, NOT this status message.
Comment 1 SpanKY gentoo-dev 2006-01-02 21:43:39 UTC
works fine for me ... please run `emerge mjpegtools >& log` and post the log as an attachment
Comment 2 Peyman Pourkermani 2006-01-07 11:26:34 UTC
Created attachment 76465 [details]
emerge log of mjpegtools-1.8.0-r1

Here is the log as you requested
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2006-01-15 09:48:32 UTC
Ccing maintainers.
vapier: does the requested log talk to you ?
Comment 4 Diego Elio Pettenò (RETIRED) gentoo-dev 2006-02-04 08:41:28 UTC
Cannot reproduce here.
Comment 5 Peyman Pourkermani 2006-02-11 07:53:59 UTC
Created attachment 79498 [details]
New emerge log showing libtool warnings

I have attached a new emerge log (after upgrading gcc and the latest emerge -uDv world). There are a lot of libtool warnings. Is that normal? The insecure RUNPATH error at the bottom of the log is also different.
Comment 6 SpanKY gentoo-dev 2006-02-12 01:28:20 UTC
if you're referring to the -mcpu warning, that is from gcc, not libtool ... and it's normal, read the warning message and you should be able to figure out what's wrong
Comment 7 SpanKY gentoo-dev 2006-02-12 02:06:41 UTC
this looks screwed up to me:

make[1]: Warning: File `/usr/include/SDL/SDL.h' has modification time 5.4e+08 s in the future

make sure your clock isnt broken, run `touch /usr/include/SDL/SDL.h`, and then re-emerge mjpegtools
Comment 8 Peyman Pourkermani 2006-02-12 08:46:40 UTC
My clock is correct. For whatever reason /usr/include/SDL/SDL.h must have had the wrong timestamp but now it has a valid date and time. So I emerged mjpegtools and it builds fine :)

I understand the -mcpu warning but I have not set it. This is what my make.conf file looks like:

CHOST="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium-m -pipe -fomit-frame-pointer"
CXXFLAGS="${CFLAGS}"

I have not set -mcpu so I assume it's set by the ebuild or in the source ??

The libtool warnings I refer to could be normal but they look like this:

libtool: install: warning: `/var/tmp/portage/mjpegtools-1.8.0-r1/work/mjpegtools-1.8.0/utils/libmjpegutils.la' has not been installed in `/usr/lib'

You can see them around line 1380 in the log.

Thanks.
Comment 9 SpanKY gentoo-dev 2006-02-12 09:50:21 UTC
> My clock is correct. For whatever reason /usr/include/SDL/SDL.h must have had
> the wrong timestamp but now it has a valid date and time. So I emerged
> mjpegtools and it builds fine :)

ok, marking bug as INVALID then

> I understand the -mcpu warning but I have not set it. This is what my
> make.conf file looks like:

ah, this is the configure script misbehaving ... i'll fix this in portage

> The libtool warnings I refer to could be normal but they look like this:
> libtool: install: warning:
`/var/tmp/portage/mjpegtools-1.8.0-r1/work/mjpegtools-1.8.0/utils/libmjpegutils.la'
> has not been installed in `/usr/lib'

that is normal, just ignore it