Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 117633 - x11-libs/vte contains insecure RUNPATH/RPATH
Summary: x11-libs/vte contains insecure RUNPATH/RPATH
Status: RESOLVED WORKSFORME
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Runpath Issues (show other bugs)
Hardware: x86 Linux
: High normal (vote)
Assignee: Gentoo Linux Gnome Desktop Team
URL:
Whiteboard:
Keywords:
: 121993 122355 (view as bug list)
Depends on:
Blocks: 81745
  Show dependency tree
 
Reported: 2006-01-03 10:51 UTC by Malcolm Lashley (RETIRED)
Modified: 2006-11-09 09:01 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Malcolm Lashley (RETIRED) gentoo-dev 2006-01-03 10:51:35 UTC
My relevant useflags

Calculating dependencies ...done!
[ebuild     U ] x11-libs/vte-0.11.16 [0.11.15-r1] USE="python -debug -doc -static" 0 kB

The offending files:

QA Notice: the following files contain insecure RUNPATH's
 Please file a bug about this at http://bugs.gentoo.org/
 For more information on this issue, kindly review:
 http://bugs.gentoo.org/81745
/var/tmp/portage/vte-0.11.16/image//usr/lib usr/bin/vte
/var/tmp/portage/vte-0.11.16/image//usr/lib usr/lib/python2.4/site-packages/gtk-2.0/vtemodule.so
Comment 1 Daniel Gryniewicz (RETIRED) gentoo-dev 2006-01-08 15:48:22 UTC
This appears to be an autoconf bug, not a vte bug. vte only references a run path in files generated by aclocal or configure.  I do not see these warnings on my system.
Comment 2 Jakub Moc (RETIRED) gentoo-dev 2006-02-07 09:33:48 UTC
*** Bug 121993 has been marked as a duplicate of this bug. ***
Comment 3 lostprogrammer 2006-02-08 00:42:19 UTC
So how to fix this bug? How I can compile vte without errors?
Comment 4 Jakub Moc (RETIRED) gentoo-dev 2006-02-10 04:51:18 UTC
*** Bug 122355 has been marked as a duplicate of this bug. ***
Comment 5 Jakub Moc (RETIRED) gentoo-dev 2006-02-10 04:51:44 UTC
Reopen wrt the duplicate bugs.
Comment 6 Florian Steinel 2006-02-13 12:24:59 UTC
works for me with vte-0.11.16 and r1.

Portage 2.0.54 (default-linux/x86/2005.1, gcc-3.4.4, glibc-2.3.5-r1, 2.6.14-gentoo-r2 i686)
=================================================================
System uname: 2.6.14-gentoo-r2 i686 AMD Athlon(tm) Processor
Gentoo Base System version 1.6.14
distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled]
ccache version 2.3 [enabled]
dev-lang/python:     2.4.2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O3 -march=athlon -funroll-loops -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/defaults/pref /usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/splash /etc/terminfo /etc/env.d"
CXXFLAGS="-O3 -march=athlon -funroll-loops -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache confcache distcc distlocks sandbox sfperms strict"
GENTOO_MIRRORS="ftp://ftp.tu-clausthal.de/pub/linux/gentoo/"
LANG="de_DE.UTF-8"
LC_ALL="de_DE.UTF-8"
LINGUAS="de en"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://192.168.18.77/gentoo-portage"
USE="x86 3dnow X aac acl alsa apm audiofile avi bash-completion berkdb bitmap-fonts bonobo bzip2 bzlib cairo cdr crypt cups curl curlwrappers dbus dts eds emboss encode esd exif expat fam ffmpeg foomaticdb fortran ftp gdbm gif glut gnome gpm gstreamer gtk gtk2 gtkhtml guile hal howl idn imagemagick imlib ipv6 java jpeg lcms ldap libg++ libwww lua mad mikmod mmx mng motif mozilla mozsvg mp3 mpeg ncurses nls ogg oggvorbis openal opengl oss pam pcre pdflib perl png python qt quicktime readline recode sdl slang slp spell ssl svg svga tcltk tcpd tiff truetype truetype-fonts type1-fonts udev unicode usb userlocales vorbis xine xml2 xmms xprint xv zlib linguas_de linguas_en userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LDFLAGS
Comment 7 Michal 2006-02-16 04:25:53 UTC
(In reply to comment #3)
> So how to fix this bug? How I can compile vte without errors?
> 

Hi, i have the same question. I'm author of duplicate bug-122355 (very sorry for that) and i really don't know what to do with that error, i try with every version of vte, do emerge -e system, and it's still doesn't install;
i can't do 'emerge -uD world' , because it's always stops on vte :(
i don't understand what's wrong with autoconf ...:/

Please, help me! :-)
Have a nice day
Comment 8 lostprogrammer 2006-02-21 05:38:39 UTC
I have found the solution: you should emerge autoconf 2.13 and all will be OK.
Comment 9 Michal 2006-02-24 10:48:09 UTC
(In reply to comment #8)
> I have found the solution: you should emerge autoconf 2.13 and all will be OK.
> 

Have you do anything else ?
Because i do "emerge =sys-devel/autoconf-2.13", but vte still don't want to install :(((
Comment 10 lostprogrammer 2006-02-24 23:44:29 UTC
Hmm, I think I don't do anything else. Maybe I forgot something. Sorry.
Comment 11 Michal 2006-03-03 12:18:42 UTC
(In reply to comment #1)
> This appears to be an autoconf bug, not a vte bug. vte only references a run
> path in files generated by aclocal or configure.  I do not see these warnings
> on my system.
> 

I'm sorry, that i complain, but can someone from developer-team  explain me what i have to do with this error, how can i install vte and what kind of bug have my autoconf ?
Any ideas what should i do ?
Comment 12 solar (RETIRED) gentoo-dev 2006-03-05 08:03:02 UTC
The next ~arch portage revision will auto repair evil rpaths and not bail. 
Maintainers should still fix the packages they maintain as portage will only die
with FEATURES=stricter (but that is a maintainer & QA problem) no longer security@

http://bugs.gentoo.org/show_bug.cgi?id=124962
Comment 13 Michal 2006-03-12 10:15:10 UTC
(In reply to comment #12)
> The next ~arch portage revision will auto repair evil rpaths and not bail. 
> Maintainers should still fix the packages they maintain as portage will only
> die
> with FEATURES=stricter (but that is a maintainer & QA problem) no longer
> security@
> 
> http://bugs.gentoo.org/show_bug.cgi?id=124962
> 

Yes, with portage-2.1_pre6 it's working ! :)
Thank you for your great work
Comment 14 Jakub Moc (RETIRED) gentoo-dev 2006-09-21 03:44:31 UTC
No longer a security issue with current stable portage, re-assigning to maintainer.
Comment 15 Leonardo Boshell (RETIRED) gentoo-dev 2006-11-09 09:01:27 UTC
No longer reproducible.