Bug 265834 – netbeans 6.8-r1 reports insecure RPATH, text relocations, executable stacks

• Status: RESOLVED WONTFIX
• Product: Gentoo Linux

[Description Nikolai 2009-04-12 09:39:47 UTC]

The Installation process of dev-util/netbeans-6.5-r4 reports several problems. It says 'please file a bug' so here you go.

Except for reporting the problems below netbeans installed alright and seems to be running without issues

I have a feeling this might be related to bug 251270

Please let me know if you need more information (full log file, installed versions, ...)

1. 
scanelf: rpath_security_checks(): Security problem NULL DT_RPATH in /var/tmp/portage/dev-util/netbeans-6.5-r4/image/usr/share/netbeans-6.5/profiler3/lib/deployed/jdk15/hpux-pa_risc2.0w/libprofilerinterface.sl

2.
The following files contain runtime text relocations
 * TEXTREL usr/share/netbeans-6.5/profiler3/lib/deployed/jdk16/solaris-i386/libprofilerinterface.so
 * TEXTREL usr/share/netbeans-6.5/profiler3/lib/deployed/jdk16/solaris-sparc/libprofilerinterface.so
 * TEXTREL usr/share/netbeans-6.5/profiler3/lib/deployed/jdk15/solaris-i386/libprofilerinterface.so
 * TEXTREL usr/share/netbeans-6.5/profiler3/lib/deployed/jdk15/solaris-sparc/libprofilerinterface.so


3.
 * --- --- RWX usr/share/netbeans-6.5/profiler3/lib/deployed/jdk16/solaris-i386/libprofilerinterface.so
 * --- --- RWX usr/share/netbeans-6.5/profiler3/lib/deployed/jdk16/solaris-sparcv9/libprofilerinterface.so
 * --- --- RWX usr/share/netbeans-6.5/profiler3/lib/deployed/jdk16/solaris-sparc/libprofilerinterface.so
 * --- --- RWX usr/share/netbeans-6.5/profiler3/lib/deployed/jdk15/solaris-i386/libprofilerinterface.so
 * --- --- RWX usr/share/netbeans-6.5/profiler3/lib/deployed/jdk15/solaris-sparcv9/libprofilerinterface.so
 * --- --- RWX usr/share/netbeans-6.5/profiler3/lib/deployed/jdk15/solaris-sparc/libprofilerinterface.so




Reproducible: Didn't try

[Comment 1 Lars Wendler (Polynomial-C) (RETIRED) 2009-04-12 10:13:45 UTC]

Please post your "emerge --info".

[Comment 2 Nikolai 2009-04-12 11:30:19 UTC]

Created attachment 188079 [details]
emerge --info for the initial bug description

[Comment 3 Miroslav Šulc 2009-05-08 16:59:32 UTC]

All the reported files are needed. These are for remote development/debugging with netbeans. I have no idea what we could do with these files to get rid of the warnings and still have them available for developers. Anyone any idea?

[Comment 4 anomen 2009-05-13 06:59:00 UTC]

RESTRICT="binchecks"

but i'm not sure it's the right thing to do. 

[Comment 5 Alistair Bush (RETIRED) 2009-05-13 11:27:53 UTC]

(In reply to comment #3)
> All the reported files are needed. These are for remote development/debugging
> with netbeans. I have no idea what we could do with these files to get rid of
> the warnings and still have them available for developers. Anyone any idea?
> 

Are they bundled? or built?

[Comment 6 Miroslav Šulc 2009-05-13 11:36:57 UTC]

(In reply to comment #5)
> Are they bundled? or built?
> 

bundled

[Comment 7 Panagiotis Christopoulos (RETIRED) 2010-05-04 20:47:52 UTC]

*** Bug 317717 has been marked as a duplicate of this bug. ***

[Comment 8 Miroslav Šulc 2010-08-08 18:38:01 UTC]

*** Bug 331647 has been marked as a duplicate of this bug. ***

[Comment 9 David Carlos Manuelda 2011-03-15 03:20:48 UTC]

Confirmed again in netbeans-6.9.1:

scanelf: rpath_security_checks(): Security problem NULL DT_RPATH in /var/tmp/portage/dev-util/netbeans-6.9.1/image/usr/share/netbeans-6.9/profiler/lib/deployed/jdk15/hpux-pa_risc2.0w/libprofilerinterface.sl
scanelf: rpath_security_checks(): Security problem NULL DT_RPATH in /var/tmp/portage/dev-util/netbeans-6.9.1/image/usr/share/netbeans-6.9/profiler/lib/deployed/jdk16/hpux-pa_risc2.0w/libprofilerinterface.sl

 * QA Notice: The following files contain insecure RUNPATHs
 *  Please file a bug about this at http://bugs.gentoo.org/
 *  with the maintaining herd of the package.
 * /usr/lib/pa20_64:/opt/langtools/lib/pa20_64: usr/share/netbeans-6.9/profiler/lib/deployed/jdk15/hpux-pa_risc2.0w/libprofilerinterface.sl
 * /usr/lib/pa20_64:/opt/langtools/lib/pa20_64: usr/share/netbeans-6.9/profiler/lib/deployed/jdk16/hpux-pa_risc2.0w/libprofilerinterface.sl

Auto fixing rpaths for /usr/lib/pa20_64:/opt/langtools/lib/pa20_64: usr/share/netbeans-6.9/profiler/lib/deployed/jdk15/hpux-pa_risc2.0w/libprofilerinterface.sl
/usr/lib/pa20_64:/opt/langtools/lib/pa20_64: usr/share/netbeans-6.9/profiler/lib/deployed/jdk16/hpux-pa_risc2.0w/libprofilerinterface.sl

[Comment 10 Miroslav Šulc 2011-10-25 00:51:28 UTC]

though not mentioned here, i guess this one is affected too and it's the only one affected that is still in the tree. with stabilization of netbeans 7.x this version will be gone too

[Comment 11 Miroslav Šulc 2012-12-06 11:52:35 UTC]

this version is not in the tree anymore. this bug is replaced by bug 429500