Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 466216 - dev-qt/qtwebkit:5 contains insecure RUNPATHs
Summary: dev-qt/qtwebkit:5 contains insecure RUNPATHs
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal QA (vote)
Assignee: Qt Bug Alias
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: qt5-porting qt-5.4.2-stable
  Show dependency tree
 
Reported: 2013-04-17 10:37 UTC by M. B.
Modified: 2015-07-15 01:37 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
qtwebkit-5.3.2-rpath.patch (qtwebkit-5.3.2-rpath.patch,498 bytes, patch)
2014-10-01 14:58 UTC, Michael Palimaka (kensington)
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description M. B. 2013-04-17 10:37:20 UTC
excerpt from the build.log:

[...]
make[1]: Für das Ziel »install« ist nichts zu tun.
make[1]: Leaving directory `/var/tmp/portage/dev-qt/qtwebkit-5.0.2/work/qtwebkit-opensource-src-5.0.2_build/Tools'
 * Removing unnecessary /usr/lib64/libQt5WebKit.la (no static archive)
 * Removing unnecessary /usr/lib64/libQt5WebKitWidgets.la (no static archive)
>>> Completed installing qtwebkit-5.0.2 into /var/tmp/portage/dev-qt/qtwebkit-5.0.2/image/

strip: x86_64-pc-linux-gnu-strip --strip-unneeded -R .comment -R .GCC.command.line
   usr/lib64/qt5/libexec/QtWebProcess
   usr/lib64/libQt5WebKit.so.5.0.2
   usr/lib64/libQt5WebKitWidgets.so.5.0.2
Auto fixing rpaths for /var/tmp/portage/dev-qt/qtwebkit-5.0.2/image/usr/lib64/qt5/libexec/QtWebProcess

 * QA Notice: The following files contain insecure RUNPATHs
 *  Please file a bug about this at http://bugs.gentoo.org/
 *  with the maintaining herd of the package.
 *   /var/tmp/portage/dev-qt/qtwebkit-5.0.2/image/usr/lib64/qt5/libexec/QtWebProcess
 * 

 * checking 99 files for package collisions
>>> Merging dev-qt/qtwebkit-5.0.2 to /
[...]
Comment 1 Davide Pesavento gentoo-dev 2013-07-04 21:54:38 UTC
is 5.1.0 affected?
Comment 2 M. B. 2013-07-25 14:51:28 UTC
yes.

strip: x86_64-pc-linux-gnu-strip --strip-unneeded -R .comment -R .GCC.command.line -R .note.gnu.gold-version
   usr/lib64/qt5/libexec/QtWebProcess
   usr/lib64/libQt5WebKitWidgets.so.5.1.0
   usr/lib64/libQt5WebKit.so.5.1.0
Auto fixing rpaths for /var/tmp/portage/dev-qt/qtwebkit-5.1.0/image/usr/lib64/qt5/libexec/QtWebProcess

 * QA Notice: The following files contain insecure RUNPATHs
 *  Please file a bug about this at http://bugs.gentoo.org/
 *  with the maintaining herd of the package.
 *   /var/tmp/portage/dev-qt/qtwebkit-5.1.0/image/usr/lib64/qt5/libexec/QtWebProcess
 *
Comment 3 Davide Pesavento gentoo-dev 2013-10-27 19:51:53 UTC
Same with 5.2.0_beta1 ?
Comment 4 M. B. 2013-10-30 12:24:35 UTC
Ask me again when #489416 is resolved ;)
Comment 5 M. B. 2013-11-13 20:41:24 UTC
still an issue.

strip: x86_64-pc-linux-gnu-strip --strip-unneeded -R .comment -R .GCC.command.line -R .note.gnu.gold-version
   usr/lib64/qt5/qml/QtWebKit/libqmlwebkitplugin.so
   usr/lib64/libQt5WebKit.so.5.2.0
   usr/lib64/libQt5WebKitWidgets.so.5.2.0
   usr/lib64/qt5/qml/QtWebKit/experimental/libqmlwebkitexperimentalplugin.so
   usr/lib64/qt5/libexec/QtWebProcess
Auto fixing rpaths for /var/tmp/portage/dev-qt/qtwebkit-5.2.0_beta1/image/usr/lib64/qt5/libexec/QtWebProcess

 * QA Notice: The following files contain insecure RUNPATHs
 *  Please file a bug about this at http://bugs.gentoo.org/
 *  with the maintaining herd of the package.
 *   /var/tmp/portage/dev-qt/qtwebkit-5.2.0_beta1/image/usr/lib64/qt5/libexec/QtWebProcess
 *
Comment 6 Michael Palimaka (kensington) gentoo-dev 2014-10-01 14:58:23 UTC
Created attachment 385892 [details, diff]
qtwebkit-5.3.2-rpath.patch

The attached patch (variants of which are floating around other downstreams) resolves the issue locally. qtwebkit does not install default_post.prf so this should not affect qmake behaviour out of portage.
Comment 7 Davide Pesavento gentoo-dev 2014-10-02 18:59:51 UTC
Unfortunately Gentoo prefix needs the rpath (at least it was needed in qt 4.8, and I copied the same logic in qt5-build.eclass but qtwebkit build system doesn't respect that).

So, assuming prefix still needs it, a more conservative fix would be replacing that line with:

  contains(QT_CONFIG, rpath): CONFIG += rpath

But of course this will still produce an insecure rpath on prefix...
Comment 8 Michael Palimaka (kensington) gentoo-dev 2014-10-02 19:17:12 UTC
That's a shame, I guess I'll keep digging. At least Portage strips the offending RPATH though.
Comment 9 Davide Pesavento gentoo-dev 2014-10-02 19:18:58 UTC
The wrong rpath is added in Tools/qmake/mkspecs/features/rpath.prf
Comment 10 Michael Palimaka (kensington) gentoo-dev 2015-01-01 14:57:15 UTC
(In reply to Davide Pesavento from comment #9)
> The wrong rpath is added in Tools/qmake/mkspecs/features/rpath.prf

If we remove it there, will it still be broken for prefix? I can't test.
Comment 11 Michael Palimaka (kensington) gentoo-dev 2015-03-14 16:29:10 UTC
@prefix do you have any interest in qt5? I want to fix this bug but don't want to cause a problem for you later since I can't test.
Comment 12 Fabian Groffen gentoo-dev 2015-03-15 08:26:06 UTC
We don't have the resources to go after this.  Judging fromt his bug, however, it seems that if you remove the incorrect rpath, it should work for us.  I assume it works for your -- which is most important.

Do what you think is best to do, thanks for considering.
Comment 13 Michael Palimaka (kensington) gentoo-dev 2015-05-31 16:29:57 UTC
In overlay:

https://gitweb.gentoo.org/proj/qt.git/commit/?id=4b376d4e6d5163cc9d0c9f8f4fd9c3490a210d8f
Comment 14 Davide Pesavento gentoo-dev 2015-05-31 18:47:53 UTC
While at it, these files also have wrong rpaths:

$ scanelf -Ryrq .
$ORIGIN/../../lib  ./usr/lib64/qt5/qml/QtWebKit/libqmlwebkitplugin.so
$ORIGIN/../../lib  ./usr/lib64/qt5/qml/QtWebKit/experimental/libqmlwebkitexperimentalplugin.so

They don't trigger the QA warning because they use $ORIGIN instead of an absolute path, but they're still wrong once installed, that path only makes sense in the build environment.
Comment 15 Michael Palimaka (kensington) gentoo-dev 2015-07-12 17:27:23 UTC
Just need to remove CONFIG += rpath in Source/WebKit/qt/declarative/{public.pri,experimental/experimental.pri}, right?
Comment 16 Davide Pesavento gentoo-dev 2015-07-15 01:37:41 UTC
Fixed in cvs (5.4.2, no revbump) and git.