Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 470862 - =app-text/djvu- with media-gfx/inkscape - sandbox violation in /root/.config/inkscape
Summary: =app-text/djvu- with media-gfx/inkscape - sandbox violation in /root/...
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: TeX project
Keywords: PATCH
Depends on:
Reported: 2013-05-21 10:18 UTC by Christopher Schwan
Modified: 2020-07-29 10:50 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Build log (build.log,66.72 KB, text/plain)
2013-05-21 11:26 UTC, Christopher Schwan
ebuild patch (djvu-,488 bytes, patch)
2013-07-05 22:21 UTC, amaury.gauthier
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Schwan 2013-05-21 10:18:14 UTC
`emerge -1 =app-text/djvu-` generates an access denied error when inkscape is installed and librsvg is not, because the following is run:

make[1]: Entering directory `/var/tmp/portage/app-text/djvu-'
s=`echo hi16-djvu.png | sed -e 's/[a-z]*\([0-9]*\).*/\1/'`; \
  false -w ${s} -h ${s} -o hi16-djvu.png djvu.svg \
          || /usr/bin/convert -geometry ${s}x${s} -depth 8 -background none djvu.svg hi16-djvu.png \
  || /usr/bin/inkscape --without-gui --export-width=${s} \
                         --export-height=${s} --export-png=hi16-djvu.png djvu.svg \
  || cp ./prebuilt-hi16-djvu.png hi16-djvu.png

`convert` fails with the message:

convert: delegate failed `"rsvg-convert" -o "%o" "%i"' @ error/delegate.c/InvokeDelegate/1065.
convert: unable to open image `/var/tmp/portage/app-text/djvu-': No such file or directory @ error/blob.c/OpenBlob/2642.
convert: unable to open file `/var/tmp/portage/app-text/djvu-': No such file or directory @ error/constitute.c/ReadImage/583.
convert: no images defined `hi16-djvu.png' @ error/convert.c/ConvertImageCommand/3044.

which starts inkscape trying to write to root's home:

ACCESS DENIED  mkdir:        /root/.config/inkscape

** (inkscape:3725): WARNING **: Unable to create profile directory (Permission denied) (13)

I circumvented the problem by removing inkscape.

Reproducible: Always

Steps to Reproduce:
1. emerge =media-gfx/inkscape-0.48.4
2. emerge =app-text/djvu-

Portage (default/linux/amd64/13.0/no-multilib, gcc-4.6.3, glibc-2.15-r3, 3.8.13-gentoo x86_64)
System uname: Linux-3.8.13-gentoo-x86_64-Intel-R-_Core-TM-_i7_CPU_Q_740_@_1.73GHz-with-gentoo-2.2
KiB Mem:     8113240 total,   5982008 free
KiB Swap:    1060284 total,   1060284 free
Timestamp of tree: Tue, 21 May 2013 09:00:01 +0000
ld GNU ld (GNU Binutils) 2.22
app-shells/bash:          4.2_p45
dev-lang/python:          2.7.3-r3, 3.2.3-r2
dev-util/pkgconfig:       0.28
sys-apps/baselayout:      2.2
sys-apps/openrc:          0.11.8
sys-apps/sandbox:         2.5
sys-devel/autoconf:       2.13, 2.69
sys-devel/automake:       1.12.6
sys-devel/binutils:       2.22-r1
sys-devel/gcc:            4.6.3
sys-devel/gcc-config:     1.7.3
sys-devel/libtool:        2.4.2
sys-devel/make:           3.82-r4
sys-kernel/linux-headers: 3.7 (virtual/os-headers)
sys-libs/glibc:           2.15-r3
Repositories: gentoo sage-on-gentoo cschwan-overlay
CFLAGS="-march=native -O2 -pipe"
CONFIG_PROTECT="/etc /usr/share/X11/xorg.conf.d /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/themes/oxygen-gtk/gtk-2.0"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=native -O2 -pipe"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync multilib-strict news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS="-O2 -pipe"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTDIR_OVERLAY="/home/cschwan/projects/sage-on-gentoo /home/cschwan/projects/cschwan-overlay"
USE="alsa amd64 bzip2 cli cracklib crypt cxx dri iconv minimal mmx modules mudflap ncurses nls nptl openmp pam pcre readline session sse sse2 ssl unicode xorg zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="sheets" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" DVB_CARDS="usb-af9015" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-3" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_2" RUBY_TARGETS="ruby19" SANE_BACKENDS="snapscan" USERLAND="GNU" VIDEO_CARDS="radeon" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7 3.2"
Comment 1 Christopher Schwan 2013-05-21 11:26:22 UTC
Created attachment 348818 [details]
Build log
Comment 2 amaury.gauthier 2013-07-05 22:21:16 UTC
Created attachment 352694 [details, diff]
ebuild patch

This patch adds XDG_CONFIG_HOME=${T} for the inkscape command.
Comment 3 Mart Raudsepp gentoo-dev 2018-04-18 06:31:42 UTC
(In reply to amaury.gauthier from comment #2)
> This patch adds XDG_CONFIG_HOME=${T} for the inkscape command.

You should be using xdg_environment_reset from xdg-utils.eclass instead of just setting one of the env vars.