Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 537374 - net-libs/nodejs-0.10.35: QA Security Notice: world writable file(s): /usr/bin/node
Summary: net-libs/nodejs-0.10.35: QA Security Notice: world writable file(s): /usr/bin...
Status: RESOLVED DUPLICATE of bug 533898
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Library (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Johan Bergström
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-22 18:11 UTC by Marc Burkhardt
Modified: 2015-02-01 11:21 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Burkhardt 2015-01-22 18:11:08 UTC
See description. I have 533898 and 536970 file here which are similar. More system infos in the first one.

Reproducible: Always
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2015-01-22 19:22:39 UTC
I'm beginning to think it's you, not the ebuilds.
Comment 2 Johan Bergström 2015-01-22 21:47:50 UTC
So, can't reproduce:

$ emerge -pv nodejs && ls -al /usr/bin/node
[ebuild   R   ] net-libs/nodejs-0.10.35  USE="npm snapshot" 
-rwxr-xr-x 1 root root 7032752 Jan 23 08:08 /usr/bin/node
Comment 3 Marc Burkhardt 2015-01-22 22:20:46 UTC
OK, maybe. But: as I do not manually make the files 777: who/what is it?
Comment 4 Marc Burkhardt 2015-01-22 22:22:57 UTC
(In reply to Marc Burkhardt from comment #3)
> OK, maybe. But: as I do not manually make the files 777: who/what is it?

Did you build that with the exact same FEATURES as I did?
Comment 5 Marc Burkhardt 2015-01-22 22:23:51 UTC
(In reply to Marc Burkhardt from comment #4)
> (In reply to Marc Burkhardt from comment #3)
> > OK, maybe. But: as I do not manually make the files 777: who/what is it?
> 
> Did you build that with the exact same FEATURES as I did?

FEATURES="-candy ccache collision-protect config-protect-if-modified compressdebug -digest distlocks downgrade-backup ebuild-locks fakeroot fixlafiles merge-sync nodoc noinfo -notitles parallel-fetch preserve-libs protect-owned sandbox splitdebug -strict -stricter -test test-fail-continue userfetch -userpriv usersandbox usersync"
Comment 6 Johan Bergström 2015-01-22 22:25:28 UTC
(In reply to Marc Burkhardt from comment #4)
> (In reply to Marc Burkhardt from comment #3)
> > OK, maybe. But: as I do not manually make the files 777: who/what is it?
> 
> Did you build that with the exact same FEATURES as I did?

No, but even if I did, I don't think that discussion belongs in this bug since this is specifically labelled about a world-writable node binary. Seems like you have an active discussion in the other bugs, so you should probably keep that bug going instead.
Comment 7 Marc Burkhardt 2015-01-22 22:35:38 UTC
(In reply to Johan Bergström from comment #6)
> (In reply to Marc Burkhardt from comment #4)
> > (In reply to Marc Burkhardt from comment #3)
> > > OK, maybe. But: as I do not manually make the files 777: who/what is it?
> > 
> > Did you build that with the exact same FEATURES as I did?
> 
> No, but even if I did, I don't think that discussion belongs in this bug
> since this is specifically labelled about a world-writable node binary.
> Seems like you have an active discussion in the other bugs, so you should
> probably keep that bug going instead.

I didn't get that really, but ok. The fact is that there is a problem, that was unanswered in the other bug. Now, that I have many packages updated and a few seem to trigger this, any of the 'triggering ebuilds' should allow a discussion.
I will try to re-animate the other bug but I sadly got no answer from the point I posted my make.conf etc.

Are you going to close this one now? So if: I will not open any further bugs. The problem looks the same but I'm not able to identify it myself. Ill will then instead append any packages (I missed a lot like it seems) to the other bug.
Comment 8 Johan Bergström 2015-01-22 22:39:53 UTC
(In reply to Marc Burkhardt from comment #7)
> (In reply to Johan Bergström from comment #6)
> > (In reply to Marc Burkhardt from comment #4)
> > > (In reply to Marc Burkhardt from comment #3)
> > > > OK, maybe. But: as I do not manually make the files 777: who/what is it?
> > > 
> > > Did you build that with the exact same FEATURES as I did?
> > 
> > No, but even if I did, I don't think that discussion belongs in this bug
> > since this is specifically labelled about a world-writable node binary.
> > Seems like you have an active discussion in the other bugs, so you should
> > probably keep that bug going instead.
> 
> I didn't get that really, but ok. The fact is that there is a problem, that
> was unanswered in the other bug. Now, that I have many packages updated and
> a few seem to trigger this, any of the 'triggering ebuilds' should allow a
> discussion.

As mentioned by Jeroen, I don't think it's the nodejs ebuild that's specifically doing anything wrong, which is why I said that I don't think this is the right place for your specific problem. A better suited topic would be "Some packages gets world-writable flags when emerging them" and trying to figure out why your emerge acts differently than most others.

> I will try to re-animate the other bug but I sadly got no answer from the
> point I posted my make.conf etc.

I can't speak for others, but I've never stumbled upon anything similar so you'll have to give it some time.

> 
> Are you going to close this one now? So if: I will not open any further
> bugs. The problem looks the same but I'm not able to identify it myself. Ill
> will then instead append any packages (I missed a lot like it seems) to the
> other bug.

I'd reuse the bug that has most information and align it to your specific issue which necessarily isn't package-related (for instance nodejs). I'm sure we'll sort it out.
Comment 9 Marc Burkhardt 2015-01-28 05:51:16 UTC
See bug 533898, ccache/portage bug.

*** This bug has been marked as a duplicate of bug 533898 ***
Comment 10 Marc Burkhardt 2015-01-31 13:39:05 UTC
(In reply to Johan Bergström from comment #8)
> (In reply to Marc Burkhardt from comment #7)
> > (In reply to Johan Bergström from comment #6)
> > > (In reply to Marc Burkhardt from comment #4)
> > > > (In reply to Marc Burkhardt from comment #3)
> > > > > OK, maybe. But: as I do not manually make the files 777: who/what is it?
> > > > 
> > > > Did you build that with the exact same FEATURES as I did?
> > > 
> > > No, but even if I did, I don't think that discussion belongs in this bug
> > > since this is specifically labelled about a world-writable node binary.
> > > Seems like you have an active discussion in the other bugs, so you should
> > > probably keep that bug going instead.
> > 
> > I didn't get that really, but ok. The fact is that there is a problem, that
> > was unanswered in the other bug. Now, that I have many packages updated and
> > a few seem to trigger this, any of the 'triggering ebuilds' should allow a
> > discussion.
> 
> As mentioned by Jeroen, I don't think it's the nodejs ebuild that's
> specifically doing anything wrong, which is why I said that I don't think
> this is the right place for your specific problem. A better suited topic
> would be "Some packages gets world-writable flags when emerging them" and
> trying to figure out why your emerge acts differently than most others.
> 
> > I will try to re-animate the other bug but I sadly got no answer from the
> > point I posted my make.conf etc.
> 
> I can't speak for others, but I've never stumbled upon anything similar so
> you'll have to give it some time.
> 
> > 
> > Are you going to close this one now? So if: I will not open any further
> > bugs. The problem looks the same but I'm not able to identify it myself. Ill
> > will then instead append any packages (I missed a lot like it seems) to the
> > other bug.
> 
> I'd reuse the bug that has most information and align it to your specific
> issue which necessarily isn't package-related (for instance nodejs). I'm
> sure we'll sort it out.

Hi Johan,

I closed to bugs with similar results and found the triggering setup. But: there's no replies anymore in the bug 533898. What could I do now?

Thanks,
Marc