Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 605286 - sys-devel/gcc-4.9.4: libstdc++.so contains insecure runpath
Summary: sys-devel/gcc-4.9.4: libstdc++.so contains insecure runpath
Status: RESOLVED DUPLICATE of bug 582524
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Toolchain Maintainers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-01-10 16:30 UTC by Vaibhav Niku
Modified: 2017-02-15 08:42 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (gcc-rpath-bug,16.51 KB, text/plain)
2017-01-10 16:30 UTC, Vaibhav Niku
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Vaibhav Niku 2017-01-10 16:30:41 UTC
Created attachment 459488 [details]
emerge --info

>>> Messages generated [...] for package sys-devel/gcc-4.9.4:

WARN: postinst
QA: other
QA Notice: The following files contain insecure RUNPATHs
Please file a bug about this at https://bugs.gentoo.org/ with the maintainer of the package.
  /var/tmp/portage/sys-devel/gcc-4.9.4/image/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.4/libstdc++.so.6.0.20
    RPATH: /var/tmp/portage/sys-devel/gcc-4.9.4/work/build/x86_64-pc-linux-gnu/libstdc++-v3/../libvtv/.libs
  /var/tmp/portage/sys-devel/gcc-4.9.4/image/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.4/32/libstdc++.so.6.0.20
    RPATH: /var/tmp/portage/sys-devel/gcc-4.9.4/work/build/x86_64-pc-linux-gnu/32/libstdc++-v3/../libvtv/.libs


---

emerge --info attached. (I am running emerge in a chroot.)
Comment 1 Anthony Basile gentoo-dev 2017-01-10 20:45:09 UTC
I'm going to need more information because I've built gcc-4.9.4 on many different arches and never got this.  To confirm, can you give me what you get when you run `readelf -d /usr/lib/gcc/x86_64-pc-linux-gnu/4.9.4/libstdc++.so.6.0.20`
Comment 2 Vaibhav Niku 2017-01-11 02:53:19 UTC
Output of `readelf -d /usr/lib/gcc/x86_64-pc-linux-gnu/4.9.4/libstdc++.so.6.0.20`:

Dynamic section at offset 0x13e150 contains 31 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [ld-linux-x86-64.so.2]
 0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
 0x000000000000000e (SONAME)             Library soname: [libstdc++.so.6]
 0x0000000000000015 (DEBUG)              0x0
 0x000000000000000c (INIT)               0x5d9b8
 0x000000000000000d (FINI)               0xe4610
 0x0000000000000019 (INIT_ARRAY)         0x335608
 0x000000000000001b (INIT_ARRAYSZ)       616 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x335870
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x200
 0x0000000000000005 (STRTAB)             0x1c700
 0x0000000000000006 (SYMTAB)             0x5c48
 0x000000000000000a (STRSZ)              161895 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000003 (PLTGOT)             0x33f000
 0x0000000000000002 (PLTRELSZ)           15768 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x59c20
 0x0000000000000007 (RELA)               0x46318
 0x0000000000000008 (RELASZ)             80136 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffc (VERDEF)             0x45da8
 0x000000006ffffffd (VERDEFNUM)          32
 0x000000006ffffffe (VERNEED)            0x46208
 0x000000006fffffff (VERNEEDNUM)         4
 0x000000006ffffff0 (VERSYM)             0x43f68
 0x000000006ffffff9 (RELACOUNT)          896
 0x0000000000000000 (NULL)               0x0

Is the above info useful? What else can I do? If you wish, I'd recompile gcc.

Also, not directly relevant, but I couldn't find which program checked the just created libraries for insecure rpaths (and passed on the warning message). Can you please tell?
Comment 3 Anthony Basile gentoo-dev 2017-01-11 12:40:59 UTC
(In reply to Vaibhav Niku from comment #2)
> 
> Also, not directly relevant, but I couldn't find which program checked the
> just created libraries for insecure rpaths (and passed on the warning
> message). Can you please tell?

That was it.  Alternatively you can use `scanelf -r`.  I don't see why you're hitting this error.  To test, try running either on /usr/x86_64-pc-linux-gnu/binutils-bin/2.25.1/ld and you'll see a DT_RUNPATH entry.
Comment 4 Vaibhav Niku 2017-01-11 14:30:50 UTC
> That was it.
Thanks. 

Since the rpath/runpath field is empty for libstdc++.so.6.0.20, who created the emerge postinst warning (and when)?

If you are going to do some detective work, the following seems to be a clue (line 17426 of libstdc++-v3/configure of gcc-4.9.4 source):

  if test $enable_vtable_verify = yes; then
[...]
    VTV_CXXLINKFLAGS="-L${toplevel_builddir}/libvtv/.libs -Wl,--rpath -Wl,${toplevel_builddir}/libvtv/.libs"
  fi

(And the same line is present in libstdc++-v3/acinclude.m4.)

---
Output of `scanelf -r /usr/lib/gcc/x86_64-pc-linux-gnu/4.9.4/libstdc++.so.6.0.20`:
 TYPE   RPATH FILE 
ET_DYN   -   /usr/lib/gcc/x86_64-pc-linux-gnu/4.9.4/libstdc++.so.6.0.20
Comment 5 SpanKY gentoo-dev 2017-02-15 08:42:02 UTC

*** This bug has been marked as a duplicate of bug 582524 ***