From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1QFy0E-00033a-Jg for garchives@archives.gentoo.org; Sat, 30 Apr 2011 00:25:42 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 75A28E041F; Sat, 30 Apr 2011 00:25:34 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id 2CCD7E041F for ; Sat, 30 Apr 2011 00:25:34 +0000 (UTC) Received: from pelican.gentoo.org (unknown [66.219.59.40]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id AFC721B4008 for ; Sat, 30 Apr 2011 00:25:33 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by pelican.gentoo.org (Postfix) with ESMTP id C8ECA80504 for ; Sat, 30 Apr 2011 00:25:32 +0000 (UTC) From: "Zac Medico" To: gentoo-commits@lists.gentoo.org Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Zac Medico" Message-ID: Subject: [gentoo-commits] proj/portage:master commit in: bin/ X-VCS-Repository: proj/portage X-VCS-Files: bin/misc-functions.sh X-VCS-Directories: bin/ X-VCS-Committer: zmedico X-VCS-Committer-Name: Zac Medico X-VCS-Revision: e483cb18fde536893270e87aa39157da9ebda406 Date: Sat, 30 Apr 2011 00:25:32 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: quoted-printable X-Archives-Salt: X-Archives-Hash: 57da14f97b9675ededb5fbcb1d5089a9 commit: e483cb18fde536893270e87aa39157da9ebda406 Author: David James google com> AuthorDate: Sat Apr 30 00:21:58 2011 +0000 Commit: Zac Medico gentoo org> CommitDate: Sat Apr 30 00:21:58 2011 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=3Dproj/portage.git;a= =3Dcommit;h=3De483cb18 Check for references to ${ROOT} in install_qa_checks. When ROOT !=3D /, binaries that reference ROOT will load their dependencies from ROOT first rather than from the system-configured path. This is a problem because the ROOT will be / on the target system. Besides the above, this patch also fixes incorrect parsing of scanelf output, where we would treat the RPATHs returned by scanelf as the names of binaries. TEST=3DWhen "stricter" FEATURE is enabled, verify that emerge fails when an ebuild references broken rpaths referencing ROOT. When "stricter" FEATURE is not enabled, verify that such references are automatically fixed. Also verify that ebuilds with non-broken RPATHs (e.g. RPATHs referencing $ORIGIN/../lib) are not touched by the change. BUG=3Dchromium-os:14271 Change-Id: I4f29cc4ea9195a1255f080284da1f676e4a2c26b Review URL: http://codereview.chromium.org/6903153 --- bin/misc-functions.sh | 34 ++++++++++++++++++++++++++-------- 1 files changed, 26 insertions(+), 8 deletions(-) diff --git a/bin/misc-functions.sh b/bin/misc-functions.sh index af0cc27..c310998 100755 --- a/bin/misc-functions.sh +++ b/bin/misc-functions.sh @@ -184,16 +184,37 @@ install_qa_check() { unset PORTAGE_QUIET fi =20 - # Make sure we disallow insecure RUNPATH/RPATHs - # Don't want paths that point to the tree where the package was built - # (older, broken libtools would do this). Also check for null paths - # because the loader will search $PWD when it finds null paths. - f=3D$(scanelf -qyRF '%r %p' "${D}" | grep -E "(${PORTAGE_BUILDDIR}|: |= ::|^:|^ )") + # Make sure we disallow insecure RUNPATH/RPATHs. + # 1) References to PORTAGE_BUILDDIR are banned because it's a + # security risk. We don't want to load files from a + # temporary directory. + # 2) If ROOT !=3D "/", references to ROOT are banned because + # that directory won't exist on the target system. + # 3) Null paths are banned because the loader will search $PWD when + # it finds null paths. + local forbidden_dirs=3D"${PORTAGE_BUILDDIR}" + if [[ -n "$ROOT" ]] && [[ "$ROOT" !=3D "/" ]]; then + forbidden_dirs=3D"${forbidden_dirs} ${ROOT}" + fi + local dir=3D"" rpath_files=3D$(scanelf -F '%F:%r' -qBR "${D}") + f=3D"" + for dir in ${forbidden_dirs}; do + for l in $(echo "${rpath_files}" | grep -E ":${dir}|::|: "); do + f+=3D" ${l%%:*}\n" + if ! has stricter ${FEATURES}; then + vecho "Auto fixing rpaths for ${l%%:*}" + TMPDIR=3D"${dir}" scanelf -BXr "${l%%:*}" -o /dev/null + fi + done + done + # Reject set*id binaries with $ORIGIN in RPATH #260331 x=3D$( find "${D}" -type f \( -perm -u+s -o -perm -g+s \) -print0 | \ xargs -0 scanelf -qyRF '%r %p' | grep '$ORIGIN' ) + + # Print QA notice. if [[ -n ${f}${x} ]] ; then vecho -ne '\n' eqawarn "QA Notice: The following files contain insecure RUNPATHs" @@ -203,9 +224,6 @@ install_qa_check() { vecho -ne '\n' if [[ -n ${x} ]] || has stricter ${FEATURES} ; then insecure_rpath=3D1 - else - vecho "Auto fixing rpaths for ${f}" - TMPDIR=3D${PORTAGE_BUILDDIR} scanelf -BXr ${f} -o /dev/null fi fi =20