From mboxrd@z Thu Jan 1 00:00:00 1970
Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org)
by finch.gentoo.org with esmtp (Exim 4.60)
(envelope-from <gentoo-commits+bounces-340494-garchives=archives.gentoo.org@lists.gentoo.org>)
id 1QFy0E-00033a-Jg
for garchives@archives.gentoo.org; Sat, 30 Apr 2011 00:25:42 +0000
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 75A28E041F;
Sat, 30 Apr 2011 00:25:34 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
by pigeon.gentoo.org (Postfix) with ESMTP id 2CCD7E041F
for <gentoo-commits@lists.gentoo.org>; Sat, 30 Apr 2011 00:25:34 +0000 (UTC)
Received: from pelican.gentoo.org (unknown [66.219.59.40])
(using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id AFC721B4008
for <gentoo-commits@lists.gentoo.org>; Sat, 30 Apr 2011 00:25:33 +0000 (UTC)
Received: from localhost.localdomain (localhost [127.0.0.1])
by pelican.gentoo.org (Postfix) with ESMTP id C8ECA80504
for <gentoo-commits@lists.gentoo.org>; Sat, 30 Apr 2011 00:25:32 +0000 (UTC)
From: "Zac Medico" <zmedico@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Zac Medico" <zmedico@gentoo.org>
Message-ID: <e483cb18fde536893270e87aa39157da9ebda406.zmedico@gentoo>
Subject: [gentoo-commits] proj/portage:master commit in: bin/
X-VCS-Repository: proj/portage
X-VCS-Files: bin/misc-functions.sh
X-VCS-Directories: bin/
X-VCS-Committer: zmedico
X-VCS-Committer-Name: Zac Medico
X-VCS-Revision: e483cb18fde536893270e87aa39157da9ebda406
Date: Sat, 30 Apr 2011 00:25:32 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: quoted-printable
X-Archives-Salt:
X-Archives-Hash: 57da14f97b9675ededb5fbcb1d5089a9
commit: e483cb18fde536893270e87aa39157da9ebda406
Author: David James <davidjames <AT> google <DOT> com>
AuthorDate: Sat Apr 30 00:21:58 2011 +0000
Commit: Zac Medico <zmedico <AT> gentoo <DOT> org>
CommitDate: Sat Apr 30 00:21:58 2011 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=3Dproj/portage.git;a=
=3Dcommit;h=3De483cb18
Check for references to ${ROOT} in install_qa_checks.
When ROOT !=3D /, binaries that reference ROOT will load their
dependencies from ROOT first rather than from the system-configured
path. This is a problem because the ROOT will be / on the target
system.
Besides the above, this patch also fixes incorrect parsing of scanelf
output, where we would treat the RPATHs returned by scanelf as the
names of binaries.
TEST=3DWhen "stricter" FEATURE is enabled, verify that emerge
fails when an ebuild references broken rpaths referencing
ROOT. When "stricter" FEATURE is not enabled, verify that such
references are automatically fixed. Also verify that ebuilds
with non-broken RPATHs (e.g. RPATHs referencing $ORIGIN/../lib)
are not touched by the change.
BUG=3Dchromium-os:14271
Change-Id: I4f29cc4ea9195a1255f080284da1f676e4a2c26b
Review URL: http://codereview.chromium.org/6903153
---
bin/misc-functions.sh | 34 ++++++++++++++++++++++++++--------
1 files changed, 26 insertions(+), 8 deletions(-)
diff --git a/bin/misc-functions.sh b/bin/misc-functions.sh
index af0cc27..c310998 100755
--- a/bin/misc-functions.sh
+++ b/bin/misc-functions.sh
@@ -184,16 +184,37 @@ install_qa_check() {
unset PORTAGE_QUIET
fi
=20
- # Make sure we disallow insecure RUNPATH/RPATHs
- # Don't want paths that point to the tree where the package was built
- # (older, broken libtools would do this). Also check for null paths
- # because the loader will search $PWD when it finds null paths.
- f=3D$(scanelf -qyRF '%r %p' "${D}" | grep -E "(${PORTAGE_BUILDDIR}|: |=
::|^:|^ )")
+ # Make sure we disallow insecure RUNPATH/RPATHs.
+ # 1) References to PORTAGE_BUILDDIR are banned because it's a
+ # security risk. We don't want to load files from a
+ # temporary directory.
+ # 2) If ROOT !=3D "/", references to ROOT are banned because
+ # that directory won't exist on the target system.
+ # 3) Null paths are banned because the loader will search $PWD when
+ # it finds null paths.
+ local forbidden_dirs=3D"${PORTAGE_BUILDDIR}"
+ if [[ -n "$ROOT" ]] && [[ "$ROOT" !=3D "/" ]]; then
+ forbidden_dirs=3D"${forbidden_dirs} ${ROOT}"
+ fi
+ local dir=3D"" rpath_files=3D$(scanelf -F '%F:%r' -qBR "${D}")
+ f=3D""
+ for dir in ${forbidden_dirs}; do
+ for l in $(echo "${rpath_files}" | grep -E ":${dir}|::|: "); do
+ f+=3D" ${l%%:*}\n"
+ if ! has stricter ${FEATURES}; then
+ vecho "Auto fixing rpaths for ${l%%:*}"
+ TMPDIR=3D"${dir}" scanelf -BXr "${l%%:*}" -o /dev/null
+ fi
+ done
+ done
+
# Reject set*id binaries with $ORIGIN in RPATH #260331
x=3D$(
find "${D}" -type f \( -perm -u+s -o -perm -g+s \) -print0 | \
xargs -0 scanelf -qyRF '%r %p' | grep '$ORIGIN'
)
+
+ # Print QA notice.
if [[ -n ${f}${x} ]] ; then
vecho -ne '\n'
eqawarn "QA Notice: The following files contain insecure RUNPATHs"
@@ -203,9 +224,6 @@ install_qa_check() {
vecho -ne '\n'
if [[ -n ${x} ]] || has stricter ${FEATURES} ; then
insecure_rpath=3D1
- else
- vecho "Auto fixing rpaths for ${f}"
- TMPDIR=3D${PORTAGE_BUILDDIR} scanelf -BXr ${f} -o /dev/null
fi
fi
=20