{"action":"closed","issue":{"url":"https://api.github.com/repos/haskell/cabal/issues/4025","repository_url":"https://api.github.com/repos/haskell/cabal","labels_url":"https://api.github.com/repos/haskell/cabal/issues/4025/labels{/name}","comments_url":"https://api.github.com/repos/haskell/cabal/issues/4025/comments","events_url":"https://api.github.com/repos/haskell/cabal/issues/4025/events","html_url":"https://github.com/haskell/cabal/issues/4025","id":184622600,"number":4025,"title":"Cabal-HEAD/ghc-HEAD injects insecure RUNPATHs to a temp build directory in dynamic binaries using library of the same package","user":{"login":"trofi","id":226650,"avatar_url":"https://avatars.githubusercontent.com/u/226650?v=3","gravatar_id":"","url":"https://api.github.com/users/trofi","html_url":"https://github.com/trofi","followers_url":"https://api.github.com/users/trofi/followers","following_url":"https://api.github.com/users/trofi/following{/other_user}","gists_url":"https://api.github.com/users/trofi/gists{/gist_id}","starred_url":"https://api.github.com/users/trofi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trofi/subscriptions","organizations_url":"https://api.github.com/users/trofi/orgs","repos_url":"https://api.github.com/users/trofi/repos","events_url":"https://api.github.com/users/trofi/events{/privacy}","received_events_url":"https://api.github.com/users/trofi/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/haskell/cabal/labels/type:%20bug","name":"type: bug","color":"e99695"}],"state":"closed","locked":false,"assignee":{"login":"ezyang","id":13564,"avatar_url":"https://avatars.githubusercontent.com/u/13564?v=3","gravatar_id":"","url":"https://api.github.com/users/ezyang","html_url":"https://github.com/ezyang","followers_url":"https://api.github.com/users/ezyang/followers","following_url":"https://api.github.com/users/ezyang/following{/other_user}","gists_url":"https://api.github.com/users/ezyang/gists{/gist_id}","starred_url":"https://api.github.com/users/ezyang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ezyang/subscriptions","organizations_url":"https://api.github.com/users/ezyang/orgs","repos_url":"https://api.github.com/users/ezyang/repos","events_url":"https://api.github.com/users/ezyang/events{/privacy}","received_events_url":"https://api.github.com/users/ezyang/received_events","type":"User","site_admin":false},"assignees":[{"login":"ezyang","id":13564,"avatar_url":"https://avatars.githubusercontent.com/u/13564?v=3","gravatar_id":"","url":"https://api.github.com/users/ezyang","html_url":"https://github.com/ezyang","followers_url":"https://api.github.com/users/ezyang/followers","following_url":"https://api.github.com/users/ezyang/following{/other_user}","gists_url":"https://api.github.com/users/ezyang/gists{/gist_id}","starred_url":"https://api.github.com/users/ezyang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ezyang/subscriptions","organizations_url":"https://api.github.com/users/ezyang/orgs","repos_url":"https://api.github.com/users/ezyang/repos","events_url":"https://api.github.com/users/ezyang/events{/privacy}","received_events_url":"https://api.github.com/users/ezyang/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/haskell/cabal/milestones/39","html_url":"https://github.com/haskell/cabal/milestones/2.0","labels_url":"https://api.github.com/repos/haskell/cabal/milestones/39/labels","id":1985792,"number":39,"title":"2.0","description":"A contributor has agreed to steward this feature for the current feature-release cycle.","creator":{"login":"ezyang","id":13564,"avatar_url":"https://avatars.githubusercontent.com/u/13564?v=3","gravatar_id":"","url":"https://api.github.com/users/ezyang","html_url":"https://github.com/ezyang","followers_url":"https://api.github.com/users/ezyang/followers","following_url":"https://api.github.com/users/ezyang/following{/other_user}","gists_url":"https://api.github.com/users/ezyang/gists{/gist_id}","starred_url":"https://api.github.com/users/ezyang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ezyang/subscriptions","organizations_url":"https://api.github.com/users/ezyang/orgs","repos_url":"https://api.github.com/users/ezyang/repos","events_url":"https://api.github.com/users/ezyang/events{/privacy}","received_events_url":"https://api.github.com/users/ezyang/received_events","type":"User","site_admin":false},"open_issues":32,"closed_issues":144,"state":"open","created_at":"2016-09-06T09:51:52Z","updated_at":"2016-10-27T09:03:10Z","due_on":"2016-11-30T00:00:00Z","closed_at":null},"comments":9,"created_at":"2016-10-22T10:22:13Z","updated_at":"2016-10-27T09:03:09Z","closed_at":"2016-10-27T09:03:09Z","body":"Let's look at small-ish systemwide-installed idiii package. I'm installing it the same way on 2 systems as:\r\n```\r\n$ mkdir /tmp/foo\r\n$ cd /tmp/foo\r\n$ cabal sandbox init\r\n$ cabal install idiii --reinstall --enable-executable-dynamic\r\n```\r\n\r\nGood system (ghc-8.0.1/Cabal-1.24):\r\n```\r\nreadelf -a ./.cabal-sandbox/bin/read-idiii | grep idiii\r\n 0x0000000000000001 (NEEDED)             Shared library: [libHSidiii-0.1.3.3-2mhwbeokSof8SZHBkN2jio-ghc8.0.1.so]\r\n 0x000000000000001d (RUNPATH)            Library runpath: [/tmp/foo/.cabal-sandbox/lib/x86_64-linux-ghc-8.0.1/idiii-0.1.3.3-2mhwbeokSof8SZHBkN2jio:...]\r\n```\r\n\r\nBad system (ghc-8.1.20161022/Cabal-HEAD):\r\n```\r\nsf foo # readelf -a ./.cabal-sandbox/bin/read-idiii | grep idiii\r\n 0x0000000000000001 (NEEDED)             Shared library: [libHSidiii-0.1.3.3-AFJIiuU3Qs1GUtsFo9lbmP-ghc8.1.20161022.so]\r\n 0x000000000000001d (RUNPATH)            Library runpath: [/tmp/foo/.cabal-sandbox/lib/x86_64-linux-ghc-8.1.20161022:...:/tmp/cabal-tmp-31011/idiii-0.1.3.3/dist/dist-sandbox-6b4809b5/build:...]\r\n```\r\n\r\nNote additional RUNPATH to a temp build directory. Gentoo package manager flags that entry as insecure:\r\n```\r\n * QA Notice: The following files contain insecure RUNPATHs\r\n *  Please file a bug about this at https://bugs.gentoo.org/\r\n *  with the maintainer of the package.\r\n *   /dev/shm/portage/dev-haskell/idiii-0.1.3.3/image/usr/bin/read-idiii\r\n *     RPATH: /usr/lib64/hunit-1.3.1.2/ghc-8.1.20161022:/usr/lib64/missingh-1.4.0.1/ghc-8.1.20161022:/usr/lib64/ghc-8.1.20161022/array-0.5.1.1:/usr/lib64/ghc-8.1.20161022/base-4.9.0.0:/usr/lib64/ghc-8.1.20161022/binary-0.8.3.0:/usr/lib64/ghc-8.1.20161022/bytestring-0.10.8.1:/usr/lib64/ghc-8.1.20161022/containers-0.5.7.1:/usr/lib64/data-accessor-0.2.2.7/ghc-8.1.20161022:/usr/lib64/ghc-8.1.20161022/deepseq-1.4.2.0:/usr/lib64/ghc-8.1.20161022/directory-1.2.6.2:/usr/lib64/ghc-8.1.20161022/filepath-1.4.1.0:/usr/lib64/ghc-8.1.20161022/ghc-prim-0.5.0.0:/usr/lib64/hslogger-1.2.10/ghc-8.1.20161022:/dev/shm/portage/dev-haskell/idiii-0.1.3.3/work/idiii-0.1.3.3/dist/build:/usr/lib64/ghc-8.1.20161022/integer-gmp-1.0.0.1:/usr/lib64/mtl-2.2.1/ghc-8.1.20161022:/usr/lib64/network-2.6.3.1/ghc-8.1.20161022:/usr/lib64/old-locale-1.0.0.7/ghc-8.1.20161022:/usr/lib64/old-time-1.1.0.3/ghc-8.1.20161022:/usr/lib64/parsec-3.1.11/ghc-8.1.20161022:/usr/lib64/polyparse-1.12/ghc-8.1.20161022:/usr/lib64/ghc-8.1.20161022/process-1.4.2.0:/usr/lib64/random-1.1/ghc-8.1.20161022:/usr/lib64/regex-base-0.93.2/ghc-8.1.20161022:/usr/lib64/regex-compat-0.95.1/ghc-8.1.20161022:/usr/lib64/regex-posix-0.95.2/ghc-8.1.20161022:/usr/lib64/ghc-8.1.20161022/rts:/usr/lib64/text-1.2.2.1/ghc-8.1.20161022:/usr/lib64/ghc-8.1.20161022/time-1.6.0.1:/usr/lib64/ghc-8.1.20161022/transformers-0.5.2.0:/usr/lib64/ghc-8.1.20161022/unix-2.7.2.0:/usr/lib64/utf8-string-1.0.1.1/ghc-8.1.20161022:/usr/lib64/x86_64-linux-ghc-8.1.20161022\r\n```\r\n\r\nI use `/dev/shm/` as a temp directory in that system.\r\n\r\nAdding @ezyang and @dcoutts for visibility."}}
{"actor":{"display_login":"ezyang"}}