Description of problem: setuid/setgid binaries arent stripped by brp-strip etc Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1. rpmbuild --rebuild an rom with setuid/setgid binary 2. 3. Actual results: Expected results: Additional info: Fix appears to have been already applied to find-debuginfo.sh but not brp-strip*
Created attachment 98397 [details] changes sed regex in brpstrip etc to ignore stuff before ELF chnages from [
Consider for U6
Created attachment 117532 [details] Another regexp approach I noticed this today, too, and created a patch for it before noticing this bug. Here's my version of it for reference, it uses a slightly stricter regexp which can be seen as a good or bad thing...
Oh, and BTW, I noticed this on FC4.
One more thing, just so it's not forgotten if this is applied sometime: Stripping setuid/setgid binaries appears to lose the setuid/setgid bits, which could silently break existing packages. That should be taken care of in the update.
This has been fixed for quite a while in upstream rpm. Ville: Using %attr in spec files is a far more reliable approach to packaging executables with setuid/setgid bits than working around quirky tool side-effects. UPSTREAM
Agreed.
This bug is filed against RHEL 3, which is in maintenance phase. During the maintenance phase, only security errata and select mission critical bug fixes will be released for enterprise products. Since this bug does not meet that criteria, it is now being closed. For more information of the RHEL errata support policy, please visit: http://www.redhat.com/security/updates/errata/ If you feel this bug is indeed mission critical, please contact your support representative. You may be asked to provide detailed information on how this bug is affecting you.