#544471 cap_sys_nice on executable leads to ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded: ignored

Package:
fakeroot
Source:
fakeroot
Description:
tool for simulating superuser privileges
Submitter:
Yaroslav Halchenko
Date:
2010-08-25 15:24:04 UTC
Severity:
normal
#544471#5
Date:
2009-08-31 19:35:29 UTC
From:
To:
I've used (you need libcap2-bin for setcap)
sudo setcap cap_sys_nice=eip /usr/bin/python2.5
to allow python scripts to adjust nice levels/choose scheduler.
Unfortunately it obscures fakeroot call, since then I get

$> fakeroot python
ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded: ignored.
Python 2.5.4 (r254:67916, Feb 18 2009, 03:00:47)
[GCC 4.3.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.


and that brakes pycentral:
$> fakeroot dh_pycentral -i
dh_pycentral: Unable to parse python version out of "ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded: ignored.
Python 2.5.4
".
since it relies on parsing stderr as it contains output from
 python --version
#544471#10
Date:
2009-09-01 03:45:05 UTC
From:
To:
I'm not sure what we can do here; I don't think we want to obscure the
fact that LD_PRELOAD has been disabled for security reasons.
#544471#15
Date:
2009-09-01 04:24:23 UTC
From:
To:
Hi Clint,

do you mean that executables with any capabilities (or even just
cap_sys_nice) set are considered insecure and LD_PRELOAD is explicitly
disallowed so LD_PRELOAD of fakeroot library fails?

N.B. fakeroot python whenever python has no cap_sys_nice is doing fine
#544471#20
Date:
2009-09-01 04:57:08 UTC
From:
To:
Yes, it is the same as with setuid/setgid programs.  The point is
that otherwise you could make a preload library to exploit any
capability by subverting one of the functions used by a privileged
binary.

I'm not sure how fakeroot-ng interacts with capabilities, but
perhaps it is more suitable for your use case.
#544471#25
Date:
2009-09-01 05:07:04 UTC
From:
To:
$> fakeroot-ng python --version
Python 2.5.4

cool -- thanks for the hint... seems to remain working fine within dpkg-buildpackage ;)

I just wonder now what to do with the bug -- apparently it is a feature ;) but
may be error message could be made more informative/relevant?
#544471#30
Date:
2009-09-01 07:01:17 UTC
From:
To:
Clint Adams wrote:
For SUID, fakeroot means that the program runs with privileges but
without fakeroot's wrapping. Fakeroot-ng means that program runs without
the (real) privileges, but with fakeroot-ng's wrapping. I'm not sure
about capabilities, but it's definitely worth giving it a try.

Shachar
#544471#35
Date:
2009-09-01 07:02:53 UTC
From:
To:
Yaroslav Halchenko wrote:
This is not a bug. It's a design limitation. I'm not even sure fakeroot
has the option of detecting when this limitation is about to trigger (at
least, not in a sane way).

Shachar
#544471#40
Date:
2010-08-25 15:13:07 UTC
From:
To:
I think this is not a bug of fakeroot but of python-central!
If dh_pycentral wants to find the Python version somewhere in stderr it
should use a damn good parser!
I suggest to use one of the following statements instead of trying to
parse stderr!

# New in version 2.3.
$ python -c "import platform;print(platform.python_version())"
2.6.6rc2

# New in version 2.0.
$ python -c "import sys;print(sys.version_info)"
(2, 6, 6, 'candidate', 2)

# New in version 2.3.
$ python -c "import platform;print(platform.python_version_tuple())"
('2', '6', '6rc2')

# New in version 1.5.2.
$ python -c "import sys;print(hex(sys.hexversion))"
0x20606c2

# Should not be used as of http://docs.python.org/library/sys.html
$ python -c "import sys;print(sys.version)"
2.6.6rc2 (r266rc2:84114, Aug 18 2010, 07:33:44)
[GCC 4.4.5 20100816 (prerelease)]

BTW.
Calling dh_pycentral from a non exeisting directory results into the
same error.