Ticket 2462 - handle QA_CHECK_RPATHS=Y mode for building RPMs on CentOS7
Summary: handle QA_CHECK_RPATHS=Y mode for building RPMs on CentOS7
Status: OPEN
Alias: None
Product: Slurm
Classification: Unclassified
Component: Build System and Packaging (show other tickets)
Version: 15.08.7
Hardware: Linux Linux
: 5 - Enhancement
Assignee: Tim Wickberg
QA Contact:
URL:
Depends on:
Blocks:
 
Reported: 2016-02-19 06:48 MST by Ben Matthews
Modified: 2017-11-13 10:43 MST (History)
2 users (show)

See Also:
Site: UCAR
Alineos Sites: ---
Atos/Eviden Sites: ---
Confidential Site: ---
Coreweave sites: ---
Cray Sites: ---
DS9 clusters: ---
HPCnow Sites: ---
HPE Sites: ---
IBM Sites: ---
NOAA SIte: ---
NoveTech Sites: ---
Nvidia HWinf-CS Sites: ---
OCF Sites: ---
Recursion Pharma Sites: ---
SFW Sites: ---
SNIC sites: ---
Tzag Elita Sites: ---
Linux Distro: ---
Machine Name:
CLE Version:
Version Fixed:
Target Release: ---
DevPrio: ---
Emory-Cloud Sites: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this ticket.
Description Ben Matthews 2016-02-19 06:48:06 MST 
Building RPMs from the distribution tarball fails on CentOS7 if you've used rpmdev-setuptree to setup your rpmbuild directory structure. This seems to be caused by the added rpath check that rpmdev-setuptree introduces via ~/.rpmmacros

cat ~/.rpmmacros

....
%__arch_install_post \
    [ "%{buildarch}" = "noarch" ] || QA_CHECK_RPATHS=1 ; \
    case "${QA_CHECK_RPATHS:-}" in [1yY]*) /usr/lib/rpm/check-rpaths ;; esac \
    /usr/lib/rpm/check-buildroot


This is obviously easy to work around, but could perhaps be a security issue if someone happened to install SLURM in just the right place and had a very creative user. 

rpmbuild -ta -D '%_with_mysql 1' -D '%_with_lua 1' -D '%_with_hwloc 1' slurm-15.08.7.tar.bz2

....

ERROR   0001: file '/usr/lib64/slurm/auth_munge.so' contains a standard rpath '/usr/lib64' in [/usr/lib64]
ERROR   0001: file '/usr/lib64/slurm/crypto_munge.so' contains a standard rpath '/usr/lib64' in [/usr/lib64]

▽
ERROR   0001: file '/usr/lib64/slurm/mpi_mvapich.so' contains a standard rpath '/usr/lib64' in [/usr/lib64]
ERROR   0001: file '/usr/lib64/slurm/slurmctld_nonstop.so' contains a standard rpath '/usr/lib64' in [/usr/lib64]
ERROR   0004: file '/usr/lib64/perl5/auto/Slurm/Slurm.so' contains an insecure rpath '../../../../src/api/.libs' in [../../../../src/api/.libs:/usr/lib]
ERROR   0001: file '/usr/lib64/perl5/auto/Slurm/Slurm.so' contains a standard rpath '/usr/lib' in [../../../../src/api/.libs:/usr/lib]
ERROR   0004: file '/usr/lib64/perl5/auto/Slurmdb/Slurmdb.so' contains an insecure rpath '../../../../src/db_api/.libs' in [../../../../src/db_api/.libs:/usr/lib]
ERROR   0001: file '/usr/lib64/perl5/auto/Slurmdb/Slurmdb.so' contains a standard rpath '/usr/lib' in [../../../../src/db_api/.libs:/usr/lib]
ERROR   0001: file '/usr/sbin/slurmd' contains a standard rpath '/usr/lib64' in [/usr/lib64]
ERROR   0001: file '/usr/sbin/slurmstepd' contains a standard rpath '/usr/lib64' in [/usr/lib64]
error: Bad exit status from /var/tmp/rpm-tmp.JR7RBJ (%install) 


This is also reproducible on several older releases. 

If it matters:

cat /etc/redhat-release
CentOS Linux release 7.0.1406 (Core)

rpm -qa | grep rpmdev
rpmdevtools-8.3-5.el7.noarch
Comment 1 Sergey Meirovich 2016-02-24 22:48:01 MST 
The same for me on RHEL6
Comment 3 Tim Wickberg 2017-01-18 13:55:01 MST 
Updating description and component fields, and reclassifying as an enhancement request.