Improve handling of hardened toolchains by only disabling PIE/etc... in the purgatory subdir.

Package-Manager: portage-2.2.18/cvs/Linux x86_64
Manifest-Sign-Key: 0xD2E96200

5 files changed, 121 insertions, 30 deletions

diff --git a/sys-apps/kexec-tools/ChangeLog b/sys-apps/kexec-tools/ChangeLog
index 2e1d1b720744..69d166829775 100644
--- a/sys-apps/kexec-tools/ChangeLog
+++ b/sys-apps/kexec-tools/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for sys-apps/kexec-tools
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/kexec-tools/ChangeLog,v 1.65 2015/04/07 14:45:57 jlec Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/kexec-tools/ChangeLog,v 1.66 2015/04/15 08:37:14 vapier Exp $
+
+*kexec-tools-2.0.9-r1 (15 Apr 2015)
+
+  15 Apr 2015; Mike Frysinger <vapier@gentoo.org>
+  +files/kexec-tools-2.0.9-hardened.patch, +kexec-tools-2.0.9-r1.ebuild,
+  kexec-tools-9999.ebuild:
+  Improve handling of hardened toolchains by only disabling PIE/etc... in the
+  purgatory subdir.
 
 *kexec-tools-2.0.9 (11 Feb 2015)
 
diff --git a/sys-apps/kexec-tools/Manifest b/sys-apps/kexec-tools/Manifest
index 554d3608f7bb..b863d38f58cc 100644
--- a/sys-apps/kexec-tools/Manifest
+++ b/sys-apps/kexec-tools/Manifest
@@ -1,11 +1,12 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
+Hash: SHA256
 
 AUX 90_kexec 199 SHA256 0200acc44dfe1108bbc0123ccf3e41ad73d9709c13e8d5ef6333fdff575d3dd8 SHA512 31837eb7df9b5c9b63c5f500e55fb584e315ac20f328490ff812a265f1a01604724bf4699f142255f7c5fa78cb2d8f2d6220a91961ac90df644b5d545d47ca39 WHIRLPOOL de8bef4f71012ec2868b705dc2943cea27fc66e0987474bcf6269abc02a6409c7868a17ba7dc24a1016066cd6f65bed3179f83e3cc9b247c6a19f126905e7797
 AUX README.Gentoo 937 SHA256 6ddecc284c89f031792eb31455460a0acece4b3b6103b9ceb8ad79052d7ab42d SHA512 f082763692def43a97866b88443daf08a2bc1b0dccdc90160d12effa16e1293d8db6935c72ca9dd5502f844078241cbecdfde15b6e8f67a2cca8f3e89f14e654 WHIRLPOOL d8692b1599ef938e048dc42f4aa3ab73f644c68394243e16834b971772919656ebf95554e7d7226f17a86cc42e390c4a5b7cb611280e076e3dd2e02e3c315846
 AUX kexec-tools-2.0.0-respect-LDFLAGS.patch 293 SHA256 0f7e6cf0ef6bc4ffd898009f3e8d9952fcb2abff7537776023b2194019c885e5 SHA512 c5213462a1e543a357c128af51c9da260fcfa5bcddd9d6bd2fadc84f0456722752e2e7a5584de84d1beca580e07e40ec424eb2577d604beb186403975f7fcd1e WHIRLPOOL 79fe97189297b5d5d87f661ce30b88dee83972157ea99f153f0d0a3f33417e0da6f488c21b16fdcb777a68657fcff88283e49cf6ff2018784c660bc2b88904fb
 AUX kexec-tools-2.0.4-disable-kexec-test.patch 473 SHA256 95d7d6756aa438af926358dc9e6c964e11201a7c19b2ed2b457f013313d47558 SHA512 c7fe9176db7c3f9c84add1c263c5a695684bf1db55d47152534f0bbb97c084ad5d3f2090307d0bdfcf5622fa810aca3c104f81b3d24baa76f42d3f32d1d4bbad WHIRLPOOL 3b0cebf5aa1cd923c7867d588af9b74002b6266d3065e7c59061c5b510ad1f8aea0e1fa78d2f17a94bf25424db1d566a5648530e9ce5044ead28407b7f6135c5
 AUX kexec-tools-2.0.4-out-of-source.patch 816 SHA256 f86f053efcd210f7919f458a52721ae3704a905488935a66f67a039bd915d6bf SHA512 4839800f99e2bdb7dfbf3aa1f3ad795feb63b4e493812a50d4baa839a27b5e96319c4e848969cbcedf627a32ed5fbfb312461c2ac89b73daaa7f8f680f35f504 WHIRLPOOL ec72be471f55d26f18152d6c92c85974c9e2c89021566d2311e517b880846c94d19057f69d055de74954efdef9301fd356b87ff1647467d425bb755c54f338bb
+AUX kexec-tools-2.0.9-hardened.patch 663 SHA256 16c657d6c67925902272e204015b73ae6d2475a54231613a475aab5864f8aa71 SHA512 3ce9a829cb2f4971fcbcd2a300bd398483b88117fa79a77c330d4d295b5126c7474b98b2695b532296a97a76ceb7d6b84e12f53cb5eccdc8a05292bab2529501 WHIRLPOOL 7a252bf0a6142f537235e8c44a9e414398375a164f19f413b4af9d4e1106ce4d7c77bbfc666de8b4c2e819b95da47f6a33791b7bda3e574ffbfa243d5c6fd204
 AUX kexec.conf 340 SHA256 19d6a02cf0bf3cebf03dc81c3b9fd5f517815ab1060f67cb9019b7e9653a7fc0 SHA512 66beb57ee13dba70f75f12326643270a0c888e178fdfca8ba7a566a874707aebe2afebb6ceae976dfb0aaf3135048daad6277e70580e4c7911b9ddbf74e4f00a WHIRLPOOL b77bb59ab16ea67690fa3e551995510b0fb0d82f7e2f10f9ed7d7815eb1e498cdda9ea667d2648b62cd1ae86a3ab67ae2ca1abd1fd2b9fce376b64ac41fb8725
 AUX kexec.conf-2.0.4 1013 SHA256 4c1b7e4651cd4be342db48389bc560589c896004f0274f8aba35a92fcd790531 SHA512 96db2834454aa4d038061e9b1f918932da3d3054021487425d0f70c6ad32096b9433ae2f3921e83196b23af901c32e591df3d6a84a6d14e064608d8ad895a599 WHIRLPOOL 3041644bf1688ac6c89e6078adcee987913bce124ea3ae4a2ce342c0956f319cccae93aabf39ee4aed9f23812e575f7f06cbf110bf39d9d961a1a19294108f27
 AUX kexec.conf-9999 397 SHA256 59bd15f8a0be3a41a457e61cfbb3520252773ed6422b9b223b347dfeb54f152a SHA512 2c31ae780b6fd16f3a07857d30415fef50ca45297c639234eb6fad871e80819e73196d389a3e473bc9685569ce8688408428ee25a1328c16d1bf729912d63496 WHIRLPOOL 0bba1d957fff2d6eea1ffb0efd53eb2546df61a4209c14e8000ea00f3353ae57623188f50cfb38b614cacecf2af2cb83d1f13b8583c6229dbcac2e3a0e15db43
@@ -18,26 +19,25 @@ DIST kexec-tools-2.0.8.tar.xz 272648 SHA256 f3abe96fa0793e63936725a4471429f07003
 DIST kexec-tools-2.0.9.tar.xz 272728 SHA256 8ae34a9ceb76350954e1e1e3ca9ab51da15862bd5f2fd14392208e60fb454f71 SHA512 b58f8f0872f1a6a3a93bc67068d7035c4b39e985dafadc573585d92259ff289bf98d5a567293a5286668315ac2158b232919e0c6847fdefc68b7ecbcfab5109e WHIRLPOOL 840d9d17ce9facc131736ef52acabb03bcc6d21f671896ff5603bd8d6bd629519e169ca878a127b863235b236dafd3b29f598424b272f599503bb3f1a5f70050
 EBUILD kexec-tools-2.0.4-r2.ebuild 1759 SHA256 aa03fdec552c341d722dd131020c7a8066edf952c5f1837837204c9d266aa83b SHA512 4dd0a8dd83c2f17859d39c0073a215e95fd1927ea403da974a4665605744518c76e2df9dee0bd12a0c68fdcb4f181f5cc5a93d626a57c3df0b2ef8555442e15a WHIRLPOOL cd2c9b2e3f8569a9c17e9291dc624b9f2746d6d91c35987fdff91537b848794fef194a7056f7ad3c39dee34f4158996c2e998a592c0864d31708312e5df90788
 EBUILD kexec-tools-2.0.8.ebuild 1787 SHA256 589f6188d6f56ee44c4c749121012611d3c3b9f869287163732930370edda65c SHA512 11887198b9ef47b3fe6283650e7fe03e0bf289e94023cc660e5ac39bb324410a969d911aaad0892140216342c2f8b978e7b179a20a5591f5cf63ab4cc2a46f87 WHIRLPOOL 28a901c6376fc17778ca014e6239de2b4f8aaa4627574c9af93c235bbe00cd25952fd862147d5e42ffe5363a854c5570a1e7eb053c6d65ecb0b057d1003edf62
+EBUILD kexec-tools-2.0.9-r1.ebuild 1689 SHA256 35d754e6c766277931bbec2f356025761593b8a325446a40510d684d38717391 SHA512 7db61f966ae0fa382c7ccfe155acaa7fbbf667b6679bad8b5633aa636d8915695f2196e9df2cea2bb5049c8459c1f7e75c0704ab6f10a362664c0089ce3ae1b7 WHIRLPOOL 35d0db6cfb488a2cb95f4bdec50283c71f362608cbe13be7e6bf0fc034aa7cfa6b86bbacd3ec2cbc811a7a82158986c8fe5744be66e9eec7a310261e77dc3919
 EBUILD kexec-tools-2.0.9.ebuild 1784 SHA256 e8b148cb76784da0fe8579f47caf9f5f62ceaf9b80de1dbf24d1a0bc58569cbd SHA512 91df4fb479a8234366df58c03f59af5ee5e4e8dd2ead2366c0f557e5a46ff9871151a95409d36b14f05eecede879e5637df139961259099199aac888434fcc5b WHIRLPOOL 63feb37bfb7db52b3f9e2304091799736d3fccbe947e3f9eeef5d3a963c963902176e2f51bf57ce823a1cf6ac50c5bd544d3ac9e8fd7d38828e2bd5c361272f8
-EBUILD kexec-tools-9999.ebuild 1833 SHA256 4aa2f209d4b4ee34193c2393f6c87f6e82b26dbe6bc368de46c605f6ff3c9a9b SHA512 f75ac1914b4216f85453abb29d716b5ab6ca611514639951ab245caac3c87fb5cd790f525d417c5f4cd8f46893c8db623f7f3873da51f070b5837a3a4d2db331 WHIRLPOOL 9971dd2a39147a599a793181d2b419a6219a06cda823657ee3f79f6da8f61c875c0bb69c41086d0539522ab66ae2618bd261f7a9335b5223b8f4af61f4980a25
-MISC ChangeLog 13299 SHA256 deed491d396c2f59109624752b23b0be2219ca1305751ca9ae08e697ea7e7459 SHA512 4e5432cf7aa8fe71e67656a6143460da43a0e65daa9e08d5eb91ca92a0f0416c5bbeea86cb0db650455178f0ef81c07b9e9b684fdbcccc3fd39b98f32d3cbfa7 WHIRLPOOL d3b41649f1a4de5b155acc35ad1c7284785ff03774284d87cdfe568014daf78515319d20ab64b4fed1025b207875ebdf0aceec05783cb4bc5800870564987bf4
+EBUILD kexec-tools-9999.ebuild 1734 SHA256 25df011a695110d6ab0a31ef53aaa683fcf9649096c5dccbc628fa978b207bc3 SHA512 672edace50b2b66cba86031eb55d47f996ba6fac93c0bdbf8a4cd80b59591de2582a8000d5b65745fe111c2e437ab18c00be3a5c670559ee31af074ffb78251b WHIRLPOOL 8afd51456a21394bc958efb930b79ffc9d61a938f863e2075184f1c09aa29b0080d9965cf6b9600c72c3011bd8a235d84e1c1ab8cfd425d779d4c43dd1536000
+MISC ChangeLog 13587 SHA256 8b970a9a79e4917d003bf700e05d201017536f05d5bc9326342695cfab735f90 SHA512 2ffe7948a355434ff90d7abec741a90219de2f045bc3393ca0b39dbcba1d99c00acb326b1a6edbdf31a49d4b381f3aad8a4f0a190c597e4a4ebccdec9f269ba5 WHIRLPOOL e288cb435f244141232f94b6fe5e510e70ce17cdf525877122a5764cd61a27d87888421257298a985b37742cd7e26a13f76296648592177db87ee87bc7666244
 MISC metadata.xml 459 SHA256 9d84c6af2cbf56cf70a11bf399f623133b5da428fd00b6921e512195bce98c36 SHA512 c4def015a91deea9e8ca7269758d6d00d2d67ea242b33ffa327a0776f7c8a89d63890bd45d2377fdcbaa9f57f832418eed6bb543c58c1fd0ba5ca3fdb4987dba WHIRLPOOL 6218bde0407385cb46fc9d469e965f4933562f9be640916a882b21a8c7fbedb00ab12b466c660a1dc2354e5259ddecae01724ebac5eadfdf4bc385e5be2fe121
 -----BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0
+Version: GnuPG v2
 
-iQJ8BAEBCgBmBQJVI+2mXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
-ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQyQ0JDQjFGMzBDQ0UxMjFGNENDNDgxMDdC
-OUQ0RjIzMUJEMTU1OEFCAAoJELnU8jG9FVirdsAP/3UCbu+xbqWsJh/uLff2Bm6g
-m3Wy4eydCd6sDDikcdyTLviLuFxEGc5CgrdLj35P7nPI3VbvfMRMEphXwcDM5UaD
-UFuFW5CwR7MEnO+R3UYl+oyNDUmiB3xNjm4qwWNsEIQIhVEslzVYBmWUO62Mnts2
-UpIwGF7bxkIiyeG4W4O9H0qL6itrxjUbASN/5IsW/ckKpdrlpfmtzSHCVdCsQ0Iv
-TYbSftCW04jXP3bye4eSjGdYJGUO9PAZcpI8s5WSJBSPnO3hjZ62TVO003KPHofd
-76M5KeED2OhNKzGvmNDIhgWo1cgF4whuZQXmJRF0lPB3/bB30qsSEyxRV6Ky9388
-ViMvwlr0r9kGRpSHN+FhaxEvu6gHNvI1lo9akTESmWG0Y+N/vR11obAU1DwOBnzy
-relEYlDqW5Jj4hnNnLRpI+b8kUCBVJwqocHIP+x+4/9iZ9kMG5jSavUVLAbJhdKv
-RobCX07PsfbxE+3fxwIKhnYvZ3m7K9bvmCuotkdo6ESExBoVBdbZy7bHqKajLsm9
-TKmCRGUoLt52IfsP0quptW4hmBCELk8OucqvmFxqvxN2HY2oGLQe2meiSdGVL2vo
-RjLvZNrv49y1D0OPAQwvoxEqk2gUN1x1tvmKacBmNz2qC341AAE9SpdMFXG1l8nH
-BRESHvN7ZqM7BHcSnLp6
-=fNO7
+iQIcBAEBCAAGBQJVLiM7AAoJEPGu1DbS6WIAB/YQAJqVgK6mDqNWbS8sWGwPcuG0
+5r467YNzILYONCsLjMXnpGFCzoiCfGEIYHCJUdr6E4C9tUBugB2kFIIORpVq1njF
+8U7KOSfrBiTPNXAI31WxLGX/v+gTNIzKPJFIYI10SF8Kk6LscBEWvqbHnaJD0/WU
+3bX+QNazGZ8YKWiv+tgybqxLqVjbzwyq25QV3QcWyKw4PcfA+96YQg3nGYFVXG3+
+GQcKvSL6PC73e13ywGQKTMTJVY4xol0NJSxMUF3BziVirjVXze1CsqsUjXJ7m7gA
+ZswsSAac+ZoRg6GW8Igdvdb9Cqscv/wiXi/JQiJyiI3aOvs/KAmv2ialvmILDaI7
+g84c0jCEAAR3AdU1qdGx4M0DR8WsYGL62myHNDKC0AD+IP1BOhm4L3zZK8gXk07i
+GLuENzYzBNv4NjBpEUCz3+gb5MkBU8tVitlmdU9CfVXJDFodSNrGd2BQEMbim8Pu
+40e7Nt93SgVbOE542gz634JUNBu/RM458IKjXMXJcfTvukq9TsAyd24w/VAtEDmN
+SEBj++SriAS3bFxTP7JLocgKgmSB/XQTcTvCVdTB5MH5jxdMQlFQH9u2Hl0PH7vv
+TdY7Dnsa5Lh/OVTzA9fa6wHwdZOFWkATw783uA8CZy0boJ4nUF8LtEp8La/XuJQ3
++AYklRsDwMo741WqGbp0
+=Dgp4
 -----END PGP SIGNATURE-----
diff --git a/sys-apps/kexec-tools/files/kexec-tools-2.0.9-hardened.patch b/sys-apps/kexec-tools/files/kexec-tools-2.0.9-hardened.patch
new file mode 100644
index 000000000000..01a8b4be933b
--- /dev/null
+++ b/sys-apps/kexec-tools/files/kexec-tools-2.0.9-hardened.patch
@@ -0,0 +1,16 @@
+the purgatory subdir gets loaded into the kernel so we need to
+make sure it does not get built with compiler settings like the
+rest of the userland tools.  that means no PIC/PIE/SSP/etc...
+
+--- a/purgatory/Makefile
++++ b/purgatory/Makefile
+@@ -47,7 +47,8 @@ purgatory/sha256.o: $(srcdir)/util_lib/sha256.c
+ $(PURGATORY): CC=$(TARGET_CC)
+ $(PURGATORY): CFLAGS+=$(PURGATORY_EXTRA_CFLAGS) \
+ 		      $($(ARCH)_PURGATORY_EXTRA_CFLAGS) \
+-		      -Os -fno-builtin -ffreestanding
++		      -Os -fno-builtin -ffreestanding \
++		      -fno-PIC -fno-PIE -fno-stack-protector
+ 
+ $(PURGATORY): CPPFLAGS=$($(ARCH)_PURGATORY_EXTRA_CFLAGS) \
+ 			-I$(srcdir)/purgatory/include \
diff --git a/sys-apps/kexec-tools/kexec-tools-2.0.9-r1.ebuild b/sys-apps/kexec-tools/kexec-tools-2.0.9-r1.ebuild
new file mode 100644
index 000000000000..483751dae993
--- /dev/null
+++ b/sys-apps/kexec-tools/kexec-tools-2.0.9-r1.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/kexec-tools/kexec-tools-2.0.9-r1.ebuild,v 1.1 2015/04/15 08:37:14 vapier Exp $
+
+EAPI=5
+
+inherit autotools-utils linux-info systemd
+
+DESCRIPTION="Load another kernel from the currently executing Linux kernel"
+HOMEPAGE="http://kernel.org/pub/linux/utils/kernel/kexec/"
+SRC_URI="mirror://kernel/linux/utils/kernel/kexec/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="booke lzma xen zlib"
+
+REQUIRED_USE="lzma? ( zlib )"
+
+DEPEND="
+	lzma? ( app-arch/xz-utils )
+	zlib? ( sys-libs/zlib )"
+RDEPEND="${DEPEND}"
+
+CONFIG_CHECK="~KEXEC"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.0.4-disable-kexec-test.patch
+	"${FILESDIR}"/${PN}-2.0.4-out-of-source.patch
+	"${FILESDIR}"/${PN}-2.0.9-hardened.patch
+)
+
+pkg_setup() {
+	# GNU Make's $(COMPILE.S) passes ASFLAGS to $(CCAS), CCAS=$(CC)
+	export ASFLAGS="${CCASFLAGS}"
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_with booke)
+		$(use_with lzma)
+		$(use_with xen)
+		$(use_with zlib)
+	)
+	autotools-utils_src_configure
+}
+
+src_install() {
+	autotools-utils_src_install
+
+	dodoc "${FILESDIR}"/README.Gentoo
+
+	newinitd "${FILESDIR}"/kexec.init-2.0.4-r2 kexec
+	newconfd "${FILESDIR}"/kexec.conf-2.0.4 kexec
+
+	insinto /etc
+	doins "${FILESDIR}"/kexec.conf
+
+	insinto /etc/kernel/postinst.d
+	doins "${FILESDIR}"/90_kexec
+
+	systemd_dounit "${FILESDIR}"/kexec.service
+}
+
+pkg_postinst() {
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "For systemd support the new config file is"
+		elog "   /etc/kexec.conf"
+		elog "Please adopt it to your needs as there is no autoconfig anymore"
+	fi
+}
diff --git a/sys-apps/kexec-tools/kexec-tools-9999.ebuild b/sys-apps/kexec-tools/kexec-tools-9999.ebuild
index 8c69b13f976a..21e89c13e9c4 100644
--- a/sys-apps/kexec-tools/kexec-tools-9999.ebuild
+++ b/sys-apps/kexec-tools/kexec-tools-9999.ebuild
@@ -1,12 +1,12 @@
-# Copyright 1999-2013 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/kexec-tools/kexec-tools-9999.ebuild,v 1.12 2013/12/28 20:27:31 jlec Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/kexec-tools/kexec-tools-9999.ebuild,v 1.13 2015/04/15 08:37:14 vapier Exp $
 
 EAPI=5
 
 AUTOTOOLS_AUTORECONF=true
 
-inherit autotools-utils flag-o-matic git-r3 linux-info systemd
+inherit autotools-utils linux-info systemd git-r3
 
 DESCRIPTION="Load another kernel from the currently executing Linux kernel"
 HOMEPAGE="http://kernel.org/pub/linux/utils/kernel/kexec/"
@@ -30,16 +30,12 @@ CONFIG_CHECK="~KEXEC"
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.0.4-disable-kexec-test.patch
 	"${FILESDIR}"/${PN}-2.0.4-out-of-source.patch
-	)
+	"${FILESDIR}"/${PN}-2.0.9-hardened.patch
+)
 
 pkg_setup() {
 	# GNU Make's $(COMPILE.S) passes ASFLAGS to $(CCAS), CCAS=$(CC)
 	export ASFLAGS="${CCASFLAGS}"
-	# to disable the -fPIE -pie in the hardened compiler
-	if gcc-specs-pie ; then
-		filter-flags -fPIE
-		append-ldflags -nopie
-	fi
 }
 
 src_configure() {
@@ -48,7 +44,7 @@ src_configure() {
 		$(use_with lzma)
 		$(use_with xen)
 		$(use_with zlib)
-		)
+	)
 	autotools-utils_src_configure
 }