mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-09-24 04:59:14 -07:00
sys-apps/util-linux: add 2.42.3
Bug: https://bugs.gentoo.org/976967 Bug: https://bugs.gentoo.org/981937 Closes: https://bugs.gentoo.org/977456 Signed-off-by: Sam James <sam@gentoo.org>
This commit is contained in:
Sam James
@@ -2,3 +2,5 @@ DIST util-linux-2.41.5.tar.sign 833 BLAKE2B 40c382defcbea78bbf137b1bdd5228cb7454
|
||||
DIST util-linux-2.41.5.tar.xz 9474992 BLAKE2B b42744ddd878cb27a0cb75ef69240c9eaf2b4ff2583eebff15af7ccd852a25e6dc150f03a181dccd3c4fec6cff6acb12aff099d8414f6f689e71ee04e223f0d3 SHA512 25e7e79e0f0a4711a15c16db05357755536cf4dc9c0ee28447d95f9bfc135f23075d434e107269a65148a8c16b37755e913aacbaec03a3bdce171a9e0a46bfe8
|
||||
DIST util-linux-2.42.2.tar.sign 833 BLAKE2B 091e4b9874290320ae985f0abe0044e22860c6922ddd6114fa3e5a0a3eed9ae229fe45b49591ecc8d575b2e2a4f22662bfe770a4e210f34d03758e062902e2b9 SHA512 3922974fa8384be5628938705f01aa3ac433512e24a3943fc5e0b2ae4cb4d9b952966727039d2fd74f58c51cd349228fd53f82ac8cd4d5ad7f61580abd4da229
|
||||
DIST util-linux-2.42.2.tar.xz 10658220 BLAKE2B 49ca2426dd6a48638ee41f43477ddec23add87be6a561d3b654e13d21fc048f00e64d9247432a3436b07f8a3f34434ab2c837a5b82757a8d27096f6764d895dd SHA512 7415add0be2930654e322830808dde03ff6d511bd357f0679e6b6287a13ca79fe58ce4ac05edef86b76fb381b3a36ca2da9d3c31b5dc0a1d889c203156a57277
|
||||
DIST util-linux-2.42.3.tar.sign 833 BLAKE2B 00080fa75ee4da6c6fbe65fa288ac7e618ef9d18923d2b455aea0e2d0a11b5ed88072b1ff5710808864948ac647727439667fd2c468bee21bf5af76179aa081a SHA512 3f05f3b2a47ca066f4e34ef80aa8a11424b9b0f8585f417bce5e6e62a4d8a6f2dc74f78eb583be11aca862cd5bac094a984169756eeaddf0b6a0b9d2503f1537
|
||||
DIST util-linux-2.42.3.tar.xz 10716216 BLAKE2B fcb9fb7f522cabebb4813c78d56115d4516371922f9a4c8e2036d3622ed427d6c0897bca7a60b2176297ff08b6a4f28b85d09509462d3aac4cd73b863402eed6 SHA512 2a307943d4fbb34ac02131e10ff7260f181dd706b21e68a891d25d6eb30476a612bcc19b674bb2256283c9c716146e0d79909f37324efc9aa9d45a44e0d58988
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
https://github.com/util-linux/util-linux/commit/286dd3ff41526b582ef48830de239dffbaa61f90
|
||||
|
||||
From 286dd3ff41526b582ef48830de239dffbaa61f90 Mon Sep 17 00:00:00 2001
|
||||
From: Karel Zak <kzak@redhat.com>
|
||||
Date: Thu, 3 Sep 2026 12:17:14 +0200
|
||||
Subject: [PATCH] nsenter: close cgroup.procs fd after join to prevent
|
||||
authority leak [CVE-2026-78408]
|
||||
|
||||
The --join-cgroup option opens the target's cgroup.procs while running
|
||||
as root and writes nsenter's own PID to migrate itself. The descriptor
|
||||
was left open across subsequent namespace transitions, credential drops
|
||||
(setgroups/setgid/setuid) and execve().
|
||||
|
||||
The kernel performs cgroup migration permission checks using the
|
||||
credentials captured at open time (file->f_cred). An open cgroup.procs
|
||||
descriptor therefore carries the opener's migration authority regardless
|
||||
of later privilege changes. A program executed inside the target
|
||||
namespace inherits root's cgroup migration capability even when running
|
||||
as an unprivileged user with no capabilities.
|
||||
|
||||
Fix this by:
|
||||
|
||||
- closing the temporary /proc/PID/cgroup fd after reading the path
|
||||
- adding O_CLOEXEC to the cgroup.procs open as defense in depth
|
||||
- closing cgroup_procs_fd immediately after the self-migration write
|
||||
- initializing the temporary cgroup fd to -1 instead of 0 to avoid
|
||||
accidentally closing stdin via open_target_fd()
|
||||
|
||||
The descriptor has no legitimate use after the single migration write.
|
||||
|
||||
Introduced-by: b40650b71a74 ("nsenter: add option -c to join the cgroup of target process")
|
||||
References: b0cf1cf0d255 ("nsenter: close cgroup.procs fd after join to prevent authority leak")
|
||||
Signed-off-by: Karel Zak <kzak@redhat.com>
|
||||
(cherry picked from commit afe067c979b9ba2cbe856f7c6411210120ea62aa)
|
||||
---
|
||||
sys-utils/nsenter.c | 11 ++++++++---
|
||||
1 file changed, 8 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c
|
||||
index 62ef366d430..f449c65d2b4 100644
|
||||
--- a/sys-utils/nsenter.c
|
||||
+++ b/sys-utils/nsenter.c
|
||||
@@ -466,7 +466,7 @@ static int get_ns_ino(const char *path, ino_t *ino)
|
||||
static void open_cgroup_procs(void)
|
||||
{
|
||||
char *buf = NULL, *path = NULL, *p;
|
||||
- int cgroup_fd = 0;
|
||||
+ int cgroup_fd = -1;
|
||||
char fdpath[PATH_MAX];
|
||||
|
||||
open_target_fd(&cgroup_fd, "cgroup", optarg);
|
||||
@@ -474,6 +474,8 @@ static void open_cgroup_procs(void)
|
||||
if (read_all_alloc(cgroup_fd, &buf) < 1)
|
||||
err(EXIT_FAILURE, _("failed to get cgroup path"));
|
||||
|
||||
+ close(cgroup_fd);
|
||||
+
|
||||
p = strtok(buf, "\n");
|
||||
if (p)
|
||||
path = strrchr(p, ':');
|
||||
@@ -483,7 +485,7 @@ static void open_cgroup_procs(void)
|
||||
|
||||
snprintf(fdpath, sizeof(fdpath), _PATH_SYS_CGROUP "/%s/cgroup.procs", path);
|
||||
|
||||
- if ((cgroup_procs_fd = open(fdpath, O_WRONLY | O_APPEND)) < 0)
|
||||
+ if ((cgroup_procs_fd = open(fdpath, O_WRONLY | O_APPEND | O_CLOEXEC)) < 0)
|
||||
err(EXIT_FAILURE, _("failed to open cgroup.procs"));
|
||||
|
||||
free(buf);
|
||||
@@ -923,8 +925,11 @@ int main(int argc, char *argv[])
|
||||
}
|
||||
|
||||
// Join into the target cgroup
|
||||
- if (cgroup_procs_fd >= 0)
|
||||
+ if (cgroup_procs_fd >= 0) {
|
||||
join_into_cgroup();
|
||||
+ close(cgroup_procs_fd);
|
||||
+ cgroup_procs_fd = -1;
|
||||
+ }
|
||||
|
||||
if (uid_gid_fd >= 0) {
|
||||
struct stat st;
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
https://github.com/util-linux/util-linux/commit/67fd3bf434299c701c9361dca509d752e220ea7f
|
||||
|
||||
From 67fd3bf434299c701c9361dca509d752e220ea7f Mon Sep 17 00:00:00 2001
|
||||
From: Karel Zak <kzak@redhat.com>
|
||||
Date: Thu, 3 Sep 2026 09:45:29 +0200
|
||||
Subject: [PATCH] lib/fileutils: fix unused parameter warnings without
|
||||
SYS_openat2
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
On systems without SYS_openat2 (older kernels), ul_openat_resolve()
|
||||
is a stub that returns -ENOSYS, making all parameters unused. With
|
||||
-Werror=unused-parameter this breaks the build.
|
||||
|
||||
Move the #ifdef around the whole function so each branch has its own
|
||||
declaration — the SYS_openat2 branch uses all parameters normally,
|
||||
the fallback branch marks them __unused__.
|
||||
|
||||
Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users")
|
||||
Signed-off-by: Karel Zak <kzak@redhat.com>
|
||||
(cherry picked from commit a471b62e732a491f1abe42450352fb0f9b5b43ea)
|
||||
---
|
||||
lib/fileutils.c | 12 ++++++++++--
|
||||
1 file changed, 10 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/fileutils.c b/lib/fileutils.c
|
||||
index 89f1e216984..80b69eea271 100644
|
||||
--- a/lib/fileutils.c
|
||||
+++ b/lib/fileutils.c
|
||||
@@ -440,10 +440,10 @@ char *ul_basename(char *path)
|
||||
return p;
|
||||
}
|
||||
|
||||
+#if defined(SYS_openat2)
|
||||
int ul_openat_resolve(int dirfd, const char *path, int flags,
|
||||
mode_t mode, unsigned long long resolve)
|
||||
{
|
||||
-#if defined(SYS_openat2)
|
||||
struct open_how how = {
|
||||
.flags = (__u64) flags,
|
||||
.mode = (__u64) mode,
|
||||
@@ -451,11 +451,19 @@ int ul_openat_resolve(int dirfd, const char *path, int flags,
|
||||
};
|
||||
|
||||
return syscall(SYS_openat2, dirfd, path, &how, sizeof(how));
|
||||
+}
|
||||
#else
|
||||
+int ul_openat_resolve(
|
||||
+ int dirfd __attribute__((__unused__)),
|
||||
+ const char *path __attribute__((__unused__)),
|
||||
+ int flags __attribute__((__unused__)),
|
||||
+ mode_t mode __attribute__((__unused__)),
|
||||
+ unsigned long long resolve __attribute__((__unused__)))
|
||||
+{
|
||||
errno = ENOSYS;
|
||||
return -1;
|
||||
-#endif
|
||||
}
|
||||
+#endif
|
||||
|
||||
int ul_open_no_symlinks(const char *path, int flags, mode_t mode)
|
||||
{
|
||||
|
||||
114
sys-apps/util-linux/files/util-linux-2.42.3-libmount-fixup.patch
Normal file
114
sys-apps/util-linux/files/util-linux-2.42.3-libmount-fixup.patch
Normal file
@@ -0,0 +1,114 @@
|
||||
https://github.com/util-linux/util-linux/commit/473b6a5a3adb4ba4a72ec3d391a4339f55433249
|
||||
|
||||
From 473b6a5a3adb4ba4a72ec3d391a4339f55433249 Mon Sep 17 00:00:00 2001
|
||||
From: Karel Zak <kzak@redhat.com>
|
||||
Date: Thu, 3 Sep 2026 10:01:29 +0200
|
||||
Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
|
||||
|
||||
The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel
|
||||
headers have the new mount syscalls) rather than
|
||||
USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support).
|
||||
|
||||
This was intentional (commit 9040c0900, 2022) -- the idea was to keep
|
||||
idmap working even with --disable-libmount-mountfd-support by calling
|
||||
the raw open_tree() syscall directly, while using an inner #ifdef
|
||||
USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree.
|
||||
|
||||
This fine-grained approach broke when the CVE-2026-78410 fix replaced
|
||||
the raw open_tree() call with mnt_open_tree(), which is only available
|
||||
under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with
|
||||
--disable-libmount-mountfd-support because mnt_open_tree() is
|
||||
undeclared.
|
||||
|
||||
Rather than maintaining two code paths for a feature that fundamentally
|
||||
depends on the new mount API, gate the entire idmap hookset on
|
||||
USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is
|
||||
guarded. Remove the now-redundant inner #ifdef.
|
||||
|
||||
Also add a note to mount.8 that X-mount.idmap requires the new
|
||||
fd-based mount API.
|
||||
|
||||
Addresses: https://github.com/util-linux/util-linux/issues/4598
|
||||
Signed-off-by: Karel Zak <kzak@redhat.com>
|
||||
(cherry picked from commit e06799ac325a881a297d2ffd6fe568cacdcd00ab)
|
||||
---
|
||||
libmount/src/hook_idmap.c | 6 ++----
|
||||
libmount/src/hooks.c | 2 +-
|
||||
libmount/src/version.c | 2 +-
|
||||
sys-utils/mount.8.adoc | 1 +
|
||||
4 files changed, 5 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c
|
||||
index 2c697b17154..b1477ac6600 100644
|
||||
--- a/libmount/src/hook_idmap.c
|
||||
+++ b/libmount/src/hook_idmap.c
|
||||
@@ -32,7 +32,7 @@
|
||||
# include <linux/nsfs.h>
|
||||
#endif
|
||||
|
||||
-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
|
||||
+#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
||||
|
||||
typedef enum idmap_type_t {
|
||||
ID_TYPE_UID, /* uidmap entry */
|
||||
@@ -317,7 +317,6 @@ static int hook_mount_post(
|
||||
* Once a mount has been attached to the filesystem it can't be
|
||||
* idmapped anymore. So create a new detached mount.
|
||||
*/
|
||||
-#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
||||
{
|
||||
struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt);
|
||||
|
||||
@@ -327,7 +326,6 @@ static int hook_mount_post(
|
||||
DBG(HOOK, ul_debugobj(hs, " reuse tree FD"));
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
if (fd_tree < 0)
|
||||
fd_tree = mnt_open_tree(AT_FDCWD, target,
|
||||
OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC |
|
||||
@@ -544,4 +542,4 @@ const struct libmnt_hookset hookset_idmap =
|
||||
.deinit = hookset_deinit
|
||||
};
|
||||
|
||||
-#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */
|
||||
+#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */
|
||||
diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c
|
||||
index 23eca4efdc4..5ae91edd7aa 100644
|
||||
--- a/libmount/src/hooks.c
|
||||
+++ b/libmount/src/hooks.c
|
||||
@@ -45,7 +45,7 @@ static const struct libmnt_hookset *const hooksets[] =
|
||||
&hookset_mount,
|
||||
#endif
|
||||
&hookset_mount_legacy,
|
||||
-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
|
||||
+#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
||||
&hookset_idmap,
|
||||
#endif
|
||||
&hookset_owner
|
||||
diff --git a/libmount/src/version.c b/libmount/src/version.c
|
||||
index 5ec0d490cde..30cb340abe7 100644
|
||||
--- a/libmount/src/version.c
|
||||
+++ b/libmount/src/version.c
|
||||
@@ -37,7 +37,7 @@ static const char *lib_features[] = {
|
||||
#ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES
|
||||
"namespaces",
|
||||
#endif
|
||||
-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
|
||||
+#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
||||
"idmapping",
|
||||
#endif
|
||||
#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
||||
diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc
|
||||
index 8a6e09f1ab8..d71c5e1fc85 100644
|
||||
--- a/sys-utils/mount.8.adoc
|
||||
+++ b/sys-utils/mount.8.adoc
|
||||
@@ -826,6 +826,7 @@ Set _mountpoint_'s mode after mounting.
|
||||
|
||||
*X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__::
|
||||
Use this option to create an idmapped mount.
|
||||
+This feature requires the new file-descriptor-based mount API (available since Linux 5.2).
|
||||
An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace.
|
||||
The ownership change is tied to the lifetime and localized to the relevant mount.
|
||||
The relevant ID-mapping can be specified in two ways:
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
https://github.com/util-linux/util-linux/commit/a323dddbcd1ed05a10e7e870b3e1a48b4ed44a43
|
||||
|
||||
From a323dddbcd1ed05a10e7e870b3e1a48b4ed44a43 Mon Sep 17 00:00:00 2001
|
||||
From: Karel Zak <kzak@redhat.com>
|
||||
Date: Wed, 2 Sep 2026 13:32:27 +0200
|
||||
Subject: [PATCH] libmount: add missing fileutils.h include to hook_idmap.c
|
||||
|
||||
The hook_idmap.c uses RESOLVE_NO_SYMLINKS (added by commit fb8e26535)
|
||||
but does not include fileutils.h, which provides the fallback #define
|
||||
for this constant.
|
||||
|
||||
On Fedora (glibc 2.40+), this is masked because glibc's
|
||||
<bits/fcntl-linux.h> transitively includes <linux/openat2.h>, which
|
||||
defines RESOLVE_NO_SYMLINKS. On Ubuntu (and other distros with older
|
||||
glibc), <fcntl.h> does not pull in openat2.h, so the build fails:
|
||||
|
||||
hook_idmap.c:335:33: error: 'RESOLVE_NO_SYMLINKS' undeclared
|
||||
|
||||
Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users")
|
||||
Signed-off-by: Karel Zak <kzak@redhat.com>
|
||||
(cherry picked from commit 7e2e010874b10b3aabdc3c4c844c9ffc46a4a374)
|
||||
---
|
||||
libmount/src/hook_idmap.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c
|
||||
index 77494e29810..2c697b17154 100644
|
||||
--- a/libmount/src/hook_idmap.c
|
||||
+++ b/libmount/src/hook_idmap.c
|
||||
@@ -23,6 +23,7 @@
|
||||
|
||||
#include "strutils.h"
|
||||
#include "all-io.h"
|
||||
+#include "fileutils.h"
|
||||
#include "namespace.h"
|
||||
|
||||
#include "mountP.h"
|
||||
|
||||
504
sys-apps/util-linux/util-linux-2.42.3.ebuild
Normal file
504
sys-apps/util-linux/util-linux-2.42.3.ebuild
Normal file
@@ -0,0 +1,504 @@
|
||||
# Copyright 1999-2026 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
PYTHON_COMPAT=( python3_{11..14} )
|
||||
TMPFILES_OPTIONAL=1
|
||||
|
||||
inherit toolchain-funcs libtool flag-o-matic bash-completion-r1 \
|
||||
pam python-r1 multilib-minimal multiprocessing systemd tmpfiles
|
||||
|
||||
MY_PV="${PV/_/-}"
|
||||
MY_P="${PN}-${MY_PV}"
|
||||
|
||||
DESCRIPTION="Various useful Linux utilities"
|
||||
HOMEPAGE="https://www.kernel.org/pub/linux/utils/util-linux/ https://github.com/util-linux/util-linux"
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git"
|
||||
inherit autotools git-r3
|
||||
else
|
||||
VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/karelzak.asc
|
||||
inherit verify-sig
|
||||
|
||||
if [[ ${PV} != *_rc* ]] ; then
|
||||
KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos"
|
||||
fi
|
||||
|
||||
SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
|
||||
SRC_URI+=" verify-sig? ( https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.sign )"
|
||||
fi
|
||||
|
||||
S="${WORKDIR}/${MY_P}"
|
||||
|
||||
# GPL-2+ first per README.licensing ("default license"), then the rest
|
||||
# are in order as listed in that file.
|
||||
LICENSE="GPL-2+ GPL-1+ GPL-2 GPL-2+ GPL-3+ LGPL-2.1+ MIT BSD-2 BSD BSD-4 EUPL-1.2 public-domain"
|
||||
SLOT="0"
|
||||
IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode uuidd"
|
||||
|
||||
# Most lib deps here are related to programs rather than our libs,
|
||||
# so we rarely need to specify ${MULTILIB_USEDEP}.
|
||||
RDEPEND="
|
||||
virtual/libcrypt:=
|
||||
audit? ( >=sys-process/audit-2.6:= )
|
||||
caps? ( sys-libs/libcap-ng )
|
||||
cramfs? ( virtual/zlib:= )
|
||||
cryptsetup? ( >=sys-fs/cryptsetup-2.1.0 )
|
||||
hardlink? ( dev-libs/libpcre2:= )
|
||||
ncurses? (
|
||||
sys-libs/ncurses:=[unicode(+)?]
|
||||
magic? ( sys-apps/file:0= )
|
||||
)
|
||||
nls? ( virtual/libintl[${MULTILIB_USEDEP}] )
|
||||
pam? ( sys-libs/pam )
|
||||
python? ( ${PYTHON_DEPS} )
|
||||
readline? ( sys-libs/readline:0= )
|
||||
rtas? ( sys-libs/librtas )
|
||||
selinux? ( >=sys-libs/libselinux-2.2.2-r4[${MULTILIB_USEDEP}] )
|
||||
slang? ( sys-libs/slang )
|
||||
!build? (
|
||||
systemd? ( sys-apps/systemd )
|
||||
udev? ( virtual/libudev:= )
|
||||
)
|
||||
"
|
||||
BDEPEND="
|
||||
virtual/pkgconfig
|
||||
nls? (
|
||||
app-text/po4a
|
||||
sys-devel/gettext
|
||||
)
|
||||
test? ( app-alternatives/bc )
|
||||
"
|
||||
DEPEND="
|
||||
${RDEPEND}
|
||||
virtual/os-headers
|
||||
acct-group/root
|
||||
"
|
||||
RDEPEND+="
|
||||
hardlink? ( !app-arch/hardlink )
|
||||
logger? ( !>=app-admin/sysklogd-2.0[logger] )
|
||||
kill? (
|
||||
!sys-apps/coreutils[kill]
|
||||
!sys-process/procps[kill]
|
||||
)
|
||||
su? (
|
||||
!<sys-apps/shadow-4.7-r2
|
||||
!>=sys-apps/shadow-4.7-r2[su]
|
||||
)
|
||||
uuidd? (
|
||||
acct-user/uuidd
|
||||
selinux? ( sec-policy/selinux-uuidd )
|
||||
systemd? ( virtual/tmpfiles )
|
||||
)
|
||||
!net-wireless/rfkill
|
||||
"
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
# Required for man-page generation
|
||||
BDEPEND+=" dev-ruby/asciidoctor"
|
||||
else
|
||||
BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-karelzak-20230517 )"
|
||||
fi
|
||||
|
||||
REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} ) su? ( pam )"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${PN}-2.41.4-no-AF_ALG.patch
|
||||
"${FILESDIR}"/${P}-libmount-include.patch
|
||||
"${FILESDIR}"/${P}-CVE-2026-78408.patch
|
||||
"${FILESDIR}"/${P}-fileutils-warnings.patch
|
||||
"${FILESDIR}"/${P}-libmount-fixup.patch
|
||||
)
|
||||
|
||||
pkg_pretend() {
|
||||
if use su && ! use suid ; then
|
||||
elog "su will be installed as suid despite USE=-suid (bug #832092)"
|
||||
elog "To use su without suid, see e.g. Portage's suidctl feature."
|
||||
fi
|
||||
}
|
||||
|
||||
src_unpack() {
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
git-r3_src_unpack
|
||||
return
|
||||
fi
|
||||
|
||||
if use verify-sig; then
|
||||
verify-sig_uncompress_verify_unpack "${DISTDIR}"/${MY_P}.tar.xz \
|
||||
"${DISTDIR}"/${MY_P}.tar.sign
|
||||
else
|
||||
default
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
|
||||
if use test ; then
|
||||
# Known-failing tests
|
||||
local known_failing_tests=(
|
||||
# Subtest 'options-maximum-size-8192' fails
|
||||
hardlink/options
|
||||
|
||||
# Fails in sandbox
|
||||
# re ioctl_ns: https://github.com/util-linux/util-linux/issues/2967
|
||||
lsns/ioctl_ns
|
||||
lsfd/mkfds-inotify
|
||||
lsfd/mkfds-symlink
|
||||
lsfd/mkfds-rw-character-device
|
||||
# Fails with network-sandbox at least in nspawn
|
||||
lsfd/option-inet
|
||||
utmp/last-ipv6
|
||||
|
||||
# Fails with permission errors in nspawn
|
||||
fadvise/drop
|
||||
fincore/count
|
||||
|
||||
# Flaky
|
||||
rename/subdir
|
||||
|
||||
# Permission issues on /dev/random
|
||||
lsfd/mkfds-eventpoll
|
||||
lsfd/column-xmode
|
||||
|
||||
# Hangs on some machines
|
||||
script/replay
|
||||
|
||||
# Fails for 32-bit time_t which some profiles have
|
||||
misc/time_t
|
||||
|
||||
# Permission issues with changing OOM score
|
||||
choom/choom
|
||||
|
||||
# MKFDS_PID is empty
|
||||
lsfd/option-hyperlink
|
||||
)
|
||||
|
||||
# debug prints confuse the tests which look for a diff
|
||||
# in output
|
||||
if has_version "=app-shells/bash-5.3_alpha*" ; then
|
||||
known_failing_tests+=(
|
||||
lsfd/column-ainodeclass
|
||||
lsfd/mkfds-netlink-protocol
|
||||
lsfd/column-type
|
||||
lsfd/mkfds-eventfd
|
||||
lsfd/mkfds-signalfd
|
||||
lsfd/mkfds-mqueue
|
||||
lsfd/mkfds-tcp6
|
||||
lsfd/mkfds-tcp
|
||||
lsfd/filter-floating-point-nums
|
||||
lsfd/mkfds-unix-stream-requiring-sockdiag
|
||||
lsfd/mkfds-unix-dgram
|
||||
lsfd/mkfds-directory
|
||||
lsfd/mkfds-pty
|
||||
lsfd/mkfds-pipe-no-fork
|
||||
lsfd/mkfds-unix-stream
|
||||
lsfd/mkfds-ro-regular-file
|
||||
lsfd/mkfds-timerfd
|
||||
lsfd/mkfds-udp
|
||||
lsfd/mkfds-udp6
|
||||
)
|
||||
fi
|
||||
|
||||
local known_failing_test
|
||||
for known_failing_test in "${known_failing_tests[@]}" ; do
|
||||
einfo "Removing known-failing test: ${known_failing_test}"
|
||||
rm tests/ts/${known_failing_test} || die
|
||||
done
|
||||
fi
|
||||
|
||||
if [[ ${PV} == 9999 ]] ; then
|
||||
po/update-potfiles
|
||||
eautoreconf
|
||||
else
|
||||
elibtoolize
|
||||
fi
|
||||
}
|
||||
|
||||
python_configure() {
|
||||
local myeconfargs=(
|
||||
"${commonargs[@]}"
|
||||
--disable-all-programs
|
||||
--disable-bash-completion
|
||||
--without-systemdsystemunitdir
|
||||
--with-python
|
||||
--enable-libblkid
|
||||
--enable-libmount
|
||||
--enable-pylibmount
|
||||
)
|
||||
|
||||
mkdir "${BUILD_DIR}" || die
|
||||
pushd "${BUILD_DIR}" >/dev/null || die
|
||||
ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
|
||||
popd >/dev/null || die
|
||||
}
|
||||
|
||||
multilib_src_configure() {
|
||||
# The scanf test in a run-time test which fails while cross-compiling.
|
||||
# Blindly assume a POSIX setup since we require libmount, and libmount
|
||||
# itself fails when the scanf test fails. bug #531856
|
||||
tc-is-cross-compiler && export scanf_cv_alloc_modifier=ms
|
||||
|
||||
# bug #485486
|
||||
export ac_cv_header_security_pam_misc_h=$(multilib_native_usex pam)
|
||||
# bug #545042
|
||||
export ac_cv_header_security_pam_appl_h=$(multilib_native_usex pam)
|
||||
|
||||
# Undo bad ncurses handling by upstream. Fall back to pkg-config.
|
||||
# bug #601530
|
||||
export NCURSES6_CONFIG=false NCURSES5_CONFIG=false
|
||||
export NCURSESW6_CONFIG=false NCURSESW5_CONFIG=false
|
||||
|
||||
# Avoid automagic dependency on ppc*
|
||||
export ac_cv_lib_rtas_rtas_get_sysparm=$(usex rtas)
|
||||
|
||||
# configure args shared by python and non-python builds
|
||||
local commonargs=(
|
||||
--localstatedir="${EPREFIX}/var"
|
||||
--runstatedir="${EPREFIX}/run"
|
||||
--enable-fs-paths-extra="${EPREFIX}/usr/sbin:${EPREFIX}/bin:${EPREFIX}/usr/bin"
|
||||
)
|
||||
|
||||
local myeconfargs=(
|
||||
"${commonargs[@]}"
|
||||
--with-bashcompletiondir="$(get_bashcompdir)"
|
||||
--without-python
|
||||
$(multilib_native_use_enable suid makeinstall-chown)
|
||||
$(multilib_native_use_enable suid makeinstall-setuid)
|
||||
$(multilib_native_use_with readline)
|
||||
$(multilib_native_use_with slang)
|
||||
$(multilib_native_usex ncurses "$(use_with magic libmagic)" '--without-libmagic')
|
||||
$(multilib_native_usex ncurses "$(use_with unicode ncursesw)" '--without-ncursesw')
|
||||
$(multilib_native_usex ncurses "$(use_with !unicode ncurses)" '--without-ncurses')
|
||||
$(multilib_native_use_with audit)
|
||||
$(tc-has-tls || echo --disable-tls)
|
||||
$(use_enable nls)
|
||||
$(use_enable nls poman)
|
||||
$(use_enable unicode widechar)
|
||||
$(use_enable static-libs static)
|
||||
$(use_with ncurses tinfo)
|
||||
$(use_with selinux)
|
||||
$(multilib_native_use_enable uuidd)
|
||||
|
||||
# TODO: Wire this up (bug #931118)
|
||||
--without-econf
|
||||
|
||||
# TODO: Wire this up (bug #931297)
|
||||
# TODO: investigate build failure w/ 2.40.1_rc1
|
||||
--disable-liblastlog2
|
||||
--disable-pam-lastlog2
|
||||
)
|
||||
|
||||
if use build ; then
|
||||
myeconfargs+=(
|
||||
--without-systemd
|
||||
--without-udev
|
||||
)
|
||||
else
|
||||
myeconfargs+=(
|
||||
$(multilib_native_use_with systemd)
|
||||
$(multilib_native_use_with udev)
|
||||
)
|
||||
fi
|
||||
|
||||
if multilib_is_native_abi ; then
|
||||
myeconfargs+=(
|
||||
--disable-chfn-chsh
|
||||
--disable-login
|
||||
--disable-newgrp
|
||||
--disable-nologin
|
||||
--disable-pylibmount
|
||||
--disable-raw
|
||||
--disable-vipw
|
||||
--enable-agetty
|
||||
--enable-bash-completion
|
||||
--enable-line
|
||||
--enable-partx
|
||||
--enable-rename
|
||||
--enable-rfkill
|
||||
--enable-schedutils
|
||||
--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
|
||||
--with-tmpfilesdir="${EPREFIX}"/usr/lib/tmpfiles.d
|
||||
$(use_enable caps setpriv)
|
||||
$(use_enable cramfs)
|
||||
$(use_enable fdformat)
|
||||
$(use_enable hardlink)
|
||||
$(use_enable kill)
|
||||
$(use_enable logger)
|
||||
$(use_enable ncurses pg)
|
||||
$(use_enable su)
|
||||
$(use_enable tty-helpers mesg)
|
||||
$(use_enable tty-helpers wall)
|
||||
$(use_enable tty-helpers write)
|
||||
$(use_with cryptsetup)
|
||||
)
|
||||
if [[ ${PV} == *9999 ]] ; then
|
||||
myeconfargs+=( --enable-asciidoc )
|
||||
else
|
||||
# Upstream is shipping pre-generated man-pages for releases
|
||||
myeconfargs+=( --disable-asciidoc )
|
||||
fi
|
||||
else
|
||||
myeconfargs+=(
|
||||
--disable-all-programs
|
||||
--disable-asciidoc
|
||||
--disable-bash-completion
|
||||
--without-systemdsystemunitdir
|
||||
--disable-poman
|
||||
|
||||
# build libraries
|
||||
--enable-libuuid
|
||||
--enable-libblkid
|
||||
--enable-libsmartcols
|
||||
--enable-libfdisk
|
||||
--enable-libmount
|
||||
|
||||
# Support uuidd for non-native libuuid
|
||||
$(use_enable uuidd libuuid-force-uuidd)
|
||||
)
|
||||
fi
|
||||
|
||||
if use kernel_Hurd ; then
|
||||
# Disable Linux-specific features
|
||||
myeconfargs+=(
|
||||
--disable-partx
|
||||
--disable-rfkill
|
||||
--disable-schedutils
|
||||
--disable-fsck
|
||||
)
|
||||
|
||||
# This is explicitly needed for some reason? TODO
|
||||
myeconfargs+=(
|
||||
--enable-agetty
|
||||
)
|
||||
fi
|
||||
|
||||
# https://savannah.gnu.org/support/?111394
|
||||
# This can be removed when we patch dev-build/autoconf, though
|
||||
# packages w/o eautoreconf will still need it.
|
||||
[[ ${enable_year2038} == "no" ]] && myeconfargs+=( --disable-year2038 )
|
||||
|
||||
ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
|
||||
|
||||
if multilib_is_native_abi && use python ; then
|
||||
python_foreach_impl python_configure
|
||||
fi
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
append-lfs-flags
|
||||
|
||||
# Workaround for bug #961040 (gcc PR120006)
|
||||
if tc-is-gcc && [[ $(gcc-major-version) == 15 && $(gcc-minor-version) -lt 2 ]] ; then
|
||||
append-flags -fno-ipa-pta
|
||||
fi
|
||||
|
||||
multilib-minimal_src_configure
|
||||
}
|
||||
|
||||
python_compile() {
|
||||
pushd "${BUILD_DIR}" >/dev/null || die
|
||||
emake all
|
||||
popd >/dev/null || die
|
||||
}
|
||||
|
||||
multilib_src_compile() {
|
||||
emake all
|
||||
|
||||
if multilib_is_native_abi && use python ; then
|
||||
python_foreach_impl python_compile
|
||||
fi
|
||||
}
|
||||
|
||||
python_test() {
|
||||
pushd "${BUILD_DIR}" >/dev/null || die
|
||||
emake check TS_OPTS="--parallel=$(makeopts_jobs) --nonroot"
|
||||
popd >/dev/null || die
|
||||
}
|
||||
|
||||
multilib_src_test() {
|
||||
emake check TS_OPTS="--parallel=$(makeopts_jobs) --nonroot"
|
||||
if multilib_is_native_abi && use python ; then
|
||||
python_foreach_impl python_test
|
||||
fi
|
||||
}
|
||||
|
||||
python_install() {
|
||||
pushd "${BUILD_DIR}" >/dev/null || die
|
||||
emake DESTDIR="${D}" install
|
||||
python_optimize
|
||||
popd >/dev/null || die
|
||||
}
|
||||
|
||||
multilib_src_install() {
|
||||
if multilib_is_native_abi && use python ; then
|
||||
python_foreach_impl python_install
|
||||
fi
|
||||
|
||||
# This needs to be called AFTER python_install call, bug #689190
|
||||
# XXX: -j1 as temporary workaround for bug #931301
|
||||
emake DESTDIR="${D}" install -j1
|
||||
}
|
||||
|
||||
multilib_src_install_all() {
|
||||
dodoc AUTHORS NEWS README* Documentation/{TODO,*.txt,releases/*}
|
||||
|
||||
dosym hexdump /usr/bin/hd
|
||||
newman - hd.1 <<< '.so man1/hexdump.1'
|
||||
|
||||
# e2fsprogs-libs didn't install .la files, and .pc work fine
|
||||
find "${ED}" -name "*.la" -delete || die
|
||||
|
||||
if use pam ; then
|
||||
# See https://github.com/util-linux/util-linux/blob/master/Documentation/PAM-configuration.txt
|
||||
newpamd "${FILESDIR}/runuser.pamd" runuser
|
||||
newpamd "${FILESDIR}/runuser-l.pamd" runuser-l
|
||||
|
||||
newpamd "${FILESDIR}/su-l.pamd" su-l
|
||||
fi
|
||||
|
||||
if use su && ! use suid ; then
|
||||
# Always force suid su, even when USE=-suid, as su is useless
|
||||
# for the overwhelming-majority case without suid.
|
||||
# Users who wish to truly have a no-suid su can strip it out
|
||||
# via e.g. Portage's suidctl or some other hook.
|
||||
# See bug #832092
|
||||
fperms u+s /bin/su
|
||||
fi
|
||||
|
||||
if use uuidd; then
|
||||
newinitd "${FILESDIR}/uuidd.initd" uuidd
|
||||
fi
|
||||
|
||||
# Note:
|
||||
# Bash completion for "runuser" command is provided by same file which
|
||||
# would also provide bash completion for "su" command. However, we don't
|
||||
# use "su" command from this package.
|
||||
# This triggers a known QA warning which we ignore for now to magically
|
||||
# keep bash completion for "su" command which shadow package does not
|
||||
# provide.
|
||||
|
||||
local ver=$(tools/git-version-gen .tarballversion)
|
||||
local major=$(ver_cut 1 ${ver})
|
||||
local minor=$(ver_cut 2 ${ver})
|
||||
local release=$(ver_cut 3 ${ver})
|
||||
export QA_PKGCONFIG_VERSION="${major}.${minor}.${release:-0}"
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
if ! use tty-helpers ; then
|
||||
elog "The mesg/wall/write tools have been disabled due to USE=-tty-helpers."
|
||||
fi
|
||||
|
||||
if [[ -z ${REPLACING_VERSIONS} ]] ; then
|
||||
elog "The agetty util now clears the terminal by default. You"
|
||||
elog "might want to add --noclear to your /etc/inittab lines."
|
||||
fi
|
||||
|
||||
if use systemd && use uuidd; then
|
||||
tmpfiles_process uuidd-tmpfiles.conf
|
||||
fi
|
||||
}
|
||||
Reference in New Issue
Block a user