From 5e89a8507a2650f7de5b728ac5d6b4ece8101589 Mon Sep 17 00:00:00 2001 From: Sam James Date: Fri, 4 Sep 2026 18:48:37 +0100 Subject: [PATCH] sys-apps/util-linux: add 2.42.3 Bug: https://bugs.gentoo.org/976967 Bug: https://bugs.gentoo.org/981937 Closes: https://bugs.gentoo.org/977456 Signed-off-by: Sam James --- sys-apps/util-linux/Manifest | 2 + .../util-linux-2.42.3-CVE-2026-78408.patch | 83 +++ ...util-linux-2.42.3-fileutils-warnings.patch | 64 +++ .../util-linux-2.42.3-libmount-fixup.patch | 114 ++++ .../util-linux-2.42.3-libmount-include.patch | 38 ++ sys-apps/util-linux/util-linux-2.42.3.ebuild | 504 ++++++++++++++++++ 6 files changed, 805 insertions(+) create mode 100644 sys-apps/util-linux/files/util-linux-2.42.3-CVE-2026-78408.patch create mode 100644 sys-apps/util-linux/files/util-linux-2.42.3-fileutils-warnings.patch create mode 100644 sys-apps/util-linux/files/util-linux-2.42.3-libmount-fixup.patch create mode 100644 sys-apps/util-linux/files/util-linux-2.42.3-libmount-include.patch create mode 100644 sys-apps/util-linux/util-linux-2.42.3.ebuild diff --git a/sys-apps/util-linux/Manifest b/sys-apps/util-linux/Manifest index e9a5e245d73cd..ee15efdde63d8 100644 --- a/sys-apps/util-linux/Manifest +++ b/sys-apps/util-linux/Manifest @@ -2,3 +2,5 @@ DIST util-linux-2.41.5.tar.sign 833 BLAKE2B 40c382defcbea78bbf137b1bdd5228cb7454 DIST util-linux-2.41.5.tar.xz 9474992 BLAKE2B b42744ddd878cb27a0cb75ef69240c9eaf2b4ff2583eebff15af7ccd852a25e6dc150f03a181dccd3c4fec6cff6acb12aff099d8414f6f689e71ee04e223f0d3 SHA512 25e7e79e0f0a4711a15c16db05357755536cf4dc9c0ee28447d95f9bfc135f23075d434e107269a65148a8c16b37755e913aacbaec03a3bdce171a9e0a46bfe8 DIST util-linux-2.42.2.tar.sign 833 BLAKE2B 091e4b9874290320ae985f0abe0044e22860c6922ddd6114fa3e5a0a3eed9ae229fe45b49591ecc8d575b2e2a4f22662bfe770a4e210f34d03758e062902e2b9 SHA512 3922974fa8384be5628938705f01aa3ac433512e24a3943fc5e0b2ae4cb4d9b952966727039d2fd74f58c51cd349228fd53f82ac8cd4d5ad7f61580abd4da229 DIST util-linux-2.42.2.tar.xz 10658220 BLAKE2B 49ca2426dd6a48638ee41f43477ddec23add87be6a561d3b654e13d21fc048f00e64d9247432a3436b07f8a3f34434ab2c837a5b82757a8d27096f6764d895dd SHA512 7415add0be2930654e322830808dde03ff6d511bd357f0679e6b6287a13ca79fe58ce4ac05edef86b76fb381b3a36ca2da9d3c31b5dc0a1d889c203156a57277 +DIST util-linux-2.42.3.tar.sign 833 BLAKE2B 00080fa75ee4da6c6fbe65fa288ac7e618ef9d18923d2b455aea0e2d0a11b5ed88072b1ff5710808864948ac647727439667fd2c468bee21bf5af76179aa081a SHA512 3f05f3b2a47ca066f4e34ef80aa8a11424b9b0f8585f417bce5e6e62a4d8a6f2dc74f78eb583be11aca862cd5bac094a984169756eeaddf0b6a0b9d2503f1537 +DIST util-linux-2.42.3.tar.xz 10716216 BLAKE2B fcb9fb7f522cabebb4813c78d56115d4516371922f9a4c8e2036d3622ed427d6c0897bca7a60b2176297ff08b6a4f28b85d09509462d3aac4cd73b863402eed6 SHA512 2a307943d4fbb34ac02131e10ff7260f181dd706b21e68a891d25d6eb30476a612bcc19b674bb2256283c9c716146e0d79909f37324efc9aa9d45a44e0d58988 diff --git a/sys-apps/util-linux/files/util-linux-2.42.3-CVE-2026-78408.patch b/sys-apps/util-linux/files/util-linux-2.42.3-CVE-2026-78408.patch new file mode 100644 index 0000000000000..2b9a270891619 --- /dev/null +++ b/sys-apps/util-linux/files/util-linux-2.42.3-CVE-2026-78408.patch @@ -0,0 +1,83 @@ +https://github.com/util-linux/util-linux/commit/286dd3ff41526b582ef48830de239dffbaa61f90 + +From 286dd3ff41526b582ef48830de239dffbaa61f90 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 12:17:14 +0200 +Subject: [PATCH] nsenter: close cgroup.procs fd after join to prevent + authority leak [CVE-2026-78408] + +The --join-cgroup option opens the target's cgroup.procs while running +as root and writes nsenter's own PID to migrate itself. The descriptor +was left open across subsequent namespace transitions, credential drops +(setgroups/setgid/setuid) and execve(). + +The kernel performs cgroup migration permission checks using the +credentials captured at open time (file->f_cred). An open cgroup.procs +descriptor therefore carries the opener's migration authority regardless +of later privilege changes. A program executed inside the target +namespace inherits root's cgroup migration capability even when running +as an unprivileged user with no capabilities. + +Fix this by: + + - closing the temporary /proc/PID/cgroup fd after reading the path + - adding O_CLOEXEC to the cgroup.procs open as defense in depth + - closing cgroup_procs_fd immediately after the self-migration write + - initializing the temporary cgroup fd to -1 instead of 0 to avoid + accidentally closing stdin via open_target_fd() + +The descriptor has no legitimate use after the single migration write. + +Introduced-by: b40650b71a74 ("nsenter: add option -c to join the cgroup of target process") +References: b0cf1cf0d255 ("nsenter: close cgroup.procs fd after join to prevent authority leak") +Signed-off-by: Karel Zak +(cherry picked from commit afe067c979b9ba2cbe856f7c6411210120ea62aa) +--- + sys-utils/nsenter.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c +index 62ef366d430..f449c65d2b4 100644 +--- a/sys-utils/nsenter.c ++++ b/sys-utils/nsenter.c +@@ -466,7 +466,7 @@ static int get_ns_ino(const char *path, ino_t *ino) + static void open_cgroup_procs(void) + { + char *buf = NULL, *path = NULL, *p; +- int cgroup_fd = 0; ++ int cgroup_fd = -1; + char fdpath[PATH_MAX]; + + open_target_fd(&cgroup_fd, "cgroup", optarg); +@@ -474,6 +474,8 @@ static void open_cgroup_procs(void) + if (read_all_alloc(cgroup_fd, &buf) < 1) + err(EXIT_FAILURE, _("failed to get cgroup path")); + ++ close(cgroup_fd); ++ + p = strtok(buf, "\n"); + if (p) + path = strrchr(p, ':'); +@@ -483,7 +485,7 @@ static void open_cgroup_procs(void) + + snprintf(fdpath, sizeof(fdpath), _PATH_SYS_CGROUP "/%s/cgroup.procs", path); + +- if ((cgroup_procs_fd = open(fdpath, O_WRONLY | O_APPEND)) < 0) ++ if ((cgroup_procs_fd = open(fdpath, O_WRONLY | O_APPEND | O_CLOEXEC)) < 0) + err(EXIT_FAILURE, _("failed to open cgroup.procs")); + + free(buf); +@@ -923,8 +925,11 @@ int main(int argc, char *argv[]) + } + + // Join into the target cgroup +- if (cgroup_procs_fd >= 0) ++ if (cgroup_procs_fd >= 0) { + join_into_cgroup(); ++ close(cgroup_procs_fd); ++ cgroup_procs_fd = -1; ++ } + + if (uid_gid_fd >= 0) { + struct stat st; + diff --git a/sys-apps/util-linux/files/util-linux-2.42.3-fileutils-warnings.patch b/sys-apps/util-linux/files/util-linux-2.42.3-fileutils-warnings.patch new file mode 100644 index 0000000000000..5bec7c3dc263b --- /dev/null +++ b/sys-apps/util-linux/files/util-linux-2.42.3-fileutils-warnings.patch @@ -0,0 +1,64 @@ +https://github.com/util-linux/util-linux/commit/67fd3bf434299c701c9361dca509d752e220ea7f + +From 67fd3bf434299c701c9361dca509d752e220ea7f Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 09:45:29 +0200 +Subject: [PATCH] lib/fileutils: fix unused parameter warnings without + SYS_openat2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On systems without SYS_openat2 (older kernels), ul_openat_resolve() +is a stub that returns -ENOSYS, making all parameters unused. With +-Werror=unused-parameter this breaks the build. + +Move the #ifdef around the whole function so each branch has its own +declaration — the SYS_openat2 branch uses all parameters normally, +the fallback branch marks them __unused__. + +Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users") +Signed-off-by: Karel Zak +(cherry picked from commit a471b62e732a491f1abe42450352fb0f9b5b43ea) +--- + lib/fileutils.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/fileutils.c b/lib/fileutils.c +index 89f1e216984..80b69eea271 100644 +--- a/lib/fileutils.c ++++ b/lib/fileutils.c +@@ -440,10 +440,10 @@ char *ul_basename(char *path) + return p; + } + ++#if defined(SYS_openat2) + int ul_openat_resolve(int dirfd, const char *path, int flags, + mode_t mode, unsigned long long resolve) + { +-#if defined(SYS_openat2) + struct open_how how = { + .flags = (__u64) flags, + .mode = (__u64) mode, +@@ -451,11 +451,19 @@ int ul_openat_resolve(int dirfd, const char *path, int flags, + }; + + return syscall(SYS_openat2, dirfd, path, &how, sizeof(how)); ++} + #else ++int ul_openat_resolve( ++ int dirfd __attribute__((__unused__)), ++ const char *path __attribute__((__unused__)), ++ int flags __attribute__((__unused__)), ++ mode_t mode __attribute__((__unused__)), ++ unsigned long long resolve __attribute__((__unused__))) ++{ + errno = ENOSYS; + return -1; +-#endif + } ++#endif + + int ul_open_no_symlinks(const char *path, int flags, mode_t mode) + { + diff --git a/sys-apps/util-linux/files/util-linux-2.42.3-libmount-fixup.patch b/sys-apps/util-linux/files/util-linux-2.42.3-libmount-fixup.patch new file mode 100644 index 0000000000000..d4c5136308987 --- /dev/null +++ b/sys-apps/util-linux/files/util-linux-2.42.3-libmount-fixup.patch @@ -0,0 +1,114 @@ +https://github.com/util-linux/util-linux/commit/473b6a5a3adb4ba4a72ec3d391a4339f55433249 + +From 473b6a5a3adb4ba4a72ec3d391a4339f55433249 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 10:01:29 +0200 +Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook + +The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel +headers have the new mount syscalls) rather than +USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support). + +This was intentional (commit 9040c0900, 2022) -- the idea was to keep +idmap working even with --disable-libmount-mountfd-support by calling +the raw open_tree() syscall directly, while using an inner #ifdef +USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree. + +This fine-grained approach broke when the CVE-2026-78410 fix replaced +the raw open_tree() call with mnt_open_tree(), which is only available +under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with +--disable-libmount-mountfd-support because mnt_open_tree() is +undeclared. + +Rather than maintaining two code paths for a feature that fundamentally +depends on the new mount API, gate the entire idmap hookset on +USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is +guarded. Remove the now-redundant inner #ifdef. + +Also add a note to mount.8 that X-mount.idmap requires the new +fd-based mount API. + +Addresses: https://github.com/util-linux/util-linux/issues/4598 +Signed-off-by: Karel Zak +(cherry picked from commit e06799ac325a881a297d2ffd6fe568cacdcd00ab) +--- + libmount/src/hook_idmap.c | 6 ++---- + libmount/src/hooks.c | 2 +- + libmount/src/version.c | 2 +- + sys-utils/mount.8.adoc | 1 + + 4 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index 2c697b17154..b1477ac6600 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -32,7 +32,7 @@ + # include + #endif + +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + + typedef enum idmap_type_t { + ID_TYPE_UID, /* uidmap entry */ +@@ -317,7 +317,6 @@ static int hook_mount_post( + * Once a mount has been attached to the filesystem it can't be + * idmapped anymore. So create a new detached mount. + */ +-#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + { + struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt); + +@@ -327,7 +326,6 @@ static int hook_mount_post( + DBG(HOOK, ul_debugobj(hs, " reuse tree FD")); + } + } +-#endif + if (fd_tree < 0) + fd_tree = mnt_open_tree(AT_FDCWD, target, + OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC | +@@ -544,4 +542,4 @@ const struct libmnt_hookset hookset_idmap = + .deinit = hookset_deinit + }; + +-#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */ ++#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */ +diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c +index 23eca4efdc4..5ae91edd7aa 100644 +--- a/libmount/src/hooks.c ++++ b/libmount/src/hooks.c +@@ -45,7 +45,7 @@ static const struct libmnt_hookset *const hooksets[] = + &hookset_mount, + #endif + &hookset_mount_legacy, +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + &hookset_idmap, + #endif + &hookset_owner +diff --git a/libmount/src/version.c b/libmount/src/version.c +index 5ec0d490cde..30cb340abe7 100644 +--- a/libmount/src/version.c ++++ b/libmount/src/version.c +@@ -37,7 +37,7 @@ static const char *lib_features[] = { + #ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES + "namespaces", + #endif +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + "idmapping", + #endif + #ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT +diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc +index 8a6e09f1ab8..d71c5e1fc85 100644 +--- a/sys-utils/mount.8.adoc ++++ b/sys-utils/mount.8.adoc +@@ -826,6 +826,7 @@ Set _mountpoint_'s mode after mounting. + + *X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__:: + Use this option to create an idmapped mount. ++This feature requires the new file-descriptor-based mount API (available since Linux 5.2). + An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace. + The ownership change is tied to the lifetime and localized to the relevant mount. + The relevant ID-mapping can be specified in two ways: + diff --git a/sys-apps/util-linux/files/util-linux-2.42.3-libmount-include.patch b/sys-apps/util-linux/files/util-linux-2.42.3-libmount-include.patch new file mode 100644 index 0000000000000..74f959737c0e1 --- /dev/null +++ b/sys-apps/util-linux/files/util-linux-2.42.3-libmount-include.patch @@ -0,0 +1,38 @@ +https://github.com/util-linux/util-linux/commit/a323dddbcd1ed05a10e7e870b3e1a48b4ed44a43 + +From a323dddbcd1ed05a10e7e870b3e1a48b4ed44a43 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Wed, 2 Sep 2026 13:32:27 +0200 +Subject: [PATCH] libmount: add missing fileutils.h include to hook_idmap.c + +The hook_idmap.c uses RESOLVE_NO_SYMLINKS (added by commit fb8e26535) +but does not include fileutils.h, which provides the fallback #define +for this constant. + +On Fedora (glibc 2.40+), this is masked because glibc's + transitively includes , which +defines RESOLVE_NO_SYMLINKS. On Ubuntu (and other distros with older +glibc), does not pull in openat2.h, so the build fails: + + hook_idmap.c:335:33: error: 'RESOLVE_NO_SYMLINKS' undeclared + +Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users") +Signed-off-by: Karel Zak +(cherry picked from commit 7e2e010874b10b3aabdc3c4c844c9ffc46a4a374) +--- + libmount/src/hook_idmap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index 77494e29810..2c697b17154 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -23,6 +23,7 @@ + + #include "strutils.h" + #include "all-io.h" ++#include "fileutils.h" + #include "namespace.h" + + #include "mountP.h" + diff --git a/sys-apps/util-linux/util-linux-2.42.3.ebuild b/sys-apps/util-linux/util-linux-2.42.3.ebuild new file mode 100644 index 0000000000000..9663e608cc349 --- /dev/null +++ b/sys-apps/util-linux/util-linux-2.42.3.ebuild @@ -0,0 +1,504 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{11..14} ) +TMPFILES_OPTIONAL=1 + +inherit toolchain-funcs libtool flag-o-matic bash-completion-r1 \ + pam python-r1 multilib-minimal multiprocessing systemd tmpfiles + +MY_PV="${PV/_/-}" +MY_P="${PN}-${MY_PV}" + +DESCRIPTION="Various useful Linux utilities" +HOMEPAGE="https://www.kernel.org/pub/linux/utils/util-linux/ https://github.com/util-linux/util-linux" + +if [[ ${PV} == 9999 ]] ; then + EGIT_REPO_URI="https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git" + inherit autotools git-r3 +else + VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/karelzak.asc + inherit verify-sig + + if [[ ${PV} != *_rc* ]] ; then + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos" + fi + + SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz" + SRC_URI+=" verify-sig? ( https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.sign )" +fi + +S="${WORKDIR}/${MY_P}" + +# GPL-2+ first per README.licensing ("default license"), then the rest +# are in order as listed in that file. +LICENSE="GPL-2+ GPL-1+ GPL-2 GPL-2+ GPL-3+ LGPL-2.1+ MIT BSD-2 BSD BSD-4 EUPL-1.2 public-domain" +SLOT="0" +IUSE="audit build caps +cramfs cryptsetup fdformat +hardlink kill +logger magic ncurses nls pam python +readline rtas selinux slang static-libs +su +suid systemd test tty-helpers udev unicode uuidd" + +# Most lib deps here are related to programs rather than our libs, +# so we rarely need to specify ${MULTILIB_USEDEP}. +RDEPEND=" + virtual/libcrypt:= + audit? ( >=sys-process/audit-2.6:= ) + caps? ( sys-libs/libcap-ng ) + cramfs? ( virtual/zlib:= ) + cryptsetup? ( >=sys-fs/cryptsetup-2.1.0 ) + hardlink? ( dev-libs/libpcre2:= ) + ncurses? ( + sys-libs/ncurses:=[unicode(+)?] + magic? ( sys-apps/file:0= ) + ) + nls? ( virtual/libintl[${MULTILIB_USEDEP}] ) + pam? ( sys-libs/pam ) + python? ( ${PYTHON_DEPS} ) + readline? ( sys-libs/readline:0= ) + rtas? ( sys-libs/librtas ) + selinux? ( >=sys-libs/libselinux-2.2.2-r4[${MULTILIB_USEDEP}] ) + slang? ( sys-libs/slang ) + !build? ( + systemd? ( sys-apps/systemd ) + udev? ( virtual/libudev:= ) + ) +" +BDEPEND=" + virtual/pkgconfig + nls? ( + app-text/po4a + sys-devel/gettext + ) + test? ( app-alternatives/bc ) +" +DEPEND=" + ${RDEPEND} + virtual/os-headers + acct-group/root +" +RDEPEND+=" + hardlink? ( !app-arch/hardlink ) + logger? ( !>=app-admin/sysklogd-2.0[logger] ) + kill? ( + !sys-apps/coreutils[kill] + !sys-process/procps[kill] + ) + su? ( + !=sys-apps/shadow-4.7-r2[su] + ) + uuidd? ( + acct-user/uuidd + selinux? ( sec-policy/selinux-uuidd ) + systemd? ( virtual/tmpfiles ) + ) + !net-wireless/rfkill +" + +if [[ ${PV} == 9999 ]] ; then + # Required for man-page generation + BDEPEND+=" dev-ruby/asciidoctor" +else + BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-karelzak-20230517 )" +fi + +REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} ) su? ( pam )" +RESTRICT="!test? ( test )" + +PATCHES=( + "${FILESDIR}"/${PN}-2.41.4-no-AF_ALG.patch + "${FILESDIR}"/${P}-libmount-include.patch + "${FILESDIR}"/${P}-CVE-2026-78408.patch + "${FILESDIR}"/${P}-fileutils-warnings.patch + "${FILESDIR}"/${P}-libmount-fixup.patch +) + +pkg_pretend() { + if use su && ! use suid ; then + elog "su will be installed as suid despite USE=-suid (bug #832092)" + elog "To use su without suid, see e.g. Portage's suidctl feature." + fi +} + +src_unpack() { + if [[ ${PV} == 9999 ]] ; then + git-r3_src_unpack + return + fi + + if use verify-sig; then + verify-sig_uncompress_verify_unpack "${DISTDIR}"/${MY_P}.tar.xz \ + "${DISTDIR}"/${MY_P}.tar.sign + else + default + fi +} + +src_prepare() { + default + + if use test ; then + # Known-failing tests + local known_failing_tests=( + # Subtest 'options-maximum-size-8192' fails + hardlink/options + + # Fails in sandbox + # re ioctl_ns: https://github.com/util-linux/util-linux/issues/2967 + lsns/ioctl_ns + lsfd/mkfds-inotify + lsfd/mkfds-symlink + lsfd/mkfds-rw-character-device + # Fails with network-sandbox at least in nspawn + lsfd/option-inet + utmp/last-ipv6 + + # Fails with permission errors in nspawn + fadvise/drop + fincore/count + + # Flaky + rename/subdir + + # Permission issues on /dev/random + lsfd/mkfds-eventpoll + lsfd/column-xmode + + # Hangs on some machines + script/replay + + # Fails for 32-bit time_t which some profiles have + misc/time_t + + # Permission issues with changing OOM score + choom/choom + + # MKFDS_PID is empty + lsfd/option-hyperlink + ) + + # debug prints confuse the tests which look for a diff + # in output + if has_version "=app-shells/bash-5.3_alpha*" ; then + known_failing_tests+=( + lsfd/column-ainodeclass + lsfd/mkfds-netlink-protocol + lsfd/column-type + lsfd/mkfds-eventfd + lsfd/mkfds-signalfd + lsfd/mkfds-mqueue + lsfd/mkfds-tcp6 + lsfd/mkfds-tcp + lsfd/filter-floating-point-nums + lsfd/mkfds-unix-stream-requiring-sockdiag + lsfd/mkfds-unix-dgram + lsfd/mkfds-directory + lsfd/mkfds-pty + lsfd/mkfds-pipe-no-fork + lsfd/mkfds-unix-stream + lsfd/mkfds-ro-regular-file + lsfd/mkfds-timerfd + lsfd/mkfds-udp + lsfd/mkfds-udp6 + ) + fi + + local known_failing_test + for known_failing_test in "${known_failing_tests[@]}" ; do + einfo "Removing known-failing test: ${known_failing_test}" + rm tests/ts/${known_failing_test} || die + done + fi + + if [[ ${PV} == 9999 ]] ; then + po/update-potfiles + eautoreconf + else + elibtoolize + fi +} + +python_configure() { + local myeconfargs=( + "${commonargs[@]}" + --disable-all-programs + --disable-bash-completion + --without-systemdsystemunitdir + --with-python + --enable-libblkid + --enable-libmount + --enable-pylibmount + ) + + mkdir "${BUILD_DIR}" || die + pushd "${BUILD_DIR}" >/dev/null || die + ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" + popd >/dev/null || die +} + +multilib_src_configure() { + # The scanf test in a run-time test which fails while cross-compiling. + # Blindly assume a POSIX setup since we require libmount, and libmount + # itself fails when the scanf test fails. bug #531856 + tc-is-cross-compiler && export scanf_cv_alloc_modifier=ms + + # bug #485486 + export ac_cv_header_security_pam_misc_h=$(multilib_native_usex pam) + # bug #545042 + export ac_cv_header_security_pam_appl_h=$(multilib_native_usex pam) + + # Undo bad ncurses handling by upstream. Fall back to pkg-config. + # bug #601530 + export NCURSES6_CONFIG=false NCURSES5_CONFIG=false + export NCURSESW6_CONFIG=false NCURSESW5_CONFIG=false + + # Avoid automagic dependency on ppc* + export ac_cv_lib_rtas_rtas_get_sysparm=$(usex rtas) + + # configure args shared by python and non-python builds + local commonargs=( + --localstatedir="${EPREFIX}/var" + --runstatedir="${EPREFIX}/run" + --enable-fs-paths-extra="${EPREFIX}/usr/sbin:${EPREFIX}/bin:${EPREFIX}/usr/bin" + ) + + local myeconfargs=( + "${commonargs[@]}" + --with-bashcompletiondir="$(get_bashcompdir)" + --without-python + $(multilib_native_use_enable suid makeinstall-chown) + $(multilib_native_use_enable suid makeinstall-setuid) + $(multilib_native_use_with readline) + $(multilib_native_use_with slang) + $(multilib_native_usex ncurses "$(use_with magic libmagic)" '--without-libmagic') + $(multilib_native_usex ncurses "$(use_with unicode ncursesw)" '--without-ncursesw') + $(multilib_native_usex ncurses "$(use_with !unicode ncurses)" '--without-ncurses') + $(multilib_native_use_with audit) + $(tc-has-tls || echo --disable-tls) + $(use_enable nls) + $(use_enable nls poman) + $(use_enable unicode widechar) + $(use_enable static-libs static) + $(use_with ncurses tinfo) + $(use_with selinux) + $(multilib_native_use_enable uuidd) + + # TODO: Wire this up (bug #931118) + --without-econf + + # TODO: Wire this up (bug #931297) + # TODO: investigate build failure w/ 2.40.1_rc1 + --disable-liblastlog2 + --disable-pam-lastlog2 + ) + + if use build ; then + myeconfargs+=( + --without-systemd + --without-udev + ) + else + myeconfargs+=( + $(multilib_native_use_with systemd) + $(multilib_native_use_with udev) + ) + fi + + if multilib_is_native_abi ; then + myeconfargs+=( + --disable-chfn-chsh + --disable-login + --disable-newgrp + --disable-nologin + --disable-pylibmount + --disable-raw + --disable-vipw + --enable-agetty + --enable-bash-completion + --enable-line + --enable-partx + --enable-rename + --enable-rfkill + --enable-schedutils + --with-systemdsystemunitdir="$(systemd_get_systemunitdir)" + --with-tmpfilesdir="${EPREFIX}"/usr/lib/tmpfiles.d + $(use_enable caps setpriv) + $(use_enable cramfs) + $(use_enable fdformat) + $(use_enable hardlink) + $(use_enable kill) + $(use_enable logger) + $(use_enable ncurses pg) + $(use_enable su) + $(use_enable tty-helpers mesg) + $(use_enable tty-helpers wall) + $(use_enable tty-helpers write) + $(use_with cryptsetup) + ) + if [[ ${PV} == *9999 ]] ; then + myeconfargs+=( --enable-asciidoc ) + else + # Upstream is shipping pre-generated man-pages for releases + myeconfargs+=( --disable-asciidoc ) + fi + else + myeconfargs+=( + --disable-all-programs + --disable-asciidoc + --disable-bash-completion + --without-systemdsystemunitdir + --disable-poman + + # build libraries + --enable-libuuid + --enable-libblkid + --enable-libsmartcols + --enable-libfdisk + --enable-libmount + + # Support uuidd for non-native libuuid + $(use_enable uuidd libuuid-force-uuidd) + ) + fi + + if use kernel_Hurd ; then + # Disable Linux-specific features + myeconfargs+=( + --disable-partx + --disable-rfkill + --disable-schedutils + --disable-fsck + ) + + # This is explicitly needed for some reason? TODO + myeconfargs+=( + --enable-agetty + ) + fi + + # https://savannah.gnu.org/support/?111394 + # This can be removed when we patch dev-build/autoconf, though + # packages w/o eautoreconf will still need it. + [[ ${enable_year2038} == "no" ]] && myeconfargs+=( --disable-year2038 ) + + ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" + + if multilib_is_native_abi && use python ; then + python_foreach_impl python_configure + fi +} + +src_configure() { + append-lfs-flags + + # Workaround for bug #961040 (gcc PR120006) + if tc-is-gcc && [[ $(gcc-major-version) == 15 && $(gcc-minor-version) -lt 2 ]] ; then + append-flags -fno-ipa-pta + fi + + multilib-minimal_src_configure +} + +python_compile() { + pushd "${BUILD_DIR}" >/dev/null || die + emake all + popd >/dev/null || die +} + +multilib_src_compile() { + emake all + + if multilib_is_native_abi && use python ; then + python_foreach_impl python_compile + fi +} + +python_test() { + pushd "${BUILD_DIR}" >/dev/null || die + emake check TS_OPTS="--parallel=$(makeopts_jobs) --nonroot" + popd >/dev/null || die +} + +multilib_src_test() { + emake check TS_OPTS="--parallel=$(makeopts_jobs) --nonroot" + if multilib_is_native_abi && use python ; then + python_foreach_impl python_test + fi +} + +python_install() { + pushd "${BUILD_DIR}" >/dev/null || die + emake DESTDIR="${D}" install + python_optimize + popd >/dev/null || die +} + +multilib_src_install() { + if multilib_is_native_abi && use python ; then + python_foreach_impl python_install + fi + + # This needs to be called AFTER python_install call, bug #689190 + # XXX: -j1 as temporary workaround for bug #931301 + emake DESTDIR="${D}" install -j1 +} + +multilib_src_install_all() { + dodoc AUTHORS NEWS README* Documentation/{TODO,*.txt,releases/*} + + dosym hexdump /usr/bin/hd + newman - hd.1 <<< '.so man1/hexdump.1' + + # e2fsprogs-libs didn't install .la files, and .pc work fine + find "${ED}" -name "*.la" -delete || die + + if use pam ; then + # See https://github.com/util-linux/util-linux/blob/master/Documentation/PAM-configuration.txt + newpamd "${FILESDIR}/runuser.pamd" runuser + newpamd "${FILESDIR}/runuser-l.pamd" runuser-l + + newpamd "${FILESDIR}/su-l.pamd" su-l + fi + + if use su && ! use suid ; then + # Always force suid su, even when USE=-suid, as su is useless + # for the overwhelming-majority case without suid. + # Users who wish to truly have a no-suid su can strip it out + # via e.g. Portage's suidctl or some other hook. + # See bug #832092 + fperms u+s /bin/su + fi + + if use uuidd; then + newinitd "${FILESDIR}/uuidd.initd" uuidd + fi + + # Note: + # Bash completion for "runuser" command is provided by same file which + # would also provide bash completion for "su" command. However, we don't + # use "su" command from this package. + # This triggers a known QA warning which we ignore for now to magically + # keep bash completion for "su" command which shadow package does not + # provide. + + local ver=$(tools/git-version-gen .tarballversion) + local major=$(ver_cut 1 ${ver}) + local minor=$(ver_cut 2 ${ver}) + local release=$(ver_cut 3 ${ver}) + export QA_PKGCONFIG_VERSION="${major}.${minor}.${release:-0}" +} + +pkg_postinst() { + if ! use tty-helpers ; then + elog "The mesg/wall/write tools have been disabled due to USE=-tty-helpers." + fi + + if [[ -z ${REPLACING_VERSIONS} ]] ; then + elog "The agetty util now clears the terminal by default. You" + elog "might want to add --noclear to your /etc/inittab lines." + fi + + if use systemd && use uuidd; then + tmpfiles_process uuidd-tmpfiles.conf + fi +}