Fix hardened issues #339157 and flesh out *at func handling some more #342983.

Package-Manager: portage-2.2.0_alpha4/cvs/Linux x86_64

3 files changed, 121 insertions, 5 deletions

diff --git a/sys-apps/sandbox/ChangeLog b/sys-apps/sandbox/ChangeLog
index 7daa7b6d9f1d..6191ef9f379d 100644
--- a/sys-apps/sandbox/ChangeLog
+++ b/sys-apps/sandbox/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for sys-apps/sandbox
 # Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-apps/sandbox/ChangeLog,v 1.142 2010/11/23 02:57:21 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/sandbox/ChangeLog,v 1.143 2010/11/24 07:46:17 vapier Exp $
+
+*sandbox-2.4 (24 Nov 2010)
+
+  24 Nov 2010; Mike Frysinger <vapier@gentoo.org> +sandbox-2.4.ebuild:
+  Fix hardened issues #339157 and flesh out *at func handling some more
+  #342983.
 
   23 Nov 2010; Mike Frysinger <vapier@gentoo.org> sandbox-2.3-r1.ebuild:
   Add back ~sparc since it has its ptrace disabled.
diff --git a/sys-apps/sandbox/Manifest b/sys-apps/sandbox/Manifest
index d244be83cf57..2491adf47472 100644
--- a/sys-apps/sandbox/Manifest
+++ b/sys-apps/sandbox/Manifest
@@ -13,17 +13,19 @@ DIST sandbox-1.2.18.1.tar.bz2 236755 RMD160 62e1e33d7f64db14d9c34d103d50256934a6
 DIST sandbox-1.2.20alpha2.tar.bz2 278323 RMD160 ebb3ca0963878810f3ac86633f848576fddb225e SHA1 3cd2262e9de3ad642b6e021eab26b50d6202ef41 SHA256 19f7148e259cf5212b8e587789b61c33cd4053c1947219a22749e7fb750b21d3
 DIST sandbox-1.6.tar.lzma 307014 RMD160 abdcfbbf137304f87c2cb184a4650bf652555ef6 SHA1 e1041d764e3fb326fe195ab39c8676227500f292 SHA256 52cfd286da3d5d51f3b6e012e409e931b21e32b4f2f16ba5677e46328680f4f4
 DIST sandbox-2.3.tar.xz 344260 RMD160 929485e4fb51737dc2fc1fe656efc505c3b78eec SHA1 c1eff87f4f608aa613a6905d2111790ac57fe091 SHA256 8670f7508453c2fd300ca29ad2eb457691c3df01c4c22fa27d4a7c880fd291d5
+DIST sandbox-2.4.tar.xz 344664 RMD160 43593c13c27881ebe17ae47c6ea0c40870f8351c SHA1 8d8b7ccc61baa881a90071c4cdc533f6918d21f4 SHA256 450599cb3052296d42f81a04dbbda82d220415fc2d16f5dc6e26b042d580fd3e
 EBUILD sandbox-1.2.18.1-r2.ebuild 3060 RMD160 e9c70adcff5a8fcb6d2f859d3b94629f2dd43392 SHA1 6a97f8384cf8a8dfa09ac86610464c831c9ba154 SHA256 24b164abace873d2483cb95fcafc6ef0cd47e356d9fbabbc2a23641dd2e8c167
 EBUILD sandbox-1.2.18.1-r3.ebuild 3219 RMD160 3b3a08f69aaf4b09458ddad1196ccbda14b2f57c SHA1 f01b174bf4055ff414a009c2b8fbb100713f39cb SHA256 c8ad82468d13716809f8c4667c316da5b9784e92100a6e7fe483d948bd8da85e
 EBUILD sandbox-1.2.20_alpha2-r1.ebuild 2638 RMD160 e0b26ffd54aa036168678bac8388a326de51deac SHA1 9a4e6f3b05d17e4d2893bbfe427ef3a2840f34c5 SHA256 7f64e7626f9d197c2d0d54254f19e902e8bf49561e2fb5d332e4ff727a69bad5
 EBUILD sandbox-1.6-r2.ebuild 2807 RMD160 34f50316548b2e9d98b5dfb70d99e3e380302672 SHA1 bba36e5a8fa8ea20c1e45febc5aeb56296d12cc9 SHA256 0d9c59cc9c328ad90f1ca93130b7975f09c827f55910a590ff2b2c314661b287
 EBUILD sandbox-2.3-r1.ebuild 2881 RMD160 b9555cb5fafe1a81457a148b9b2cf03d571f426b SHA1 17563a3e5c9f4d18ddd56764b9648efa59d8ad66 SHA256 53e67e6531667771175a2e867e1bb12d08fcbcb5dc356f35acd484e0bf970bbc
-MISC ChangeLog 20074 RMD160 1bce064008633b1b6e4692db83c1949a592085e4 SHA1 ef3f273a830fd96f87f40be8bee624c9838beb93 SHA256 697a8f3fc4a6eae56886b32c3823c441e244f20c983ec8378a99d268d2b5b078
+EBUILD sandbox-2.4.ebuild 2818 RMD160 0d2b504ece11b707fde3343a815bac9a0bbcb63d SHA1 158fcbf1fbe51ff64ee6fc2019a96db1417450d8 SHA256 2dfe10a7e9a171a7cf696ee3cc66d044820d2485bffcb02b73e9903d25dbb50c
+MISC ChangeLog 20257 RMD160 3bbde46e54454f1431dd05e533755c0f80de8f92 SHA1 9d42a906e9cf7aa45579717bdb27aaa2bbb2c223 SHA256 60d974270a1e81af02b3a530cef16f9956b168d65b87c542550ed903b593d032
 MISC metadata.xml 337 RMD160 c70000494a436cc0f8256d428f86d42b0fdf6017 SHA1 d81a50fa4047e6c0ecf1ab16e4fa6214895c5e9c SHA256 575b378bf8db5526847e6839a3351ec72769d75ed1c5b392559d57f6e6b4294f
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.16 (GNU/Linux)
 
-iF4EAREIAAYFAkzrLQ4ACgkQTwhj9JtAlp6/nQEAvXz3hgOKk6pnDjJv+DG0fWEs
-DbCGN1vHkzddOzQ4Vc0A/3AsB5x9NCt87ZFvweytV/EqPypCtNw3ABVGec7ij4GC
-=r5TB
+iF4EAREIAAYFAkzswjMACgkQTwhj9JtAlp6dkAD/Qi4dhxWK+FFsMMcGJZNiRwuQ
+QP/W6mIfxOMyftm0k3ABAIUO7J6DztH6vGnt+AHiNGxtVBrF7tOT1DtIav3Bria2
+=uchu
 -----END PGP SIGNATURE-----
diff --git a/sys-apps/sandbox/sandbox-2.4.ebuild b/sys-apps/sandbox/sandbox-2.4.ebuild
new file mode 100644
index 000000000000..8e8600919ada
--- /dev/null
+++ b/sys-apps/sandbox/sandbox-2.4.ebuild
@@ -0,0 +1,108 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-apps/sandbox/sandbox-2.4.ebuild,v 1.1 2010/11/24 07:46:17 vapier Exp $
+
+#
+# don't monkey with this ebuild unless contacting portage devs.
+# period.
+#
+
+inherit eutils flag-o-matic toolchain-funcs multilib
+
+DESCRIPTION="sandbox'd LD_PRELOAD hack"
+HOMEPAGE="http://www.gentoo.org/"
+SRC_URI="mirror://gentoo/${P}.tar.xz
+	http://dev.gentoo.org/~vapier/dist/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~sparc-fbsd -x86-fbsd"
+IUSE="multilib"
+
+DEPEND="app-arch/xz-utils
+	>=app-misc/pax-utils-0.1.19" #265376
+RDEPEND=""
+
+EMULTILIB_PKG="true"
+has sandbox_death_notice ${EBUILD_DEATH_HOOKS} || EBUILD_DEATH_HOOKS="${EBUILD_DEATH_HOOKS} sandbox_death_notice"
+
+sandbox_death_notice() {
+	ewarn "If configure failed with a 'cannot run C compiled programs' error, try this:"
+	ewarn "FEATURES=-sandbox emerge sandbox"
+}
+
+sb_get_install_abis() { use multilib && get_install_abis || echo ${ABI:-default} ; }
+
+src_unpack() {
+	unpack ${A}
+	if [[ ! -d ${S} ]] ; then
+		# When upgrading from older version, xz unpack may not work #271543
+		xz -dc "${DISTDIR}/${A}" | tar xf - || die
+	fi
+}
+
+src_compile() {
+	filter-lfs-flags #90228
+
+	local OABI=${ABI}
+	for ABI in $(sb_get_install_abis) ; do
+		mkdir "${WORKDIR}/build-${ABI}"
+		cd "${WORKDIR}/build-${ABI}"
+
+		use multilib && multilib_toolchain_setup ${ABI}
+
+		einfo "Configuring sandbox for ABI=${ABI}..."
+		ECONF_SOURCE="../${P}/" \
+		econf ${myconf} || die
+		einfo "Building sandbox for ABI=${ABI}..."
+		emake || die
+	done
+	ABI=${OABI}
+}
+
+src_test() {
+	local OABI=${ABI}
+	for ABI in $(sb_get_install_abis) ; do
+		cd "${WORKDIR}/build-${ABI}"
+		einfo "Checking sandbox for ABI=${ABI}..."
+		emake check || die "make check failed for ${ABI}"
+	done
+	ABI=${OABI}
+}
+
+src_install() {
+	local OABI=${ABI}
+	for ABI in $(sb_get_install_abis) ; do
+		cd "${WORKDIR}/build-${ABI}"
+		einfo "Installing sandbox for ABI=${ABI}..."
+		emake DESTDIR="${D}" install || die "make install failed for ${ABI}"
+		insinto /etc/sandbox.d #333131
+		doins etc/sandbox.d/00default || die
+	done
+	ABI=${OABI}
+
+	doenvd "${FILESDIR}"/09sandbox
+
+	keepdir /var/log/sandbox
+	fowners root:portage /var/log/sandbox
+	fperms 0770 /var/log/sandbox
+
+	cd "${S}"
+	dodoc AUTHORS ChangeLog* NEWS README
+}
+
+pkg_preinst() {
+	chown root:portage "${D}"/var/log/sandbox
+	chmod 0770 "${D}"/var/log/sandbox
+
+	local old=$(find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*')
+	if [[ -n ${old} ]] ; then
+		elog "Removing old sandbox libraries for you:"
+		elog ${old//${ROOT}}
+		find "${ROOT}"/lib* -maxdepth 1 -name 'libsandbox*' -exec rm -fv {} \;
+	fi
+}
+
+pkg_postinst() {
+	chmod 0755 "${ROOT}"/etc/sandbox.d #265376
+}