Fix from upstream for ldso prelink segfaults #353814 and fix static linking with fortify symbols #353816 by Harris Landgarten.

Package-Manager: portage-2.2.0_alpha23/cvs/Linux x86_64

3 files changed, 274 insertions, 4 deletions

diff --git a/sys-libs/glibc/ChangeLog b/sys-libs/glibc/ChangeLog
index dcecb22de09d..a45a3728dfe2 100644
--- a/sys-libs/glibc/ChangeLog
+++ b/sys-libs/glibc/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for sys-libs/glibc
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-libs/glibc/ChangeLog,v 1.743 2011/02/07 19:18:12 ssuominen Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-libs/glibc/ChangeLog,v 1.744 2011/02/14 18:03:48 vapier Exp $
+
+*glibc-2.13-r1 (14 Feb 2011)
+
+  14 Feb 2011; Mike Frysinger <vapier@gentoo.org> +glibc-2.13-r1.ebuild:
+  Fix from upstream for ldso prelink segfaults #353814 and fix static linking
+  with fortify symbols #353816 by Harris Landgarten.
 
   07 Feb 2011; Samuli Suominen <ssuominen@gentoo.org> glibc-2.13.ebuild:
   Abort if sys-devel/prelink is installed wrt #353814.
diff --git a/sys-libs/glibc/Manifest b/sys-libs/glibc/Manifest
index 419b9dd61bca..40d0c2729cb9 100644
--- a/sys-libs/glibc/Manifest
+++ b/sys-libs/glibc/Manifest
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
 AUX 2.10/glibc-2.10-gentoo-chk_fail.c 9407 RMD160 230701dfacfe2481eb49e5384fe4ebb508bd3af2 SHA1 0e9330d57de714dd1ecd7040d3eabf4723cdee7c SHA256 7745c0f5d37b37959b43b41e39762fc35b877161bc5740d9d3e9a83021acbc0e
 AUX 2.10/glibc-2.10-hardened-configure-picdefault.patch 865 RMD160 744bdbfb73f1dbced4cb33cb5aa92f3b41d3b4fb SHA1 21e0f83598f5342032a794315f0e3dac07f647da SHA256 b50b29f85d88011555bbcbe6046e6600be9344f2d78412b14aebdea515420774
 AUX 2.10/glibc-2.10-hardened-inittls-nosysenter.patch 8823 RMD160 163e53f0f4f0bd003ef1c50a4eaaa8f4a82695fe SHA1 df23c6756114e1451e6f120723af1b621037c28e SHA256 dcf78c6524c222dbee907200a8878aff727e29d43a4962b977a16d85752e5c10
@@ -36,7 +39,7 @@ DIST glibc-2.12.1-patches-8.tar.bz2 112063 RMD160 5bf50dbd1bb30d5cc9a41ebfdc72fa
 DIST glibc-2.12.1.tar.bz2 15667516 RMD160 4a46745f4220f4253af0b882d0c2072499e17653 SHA1 ef5ca1e765719d3290bd24f94705f27534f3744b SHA256 759f115c52bc12c5bb453af559dcd456d32138250b7cc96e47804e3d0ec97407
 DIST glibc-2.12.2-patches-1.tar.bz2 103230 RMD160 b78486c52a04a317991f4de6b50c9a8fd92fffe3 SHA1 971195f9d9dde067a08beca69434269ff2072a76 SHA256 674e2e2d028d1f3815bfc578135ffc2adef5f1345daddcda7367da15846678b6
 DIST glibc-2.12.2.tar.bz2 15667759 RMD160 1855ebbbca52dc036de159cca720f6153e173e21 SHA1 3ef6d36eee2dc7c4351f215f689e6a04c161a35e SHA256 22f8eb3c49b9eb5e88fc249daf8670899adef24eb1f74708fb150a6502fa1216
-DIST glibc-2.13-patches-1.tar.bz2 103245 RMD160 39039f031e3a1d8017815294059d71a84d7f6103 SHA1 2349ea7fdaff3f9666281ddc69539c7f5033427a SHA256 10092cecbe186ce7c3e651c3097e0a7e4f2428dbe4f2e73e775e83ab1f898255
+DIST glibc-2.13-patches-2.tar.bz2 104617 RMD160 a582795b5102ff6204eb8937dba9352376a607ee SHA1 c67c30ead5cbaee0fbc55eca4115256bec1718e0 SHA256 fd643ddba1676a87678519e3c0d62692704a2073efe8905325707fb4d49c38b5
 DIST glibc-2.13.tar.bz2 15725729 RMD160 cf34e4a06a2602deed709e2ee10cf7446a824989 SHA1 14d83dced873a21a3da6a0bfa0926f40d82ef980 SHA256 0173c92a0545e6d99a46a4fbed2da00ba26556f5c6198e2f9f1631ed5318dbb2
 DIST glibc-2.2.5-manpages.tar.bz2 14667 RMD160 4f6e1fde042c19aca4718c8e06e19dc2786a1334 SHA1 7bb5615af98a8b5fb2ef91a47148fedef227c544 SHA256 03850134bd0c670d8b5fe5e3bad0dac2efdb7078ddf69e0dbcdba380f4d5697c
 DIST glibc-2.2.5-patches-1.0.tar.bz2 21176 RMD160 4575e4355a919b7865829d22ab86cbdcd53253ee SHA1 f8fa215694673c5ee69f00b3986bcd34d48c7d85 SHA256 39e20bbd032db00c3b0781a0055ed092e9ebcbc2f71e4c1930fd93cd67d374fd
@@ -74,7 +77,7 @@ EBUILD glibc-2.11.2-r3.ebuild 8375 RMD160 800dbbaf586794c984d02375a7d984b9d4b6f6
 EBUILD glibc-2.11.3.ebuild 8381 RMD160 fde254014f1cf04b420fe8a01d9112c4d2bb3b15 SHA1 0bc0aaf0bc00bbaeeb0a84e0090983f66d464fb4 SHA256 8db3139feb4944a097bcaa1d5f87e89862c5e4c7cd425dba97e67bb4b106d498
 EBUILD glibc-2.12.1-r3.ebuild 8742 RMD160 59a9f5cf261a657ccbe3c2913b6b64ad57c61c3b SHA1 5a190f7915f945a8ebf002b55dc86c27cfbafca9 SHA256 122b698a3f2519106636fee326d72fcf2f2369eb807ef43d573197c99bb252e3
 EBUILD glibc-2.12.2.ebuild 8740 RMD160 84fddc96440cc059b1b67b65daaf5e1380d0b6d2 SHA1 5190b96eb0294f3c751a18fec0a390202a68720b SHA256 691a4677af538f61a84236a98638633a6de90f309439403efc0271f665478e0d
-EBUILD glibc-2.13.ebuild 8826 RMD160 01e91b365b030b44035e2f8600ebc1f024271894 SHA1 bd0201f11351063dda59f1310d77d17f6dd5edaa SHA256 ae6adec7cdb8d915366ef3763be8684caaf138d52b280dc33726f62fa9a6ff66
+EBUILD glibc-2.13-r1.ebuild 8615 RMD160 f660abd89da733451a54c4c8aef8f922e5bc9927 SHA1 4d16fbba7922ae1309da640a1561f96e79c379dc SHA256 1661bdd4205a1b29a41d067a93faeee3043e7c7675f73d1bf10146e36c82a5df
 EBUILD glibc-2.2.5-r10.ebuild 4847 RMD160 829dc6d11434ff2d8d202277595b0817b1a9ab28 SHA1 19523459701cabf750a777b17cbe0af34d4688dd SHA256 454a2b5d6201ab615f00c50987c7ac0328d22cc66db582851fcd27e2a967b17f
 EBUILD glibc-2.5-r4.ebuild 38511 RMD160 a3b93923cd15ace0ea30641d30afe9da9327415f SHA1 08979a91721c31fb9587e2f183f194361c4406d0 SHA256 bf1e52a7dfa6df7259bc51857f0630950a763dcb8ce70325ec2ac7651a12d333
 EBUILD glibc-2.5.1.ebuild 38586 RMD160 384dc7e6facd139bd1a27941bb2c3fcc4c7bbc8c SHA1 d97ceae0c66a229c7c80cf71e49a0b152caed27b SHA256 552d01eea084e1f9cac9980799ec67c30983063cdd790298dbe8b643b2ea18f3
@@ -83,5 +86,12 @@ EBUILD glibc-2.7-r2.ebuild 12941 RMD160 461ae1f64ad710426a485eb5593f1e13c4a618d8
 EBUILD glibc-2.8_p20080602-r1.ebuild 13488 RMD160 6b58dc46eb346a67557e5ce6b84a10a3688d649a SHA1 a89f61f4add7950715fedd27a4cc9fb68599f4c1 SHA256 f560d233bb3b0bcdda61fe6d052f54c253d43c9b31f7a2070e9b2f4003131b30
 EBUILD glibc-2.9_p20081201-r2.ebuild 7772 RMD160 ad3a0203d514fea907712ada8a9c3970267aa823 SHA1 690094c7a7b7c5a0b016f41ba519d4ecaa8a1cea SHA256 bb909d9117328ca426af80e6b6d78cb3a96b0efe03d511ead4bf8d62341f42a2
 EBUILD glibc-2.9_p20081201-r3.ebuild 7806 RMD160 6d696692a2e122bfdc149aea75368cea00bce92c SHA1 0df0da8ccd0a95084f849bdb92bfc3389efba74f SHA256 995c0e939cc7146e347d3f8caafbf4ad720a7caa7dfd0a9562f5a2877533a45c
-MISC ChangeLog 133111 RMD160 ff413f9dbee699f95e9f3afd68dca3aee13cf59f SHA1 23b406aed19783ec2ea12152a2dba73af3e6c670 SHA256 7d0a92e6e7dcf9bca359ed9301468744990c104a130516d872a3cf531a4e5be6
+MISC ChangeLog 133343 RMD160 ac4d57888f6cb791c2263f1b02328e4acae146dc SHA1 cfb60f72be1e50b7f3adbe5085a0674c26b3145b SHA256 8a3801785df21cc5bdd2acf0e701419b3c2cc2d5f60d2a0e633ca7328d1b7581
 MISC metadata.xml 539 RMD160 cf4d236b54a77b3cea382d53e4e61721bd14169b SHA1 b54ad589378da193ddc89676f8468c6d1b79521f SHA256 d7cb6dd119c81b5bf12c360af3705ca31a56ffa8bec999b44faa63c183719c31
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.17 (GNU/Linux)
+
+iF4EAREIAAYFAk1ZbosACgkQaC/OocHi7JZZngD6AjH8NR4XH8v8B7vFwj/Tbmtb
+IUNG8p3wjA6d5qx2FZQA/j2bdcIycqZfPGtEV4eTw8r93ptTvcyyLYbLwpVL2hu0
+=NuAS
+-----END PGP SIGNATURE-----
diff --git a/sys-libs/glibc/glibc-2.13-r1.ebuild b/sys-libs/glibc/glibc-2.13-r1.ebuild
new file mode 100644
index 000000000000..1794a9a615b2
--- /dev/null
+++ b/sys-libs/glibc/glibc-2.13-r1.ebuild
@@ -0,0 +1,254 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-libs/glibc/glibc-2.13-r1.ebuild,v 1.1 2011/02/14 18:03:48 vapier Exp $
+
+inherit eutils versionator libtool toolchain-funcs flag-o-matic gnuconfig multilib
+
+DESCRIPTION="GNU libc6 (also called glibc2) C library"
+HOMEPAGE="http://www.gnu.org/software/libc/libc.html"
+
+LICENSE="LGPL-2"
+KEYWORDS="~amd64 ~ia64 ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+RESTRICT="strip" # strip ourself #46186
+EMULTILIB_PKG="true"
+
+# Configuration variables
+if [[ ${PV} == *_p* ]] ; then
+RELEASE_VER=${PV%_p*}
+BRANCH_UPDATE=""
+SNAP_VER=${PV#*_p}
+else
+RELEASE_VER=${PV}
+BRANCH_UPDATE=""
+SNAP_VER=""
+fi
+MANPAGE_VER=""                                 # pregenerated manpages
+INFOPAGE_VER=""                                # pregenerated infopages
+LIBIDN_VER=""                                  # it's integrated into the main tarball now
+PATCH_VER="2"                                  # Gentoo patchset
+PORTS_VER="2.12.1"                             # version of glibc ports addon
+LT_VER=""                                      # version of linuxthreads addon
+NPTL_KERN_VER=${NPTL_KERN_VER:-"2.6.9"}        # min kernel version nptl requires
+#LT_KERN_VER=${LT_KERN_VER:-"2.4.1"}           # min kernel version linuxthreads requires
+
+IUSE="debug gd glibc-omitfp hardened multilib nls selinux profile vanilla crosscompile_opts_headers-only ${LT_VER:+glibc-compat20 nptl nptlonly}"
+S=${WORKDIR}/glibc-${RELEASE_VER}${SNAP_VER:+-${SNAP_VER}}
+
+# Here's how the cross-compile logic breaks down ...
+#  CTARGET - machine that will target the binaries
+#  CHOST   - machine that will host the binaries
+#  CBUILD  - machine that will build the binaries
+# If CTARGET != CHOST, it means you want a libc for cross-compiling.
+# If CHOST != CBUILD, it means you want to cross-compile the libc.
+#  CBUILD = CHOST = CTARGET    - native build/install
+#  CBUILD != (CHOST = CTARGET) - cross-compile a native build
+#  (CBUILD = CHOST) != CTARGET - libc for cross-compiler
+#  CBUILD != CHOST != CTARGET  - cross-compile a libc for a cross-compiler
+# For install paths:
+#  CHOST = CTARGET  - install into /
+#  CHOST != CTARGET - install into /usr/CTARGET/
+
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY/cross-} != ${CATEGORY} ]] ; then
+		export CTARGET=${CATEGORY/cross-}
+	fi
+fi
+
+[[ ${CTARGET} == hppa* ]] && NPTL_KERN_VER=${NPTL_KERN_VER/2.6.9/2.6.20}
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+alt_libdir() {
+	if is_crosscompile ; then
+		echo /usr/${CTARGET}/$(get_libdir)
+	else
+		echo /$(get_libdir)
+	fi
+}
+
+if is_crosscompile ; then
+	SLOT="${CTARGET}-2.2"
+else
+	# Why SLOT 2.2 you ask yourself while sippin your tea ?
+	# Everyone knows 2.2 > 0, duh.
+	SLOT="2.2"
+	PROVIDE="virtual/libc"
+fi
+
+# General: We need a new-enough binutils for as-needed
+# arch: we need to make sure our binutils/gcc supports TLS
+DEPEND=">=sys-devel/gcc-3.4.4
+	arm? ( >=sys-devel/binutils-2.16.90 >=sys-devel/gcc-4.1.0 )
+	x86? ( >=sys-devel/gcc-4.3 )
+	amd64? ( >=sys-devel/binutils-2.19 >=sys-devel/gcc-4.3 )
+	ppc? ( >=sys-devel/gcc-4.1.0 )
+	ppc64? ( >=sys-devel/gcc-4.1.0 )
+	>=sys-devel/binutils-2.15.94
+	${LT_VER:+nptl? (} >=sys-kernel/linux-headers-${NPTL_KERN_VER} ${LT_VER:+)}
+	>=sys-devel/gcc-config-1.3.12
+	>=app-misc/pax-utils-0.1.10
+	virtual/os-headers
+	nls? ( sys-devel/gettext )
+	>=sys-apps/sandbox-1.2.18.1-r2
+	!<sys-apps/portage-2.1.2
+	selinux? ( sys-libs/libselinux )"
+RDEPEND="!sys-kernel/ps3-sources
+	nls? ( sys-devel/gettext )
+	selinux? ( sys-libs/libselinux )"
+
+if [[ ${CATEGORY/cross-} != ${CATEGORY} ]] ; then
+	DEPEND="${DEPEND} !crosscompile_opts_headers-only? ( ${CATEGORY}/gcc )"
+	[[ ${CATEGORY} == *-linux* ]] && DEPEND="${DEPEND} ${CATEGORY}/linux-headers"
+else
+	DEPEND="${DEPEND} !vanilla? ( >=sys-libs/timezone-data-2007c )"
+	RDEPEND="${RDEPEND}
+		vanilla? ( !sys-libs/timezone-data )
+		!vanilla? ( sys-libs/timezone-data )"
+fi
+
+SRC_URI=$(
+	upstream_uris() {
+		echo mirror://gnu/glibc/$1 ftp://sources.redhat.com/pub/glibc/{releases,snapshots}/$1 mirror://gentoo/$1
+	}
+	gentoo_uris() {
+		local devspace="HTTP~vapier/dist/URI HTTP~azarah/glibc/URI"
+		devspace=${devspace//HTTP/http://dev.gentoo.org/}
+		echo mirror://gentoo/$1 ${devspace//URI/$1}
+	}
+
+	TARNAME=${PN}
+	if [[ -n ${SNAP_VER} ]] ; then
+		TARNAME="${PN}-${RELEASE_VER}"
+		[[ -n ${PORTS_VER} ]] && PORTS_VER=${SNAP_VER}
+		upstream_uris ${TARNAME}-${SNAP_VER}.tar.bz2
+	else
+		upstream_uris ${TARNAME}-${RELEASE_VER}.tar.bz2
+	fi
+	[[ -n ${LIBIDN_VER}    ]] && upstream_uris glibc-libidn-${LIBIDN_VER}.tar.bz2
+	[[ -n ${PORTS_VER}     ]] && upstream_uris ${TARNAME}-ports-${PORTS_VER}.tar.bz2
+	[[ -n ${LT_VER}        ]] && upstream_uris ${TARNAME}-linuxthreads-${LT_VER}.tar.bz2
+	[[ -n ${BRANCH_UPDATE} ]] && gentoo_uris glibc-${RELEASE_VER}-branch-update-${BRANCH_UPDATE}.patch.bz2
+	[[ -n ${PATCH_VER}     ]] && gentoo_uris glibc-${RELEASE_VER}-patches-${PATCH_VER}.tar.bz2
+	[[ -n ${MANPAGE_VER}   ]] && gentoo_uris glibc-manpages-${MANPAGE_VER}.tar.bz2
+	[[ -n ${INFOPAGE_VER}  ]] && gentoo_uris glibc-infopages-${INFOPAGE_VER}.tar.bz2
+)
+
+# eblit-include [--skip] <function> [version]
+eblit-include() {
+	local skipable=false
+	[[ $1 == "--skip" ]] && skipable=true && shift
+	[[ $1 == pkg_* ]] && skipable=true
+
+	local e v func=$1 ver=$2
+	[[ -z ${func} ]] && die "Usage: eblit-include <function> [version]"
+	for v in ${ver:+-}${ver} -${PVR} -${PV} "" ; do
+		e="${FILESDIR}/eblits/${func}${v}.eblit"
+		if [[ -e ${e} ]] ; then
+			source "${e}"
+			return 0
+		fi
+	done
+	${skipable} && return 0
+	die "Could not locate requested eblit '${func}' in ${FILESDIR}/eblits/"
+}
+
+# eblit-run-maybe <function>
+# run the specified function if it is defined
+eblit-run-maybe() {
+	[[ $(type -t "$@") == "function" ]] && "$@"
+}
+
+# eblit-run <function> [version]
+# aka: src_unpack() { eblit-run src_unpack ; }
+eblit-run() {
+	eblit-include --skip common "${*:2}"
+	eblit-include "$@"
+	eblit-run-maybe eblit-$1-pre
+	eblit-${PN}-$1
+	eblit-run-maybe eblit-$1-post
+}
+
+src_unpack()  { eblit-run src_unpack  ; }
+src_compile() { eblit-run src_compile ; }
+src_test()    { eblit-run src_test    ; }
+src_install() { eblit-run src_install ; }
+
+# FILESDIR might not be available during binpkg install
+for x in setup {pre,post}inst ; do
+	e="${FILESDIR}/eblits/pkg_${x}.eblit"
+	if [[ -e ${e} ]] ; then
+		. "${e}"
+		eval "pkg_${x}() { eblit-run pkg_${x} ; }"
+	fi
+done
+
+pkg_setup() {
+	eblit-run pkg_setup
+
+	# Static binary sanity check #332927
+	if [[ ${ROOT} == "/" ]] && \
+	   has_version "<${CATEGORY}/${P}" && \
+	   built_with_use sys-apps/coreutils static
+	then
+		eerror "Please rebuild coreutils with USE=-static, then install"
+		eerror "glibc, then you may rebuild coreutils with USE=static."
+		die "Avoiding system meltdown #332927"
+	fi
+}
+
+eblit-src_unpack-post() {
+	if use hardened ; then
+		cd "${S}"
+		einfo "Patching to get working PIE binaries on PIE (hardened) platforms"
+		gcc-specs-pie && epatch "${FILESDIR}"/2.12/glibc-2.12-hardened-pie.patch
+		epatch "${FILESDIR}"/2.10/glibc-2.10-hardened-configure-picdefault.patch
+		epatch "${FILESDIR}"/2.10/glibc-2.10-hardened-inittls-nosysenter.patch
+
+		einfo "Installing Hardened Gentoo SSP and FORTIFY_SOURCE handler"
+		cp -f "${FILESDIR}"/2.6/glibc-2.6-gentoo-stack_chk_fail.c \
+			debug/stack_chk_fail.c || die
+		cp -f "${FILESDIR}"/2.10/glibc-2.10-gentoo-chk_fail.c \
+			debug/chk_fail.c || die
+
+		if use debug ; then
+			# When using Hardened Gentoo stack handler, have smashes dump core for
+			# analysis - debug only, as core could be an information leak
+			# (paranoia).
+			sed -i \
+				-e '/^CFLAGS-backtrace.c/ iCFLAGS-stack_chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
+				debug/Makefile \
+				|| die "Failed to modify debug/Makefile for debug stack handler"
+			sed -i \
+				-e '/^CFLAGS-backtrace.c/ iCFLAGS-chk_fail.c = -DSSP_SMASH_DUMPS_CORE' \
+				debug/Makefile \
+				|| die "Failed to modify debug/Makefile for debug fortify handler"
+		fi
+
+		# Build nscd with ssp-all
+		sed -i \
+			-e 's:-fstack-protector$:-fstack-protector-all:' \
+			nscd/Makefile \
+			|| die "Failed to ensure nscd builds with ssp-all"
+	fi
+}
+
+maint_pkg_create() {
+	local base="/usr/local/src/gnu/glibc/glibc-${PV:0:1}_${PV:2:1}"
+	cd ${base}
+	local stamp=$(date +%Y%m%d)
+	local d
+	for d in libc ports ; do
+		#(cd ${d} && cvs up)
+		case ${d} in
+			libc)  tarball="${P}";;
+			ports) tarball="${PN}-ports-${PV}";;
+		esac
+		rm -f ${tarball}*
+		ln -sf ${d} ${tarball}
+		tar hcf - ${tarball} --exclude-vcs | lzma > "${T}"/${tarball}.tar.lzma
+		du -b "${T}"/${tarball}.tar.lzma
+	done
+}