From 2301479ae78d8bdd61e4b84642ef9e67abdae37b Mon Sep 17 00:00:00 2001 From: Dongsu Park Date: Fri, 28 Jan 2022 08:09:17 +0100 Subject: [PATCH 1/3] sys-libs/glibc: sync with Gentoo for 2.33-r10 Update sys-libs/glibc to 2.33-r10, mainly to address CVE-2021-3998, CVE-2021-3999, CVE-2022-23218, CVE-2022-23219. Gentoo ref: 7ba56d4da4e3fd2bc0d2c1012f2dc02e448c77d4 --- .../coreos-overlay/sys-libs/glibc/Manifest | 4 +- .../sys-libs/glibc/files/nscd-conf.tmpfiles | 2 - ...c-2.33-r7.ebuild => glibc-2.33-r10.ebuild} | 244 +++++++++++------- .../sys-libs/glibc/metadata.xml | 4 +- 4 files changed, 156 insertions(+), 98 deletions(-) delete mode 100644 sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles rename sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/{glibc-2.33-r7.ebuild => glibc-2.33-r10.ebuild} (90%) diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest index 11099d5d0f..2127377bbc 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/Manifest @@ -1,5 +1,5 @@ DIST gcc-multilib-bootstrap-20201208.tar.xz 5528452 BLAKE2B 16699a6e4df5b2f28a21776ae9e3728b26a9ea251f5580aa5349545ad7c9f6145b9cb6a12ca8f5f96b9cb2a3c70b7e66ca702e4c6f083ac00408e0a20a69e613 SHA512 a243f505e17d0a7e144e8713c077582412f61d6cf7f79baa846de4fb77f5e0f27e11c9a785e14624e04ac52287b32164e7995323aa11caef59113ac438254347 -DIST glibc-2.33-patches-6.tar.xz 64632 BLAKE2B f04ca4320d65c8796c67471cb56d3bf002cc34fb6a81075b85948e41c94df46cb2a3a944cced42d6d2c17ffc11e32a9840810864e655cc0fe18e6e0fe9f3c985 SHA512 b95746cd3415ec9ca275e542a2b5fddd5ce5680aa3bda08e94e96cf431191f7488ef6b7999ff0dfaf7405a4212531a75283e9bd7f5ae65bf572912038877a6df +DIST glibc-2.33-patches-8.tar.xz 91220 BLAKE2B 1c9aeaf2d3a58e83aec8ea6eb19776dd05e16430f25de675b467ab18d4fb438374254d06b2072b4272d089237e5f11da6d94a84c38f588b79e94e26b650f6faf SHA512 58d3f444c50e64bbf867cbcc38f4281156c7da3878674038674e1c6706b90919468af9fbd424c2dd949bc2d7d6cb36ed7be2120bb957636cad6b76e56eb54031 DIST glibc-2.33.tar.xz 17031280 BLAKE2B 703d12121c1e2c5d9e0c6ba5341f5fb5c4d9111611a83f2360029b5de9c6e5a5611249d1833684a58ed4afdf49cae614365d87ec8721ba0e5d218f593b1f229d SHA512 4cb5777b68b22b746cc51669e0e9282b43c83f6944e42656e6db7195ebb68f2f9260f130fdeb4e3cfc64efae4f58d96c43d388f52be1eb024ca448084684abdb DIST glibc-systemd-20210814.tar.gz 1469 BLAKE2B 10fa7bcb46d4fdce9c0ab353cbd30871e9b09a347a13a9c9a3b5777f931aa3c826c158d2e49532c604d4a834f2fab4089b67495fb88d0398945dc50d45ad9ef1 SHA512 5346a9ea459a1e6ccf665389f2a294de1e16f1e3e05cdf07e3dd99ed0e4f6f8b52cc333d4bff3c75ac90ab6ce70cd4ab2b3e126f920ce7979abd6dda56315efc -DIST locale-gen-2.10.tar.gz 7747 BLAKE2B 49f569c5ae5260fca128503bc6f22d6f6f1cda817920c41fdadadf1527bbb4f3eb161f79fa729830666a4673e9092f99f4685ec8fcac8ddea0b8242bca9c1f4f SHA512 e350e60d458d67638e3090711fca05af6fafac06c51b97648244549f8a0621dab7543f09dc7ad4c62392f13bdae8e5875dc6d0b6c3d83efc29d116bc2eef92db +DIST locale-gen-2.22.tar.gz 7971 BLAKE2B 2dc66fa69bf51799d0c34459b654fba6998b80a7e322e9b670036c967e269ad921f50195e6e34c4a83c1f0bad191fd5aa3f37defb82271b73acbca07b7e49d08 SHA512 9798b10dbbc792345a7b7a121dec5f4bba9839a8aec010f01a09f3402fd5bf2376f79e03a6a19bc357010db780037a8811c381136ce19be1f1370374906dff38 diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles deleted file mode 100644 index 0cf43dcb7a..0000000000 --- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles +++ /dev/null @@ -1,2 +0,0 @@ -L /etc/nscd.conf - - - - ../usr/share/baselayout/nscd.conf -d /var/db/nscd - - - - - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r7.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild similarity index 90% rename from sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r7.ebuild rename to sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild index 534ca99cef..ada616094f 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r7.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild @@ -1,9 +1,15 @@ -# Copyright 1999-2021 Gentoo Authors +# Copyright 1999-2022 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 EAPI=7 -PYTHON_COMPAT=( python3_{6..10} ) +# Bumping notes: https://wiki.gentoo.org/wiki/Project:Toolchain/sys-libs/glibc +# Please read & adapt the page as necessary if obsolete. + +# We avoid Python 3.10 here _for now_ (it does work!) to avoid circular dependencies +# on upgrades as people migrate to libxcrypt. +# https://wiki.gentoo.org/wiki/User:Sam/Portage_help/Circular_dependencies#Python_and_libcrypt +PYTHON_COMPAT=( python3_{7,8,9} ) TMPFILES_OPTIONAL=1 inherit python-any-r1 prefix preserve-libs toolchain-funcs flag-o-matic gnuconfig \ @@ -17,13 +23,13 @@ SLOT="2.2" EMULTILIB_PKG="true" # Gentoo patchset (ignored for live ebuilds) -PATCH_VER=6 +PATCH_VER=8 PATCH_DEV=dilfridge if [[ ${PV} == 9999* ]]; then inherit git-r3 else - KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" + KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" SRC_URI="mirror://gnu/glibc/${P}.tar.xz" SRC_URI+=" https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz" fi @@ -32,7 +38,7 @@ RELEASE_VER=${PV} GCC_BOOTSTRAP_VER=20201208 -LOCALE_GEN_VER=2.10 +LOCALE_GEN_VER=2.22 GLIBC_SYSTEMD_VER=20210814 @@ -172,6 +178,12 @@ XFAIL_TEST_LIST=( # https://sourceware.org/PR19329 # https://bugs.gentoo.org/719674#c12 tst-stack4 + + # The following tests fail only inside portage + # https://bugs.gentoo.org/831267 + tst-system + tst-strerror + tst-strsignal ) # @@ -404,6 +416,9 @@ setup_flags() { # #492892 filter-flags -frecord-gcc-switches + # #829583 + filter-lfs-flags + unset CBUILD_OPT CTARGET_OPT if use multilib ; then CTARGET_OPT=$(get_abi_CTARGET) @@ -505,14 +520,104 @@ setup_env() { einfo "Skip CC ABI injection. We can't use (cross-)compiler yet." return 0 fi - local VAR=CFLAGS_${ABI} + + # Glibc does not work with gold (for various reasons) #269274. + tc-ld-disable-gold + + if use doc ; then + export MAKEINFO=makeinfo + else + export MAKEINFO=/dev/null + fi + + # Reset CC and CXX to the value at start of emerge + export CC=${__ORIG_CC:-${CC:-$(tc-getCC ${CTARGET})}} + export CXX=${__ORIG_CXX:-${CXX:-$(tc-getCXX ${CTARGET})}} + + # and make sure __ORIC_CC and __ORIG_CXX is defined now. + export __ORIG_CC=${CC} + export __ORIG_CXX=${CXX} + + if tc-is-clang && ! use custom-cflags && ! is_crosscompile ; then + + # If we are running in an otherwise clang/llvm environment, we need to + # recover the proper gcc and binutils settings here, at least until glibc + # is finally building with clang. So let's override everything that is + # set in the clang profiles. + # Want to shoot yourself into the foot? Set USE=custom-cflags, that's always + # a good start into that direction. + # Also, if you're crosscompiling, let's assume you know what you are doing. + # Hopefully. + + local current_binutils_path=$(binutils-config -B) + local current_gcc_path=$(gcc-config -B) + einfo "Overriding clang configuration, since it won't work here" + + export CC="${current_gcc_path}/gcc" + export CXX="${current_gcc_path}/g++" + export LD="${current_binutils_path}/ld.bfd" + export AR="${current_binutils_path}/ar" + export AS="${current_binutils_path}/as" + export NM="${current_binutils_path}/nm" + export STRIP="${current_binutils_path}/strip" + export RANLIB="${current_binutils_path}/ranlib" + export OBJCOPY="${current_binutils_path}/objcopy" + export STRINGS="${current_binutils_path}/strings" + export OBJDUMP="${current_binutils_path}/objdump" + export READELF="${current_binutils_path}/readelf" + export ADDR2LINE="${current_binutils_path}/addr2line" + + # do we need to also do flags munging here? yes! at least... + filter-flags '-fuse-ld=*' + filter-flags '-D_FORTIFY_SOURCE=*' + + else + + # this is the "normal" case + + export CC="$(tc-getCC ${CTARGET})" + export CXX="$(tc-getCXX ${CTARGET})" + + # Always use tuple-prefixed toolchain. For non-native ABI glibc's configure + # can't detect them automatically due to ${CHOST} mismatch and fallbacks + # to unprefixed tools. Similar to multilib.eclass:multilib_toolchain_setup(). + export NM="$(tc-getNM ${CTARGET})" + export READELF="$(tc-getREADELF ${CTARGET})" + + fi + # We need to export CFLAGS with abi information in them because glibc's # configure script checks CFLAGS for some targets (like mips). Keep # around the original clean value to avoid appending multiple ABIs on - # top of each other. - : ${__GLIBC_CC:=$(tc-getCC ${CTARGET})} - export __GLIBC_CC CC="${__GLIBC_CC} ${!VAR}" - einfo " $(printf '%15s' 'Manual CC:') ${CC}" + # top of each other. (Why does the comment talk about CFLAGS if the code + # acts on CC?) + export __GLIBC_CC=${CC} + export __GLIBC_CXX=${CXX} + + export __abi_CFLAGS="$(get_abi_CFLAGS)" + + # CFLAGS can contain ABI-specific flags like -mfpu=neon, see bug #657760 + # To build .S (assembly) files with the same ABI-specific flags + # upstream currently recommends adding CFLAGS to CC/CXX: + # https://sourceware.org/PR23273 + # Note: Passing CFLAGS via CPPFLAGS overrides glibc's arch-specific CFLAGS + # and breaks multiarch support. See 659030#c3 for an example. + # The glibc configure script doesn't properly use LDFLAGS all the time. + export CC="${__GLIBC_CC} ${__abi_CFLAGS} ${CFLAGS} ${LDFLAGS}" + + # Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548 + export CXX="${__GLIBC_CXX} ${__abi_CFLAGS} ${CFLAGS}" + + if is_crosscompile; then + # Assume worst-case bootstrap: glibc is buil first time + # when ${CTARGET}-g++ is not available yet. We avoid + # building auxiliary programs that require C++: bug #683074 + # It should not affect final result. + export libc_cv_cxx_link_ok=no + # The line above has the same effect. We set CXX explicitly + # to make build logs less confusing. + export CXX= + fi } foreach_abi() { @@ -713,18 +818,31 @@ sanity_prechecks() { fi } +upgrade_warning() { + if [[ ${MERGE_TYPE} != buildonly && -n ${REPLACING_VERSIONS} && -z ${ROOT} ]]; then + local oldv newv=$(ver_cut 1-2 ${PV}) + for oldv in ${REPLACING_VERSIONS}; do + if ver_test ${oldv} -lt ${newv}; then + ewarn "After upgrading glibc, please restart all running processes." + ewarn "Be sure to include init (telinit u) or systemd (systemctl daemon-reexec)." + ewarn "Alternatively, reboot your system." + break + fi + done + fi +} + # # the phases # # pkg_pretend -# Flatcar: Skip sanity checks at pretend time because we don't ship a compiler -# in the OS image. This test fails when installing the glibc binpkg and no -# compiler is present. pkg_pretend() { - einfo "Flatcar: Skipping sanity_prechecks for binpkg installation. src_unpack will take care of compile-time prechecks." - # sanity_prechecks + # All the checks... + einfo "Checking general environment sanity." + sanity_prechecks + upgrade_warning } pkg_setup() { @@ -796,61 +914,13 @@ src_prepare() { } glibc_do_configure() { - # Glibc does not work with gold (for various reasons) #269274. - tc-ld-disable-gold - - # CXX isnt handled by the multilib system, so if we dont unset here - # we accumulate crap across abis - unset CXX - - einfo "Configuring glibc for nptl" - - if use doc ; then - export MAKEINFO=makeinfo - else - export MAKEINFO=/dev/null - fi local v - for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX LD {AS,C,CPP,CXX,LD}FLAGS MAKEINFO NM READELF; do + for v in ABI CBUILD CHOST CTARGET CBUILD_OPT CTARGET_OPT CC CXX LD {AS,C,CPP,CXX,LD}FLAGS MAKEINFO NM AR AS STRIP RANLIB OBJCOPY STRINGS OBJDUMP READELF; do einfo " $(printf '%15s' ${v}:) ${!v}" done - # CFLAGS can contain ABI-specific flags like -mfpu=neon, see bug #657760 - # To build .S (assembly) files with the same ABI-specific flags - # upstream currently recommends adding CFLAGS to CC/CXX: - # https://sourceware.org/PR23273 - # Note: Passing CFLAGS via CPPFLAGS overrides glibc's arch-specific CFLAGS - # and breaks multiarch support. See 659030#c3 for an example. - # The glibc configure script doesn't properly use LDFLAGS all the time. - export CC="$(tc-getCC ${CTARGET}) ${CFLAGS} ${LDFLAGS}" - einfo " $(printf '%15s' 'Manual CC:') ${CC}" - - # Some of the tests are written in C++, so we need to force our multlib abis in, bug 623548 - export CXX="$(tc-getCXX ${CTARGET}) $(get_abi_CFLAGS) ${CFLAGS}" - - if is_crosscompile; then - # Assume worst-case bootstrap: glibc is buil first time - # when ${CTARGET}-g++ is not available yet. We avoid - # building auxiliary programs that require C++: bug #683074 - # It should not affect final result. - export libc_cv_cxx_link_ok=no - # The line above has the same effect. We set CXX explicitly - # to make build logs less confusing. - export CXX= - fi - einfo " $(printf '%15s' 'Manual CXX:') ${CXX}" - - # Always use tuple-prefixed toolchain. For non-native ABI glibc's configure - # can't detect them automatically due to ${CHOST} mismatch and fallbacks - # to unprefixed tools. Similar to multilib.eclass:multilib_toolchain_setup(). - export NM="$(tc-getNM ${CTARGET})" - export READELF="$(tc-getREADELF ${CTARGET})" - einfo " $(printf '%15s' 'Manual NM:') ${NM}" - einfo " $(printf '%15s' 'Manual READELF:') ${READELF}" - echo - local myconf=() case ${CTARGET} in @@ -1189,13 +1259,13 @@ run_locale_gen() { root="$2" fi - local locale_list="${root}/etc/locale.gen" + local locale_list="${root%/}/etc/locale.gen" pushd "${ED}"/$(get_libdir) >/dev/null if [[ -z $(locale-gen --list --config "${locale_list}") ]] ; then [[ -z ${inplace} ]] && ewarn "Generating all locales; edit /etc/locale.gen to save time/space" - locale_list="${root}/usr/share/i18n/SUPPORTED" + locale_list="${root%/}/usr/share/i18n/SUPPORTED" fi set -- locale-gen ${inplace} --jobs $(makeopts_jobs) --config "${locale_list}" \ @@ -1223,13 +1293,12 @@ glibc_do_src_install() { # '#define VERSION "2.26.90"' -> '2.26.90' local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h) - # Flatcar: override this and strip everything to keep image size at bay # Avoid stripping binaries not targeted by ${CHOST}. Or else # ${CHOST}-strip would break binaries build for ${CTARGET}. - # is_crosscompile && dostrip -x / + is_crosscompile && dostrip -x / # gdb thread introspection relies on local libpthreas symbols. stripping breaks it # See Note [Disable automatic stripping] - # dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so + dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so if [[ -e ${ED}/$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then # Move versioned .a file out of libdir to evade portage QA checks @@ -1412,23 +1481,6 @@ glibc_do_src_install() { run_locale_gen --inplace-glibc "${ED}/" sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die fi - - ## Flatcar Container Linux: Add some local changes: - # - Config files are installed by baselayout, not glibc. - # - Install nscd/systemd stuff in /usr. - - # Use tmpfiles to put nscd.conf in /etc and create directories. - insinto /usr/share/baselayout - if ! in_iuse nscd || use nscd ; then - doins "${S}"/nscd/nscd.conf || die - newtmpfiles "${FILESDIR}"/nscd-conf.tmpfiles nscd-conf.conf || die - fi - - # Clean out any default configs. - rm -rf "${ED}"/etc - - # Restore this one for the SDK. - test ! -e "${T}"/00glibc || doenvd "${T}"/00glibc } glibc_headers_install() { @@ -1478,6 +1530,12 @@ glibc_sanity_check() { # (e.g. /var/tmp/portage:${HOSTNAME}) pushd "${ED}"/$(get_libdir) >/dev/null + # first let's find the actual dynamic linker here + # symlinks may point to the wrong abi + local newldso=$(find . -maxdepth 1 -name 'ld-*so' -type f -print -quit) + + einfo Last-minute run tests with ${newldso} in /$(get_libdir) ... + local x striptest for x in cal date env free ls true uname uptime ; do x=$(type -p ${x}) @@ -1490,7 +1548,7 @@ glibc_sanity_check() { # We need to clear the locale settings as the upgrade might want # incompatible locale data. This test is not for verifying that. LC_ALL=C \ - ./ld-*.so --library-path . ${x} > /dev/null \ + ${newldso} --library-path . ${x} > /dev/null \ || die "simple run test (${x}) failed" done @@ -1523,10 +1581,9 @@ pkg_preinst() { # Keep around libcrypt so that Perl doesn't break when merging libxcrypt # (libxcrypt is the new provider for now of libcrypt.so.{1,2}). # bug #802207 - if ! use crypt && has_version "${CATEGORY}/${PN}[crypt]"; then + if ! use crypt && has_version "${CATEGORY}/${PN}[crypt]" && ! has preserve-libs ${FEATURES}; then PRESERVED_OLD_LIBCRYPT=1 - preserve_old_lib /$(get_libdir)/libcrypt$(get_libname 1) - cp "${EROOT}"/usr/include/crypt.h "${T}"/crypt.h || die + cp -p "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" "${T}/libcrypt$(get_libname 1)" || die else PRESERVED_OLD_LIBCRYPT=0 fi @@ -1545,6 +1602,8 @@ pkg_postinst() { use compile-locales || run_locale_gen "${EROOT}/" fi + upgrade_warning + # Check for sanity of /etc/nsswitch.conf, take 2 if [[ -e ${EROOT}/etc/nsswitch.conf ]] && ! has_version sys-auth/libnss-nis ; then local entry @@ -1561,10 +1620,11 @@ pkg_postinst() { fi if [[ ${PRESERVED_OLD_LIBCRYPT} -eq 1 ]] ; then + cp -p "${T}/libcrypt$(get_libname 1)" "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1)" || die preserve_old_lib_notify /$(get_libdir)/libcrypt$(get_libname 1) - cp "${T}"/crypt.h "${EROOT}"/usr/include/crypt.h || eerror "Error restoring crypt.h, please file a bug" + elog "Please ignore a possible later error message about a file collision involving" - elog "/usr/include/crypt.h. We need to preserve this file for the moment to keep" + elog "${EROOT}/$(get_libdir)/libcrypt$(get_libname 1). We need to preserve this file for the moment to keep" elog "the upgrade working, but it also needs to be overwritten when" elog "sys-libs/libxcrypt is installed. See bug 802210 for more details." fi diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/metadata.xml b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/metadata.xml index 7dc64b63dd..613e58eff7 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/metadata.xml +++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/metadata.xml @@ -1,5 +1,5 @@ - + toolchain@gentoo.org @@ -7,6 +7,7 @@ Enable Intel Control-flow Enforcement Technology (needs binutils 2.29 and gcc 8) + Enable the new clone3 syscall within glibc. Can be disabled to allow compatibility with older Electron applications. build *all* locales in src_install; this is generally meant for stage building only as it ignores /etc/locale.gen file and can be pretty slow build and install libcrypt and crypt.h When USE=hardened, allow fortify/stack violations to dump core (SIGABRT) and not kill self (SIGKILL) @@ -14,7 +15,6 @@ enable optimizations for multiple CPU architectures (detected at runtime) Provide prebuilt libgcc.a and crt files if missing. Only needed for ABI switch. Build, and enable support for, the Name Service Cache Daemon - Enable obsolete RPC/NIS layers protect stack of glibc internals Enable static PIE support (runtime files for -static-pie gcc option). Make internal pt_chown helper setuid -- not needed if using Linux and have /dev/pts mounted with gid=5 From a752947aec9670a6468723f9069561e1bc0fcc62 Mon Sep 17 00:00:00 2001 From: Krzesimir Nowak Date: Wed, 15 Dec 2021 20:48:57 +0100 Subject: [PATCH 2/3] sys-libs/glibc: Apply Flatcar modifications - unmask amd64 and arm64 - take care of nscd.conf via tmpfiles, add files/nscd-conf.tmpfiles. - don't run sanity checks in pkg_pretend to prevent gcc checks when only the binary package is installed. - comment out 'dostrip -x' to force the OS image binaries to be stripped - remove everything glibc wants to put under /etc since we use baselayout to provide that --- .../sys-libs/glibc/files/nscd-conf.tmpfiles | 2 ++ .../sys-libs/glibc/glibc-2.33-r10.ebuild | 32 +++++++++++++++---- 2 files changed, 28 insertions(+), 6 deletions(-) create mode 100644 sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles new file mode 100644 index 0000000000..0cf43dcb7a --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/files/nscd-conf.tmpfiles @@ -0,0 +1,2 @@ +L /etc/nscd.conf - - - - ../usr/share/baselayout/nscd.conf +d /var/db/nscd - - - - - diff --git a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild index ada616094f..0a9c733319 100644 --- a/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/sys-libs/glibc/glibc-2.33-r10.ebuild @@ -29,7 +29,7 @@ PATCH_DEV=dilfridge if [[ ${PV} == 9999* ]]; then inherit git-r3 else - KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" + KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" SRC_URI="mirror://gnu/glibc/${P}.tar.xz" SRC_URI+=" https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz" fi @@ -838,10 +838,12 @@ upgrade_warning() { # pkg_pretend +# Flatcar: Skip sanity checks at pretend time because we don't ship a compiler +# in the OS image. This test fails when installing the glibc binpkg and no +# compiler is present. pkg_pretend() { - # All the checks... - einfo "Checking general environment sanity." - sanity_prechecks + einfo "Flatcar: Skipping sanity_prechecks for binpkg installation. src_unpack will take care of compile-time prechecks." + # sanity_prechecks upgrade_warning } @@ -1293,12 +1295,13 @@ glibc_do_src_install() { # '#define VERSION "2.26.90"' -> '2.26.90' local upstream_pv=$(sed -n -r 's/#define VERSION "(.*)"/\1/p' "${S}"/version.h) + # Flatcar: override this and strip everything to keep image size at bay # Avoid stripping binaries not targeted by ${CHOST}. Or else # ${CHOST}-strip would break binaries build for ${CTARGET}. - is_crosscompile && dostrip -x / + # is_crosscompile && dostrip -x / # gdb thread introspection relies on local libpthreas symbols. stripping breaks it # See Note [Disable automatic stripping] - dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so + # dostrip -x $(alt_libdir)/libpthread-${upstream_pv}.so if [[ -e ${ED}/$(alt_usrlibdir)/libm-${upstream_pv}.a ]] ; then # Move versioned .a file out of libdir to evade portage QA checks @@ -1481,6 +1484,23 @@ glibc_do_src_install() { run_locale_gen --inplace-glibc "${ED}/" sed -e 's:COMPILED_LOCALES="":COMPILED_LOCALES="1":' -i "${ED}"/usr/sbin/locale-gen || die fi + + ## Flatcar Container Linux: Add some local changes: + # - Config files are installed by baselayout, not glibc. + # - Install nscd/systemd stuff in /usr. + + # Use tmpfiles to put nscd.conf in /etc and create directories. + insinto /usr/share/baselayout + if ! in_iuse nscd || use nscd ; then + doins "${S}"/nscd/nscd.conf || die + newtmpfiles "${FILESDIR}"/nscd-conf.tmpfiles nscd-conf.conf || die + fi + + # Clean out any default configs. + rm -rf "${ED}"/etc + + # Restore this one for the SDK. + test ! -e "${T}"/00glibc || doenvd "${T}"/00glibc } glibc_headers_install() { From 27bd0429a0ae1b68d46f2de97292bf7e9719e86f Mon Sep 17 00:00:00 2001 From: Dongsu Park Date: Fri, 28 Jan 2022 08:34:42 +0100 Subject: [PATCH 3/3] changelog: add changelog for glibc 2.33-r10 --- .../changelog/security/2022-01-28-glibc-2.33-r10.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/security/2022-01-28-glibc-2.33-r10.md diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/security/2022-01-28-glibc-2.33-r10.md b/sdk_container/src/third_party/coreos-overlay/changelog/security/2022-01-28-glibc-2.33-r10.md new file mode 100644 index 0000000000..61d88af1f4 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/changelog/security/2022-01-28-glibc-2.33-r10.md @@ -0,0 +1 @@ +- glibc ([CVE-2021-3998](https://nvd.nist.gov/vuln/detail/CVE-2021-3998), [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999), [CVE-2022-23218](https://nvd.nist.gov/vuln/detail/CVE-2022-23218), [CVE-2022-23219](https://nvd.nist.gov/vuln/detail/CVE-2022-23219))