On Fri, Nov 04, 2011 at 01:59:14PM +0100, "Paweł Hajdan, Jr." wrote:
> check_extra_config requires a configured kernel
> (/usr/src/linux/.config), while I think it should also be satisfied by
> /proc/config.gz (i.e. just a way to verify the config, not necessarily
> kernel built locally).
> 
> An example use case is www-client/chromium, which makes sure the kernel
> will support its sandbox. It's generally a bad idea to run without full
> sandboxing support (it can work without kernel support, just doesn't
> prevent a compromised renderer from connecting to network or sending
> signals to processes).
chromium is using CONFIG_CHECK wrongly.
It should be CONFIG_CHECK="~PID_NS ~NET_NS"

- Does the package _build_ kernel modules?
  Yes: .config is required. 
  No: .config is NOT required. All options must have '~' prefix.
- Does the package use the options specified _during_ src_configure,
  src_compile, src_test process?
  (eg there's a testsuite that uses namespaces).
  Yes: .config/config.gz may not be available, devise an actual test
  that tries to use the option.
  No: Just keep the ~ prefix on the option.

> # In the case where we don't require a .config, we can now bail out
> # if the user has no .config as there is nothing to do. Otherwise
> # code later will cause a failure due to missing .config.
> if ! linux_config_exists; then
[snip]
> fi
This will cause out-of-kernel module building to fail much later instead
of correctly failing early when there is no .config.

-- 
Robin Hugh Johnson
Gentoo Linux: Developer, Trustee & Infrastructure Lead
E-Mail     : robbat2@g.o
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85