[gentoo-hardened] modification of packages according to two bugs for hardened-gcc

[Alexander Gabert]

hi,

the following packages have been updated with changes for supporting
hgcc on my local copy and will be committed soon if no one bothers.
i also slept about replacing has_version with is_installed

here we go!

diff -u -r -N portage/sys-apps/devfsd/devfsd-1.3.25-r4.ebuild
portage.PAPPY/sys-apps/devfsd/devfsd-1.3.25-r4.ebuild
--- portage/sys-apps/devfsd/devfsd-1.3.25-r4.ebuild 2003-08-03
21:34:53.000000000 +0000
+++ portage.PAPPY/sys-apps/devfsd/devfsd-1.3.25-r4.ebuild   2003-09-04
16:20:07.000000000 +0000
@@ -23,6 +23,11 @@
    cd ${S}
    epatch ${FILESDIR}/${P}-kernel-2.5.patch.bz2
    
+   if has_version 'sys-devel/hardened-gcc' && [ ${CC} = "gcc" ]; then
+       einfo "hardened-gcc: adding ${CC} -yet_exec ${CFLAGS}"
+       CFLAGS="-yet_exec ${CFLAGS}"
+   fi
+
    sed -e "s:-O2:${CFLAGS}:g" \
        -e 's:/usr/man:/usr/share/man:' \
        -e '32,34d;11,16d' -e '6c\' \
diff -u -r -N portage/sys-apps/grub/grub-0.93.20030118.ebuild
portage.PAPPY/sys-apps/grub/grub-0.93.20030118.ebuild
--- portage/sys-apps/grub/grub-0.93.20030118.ebuild 2003-07-27
19:12:44.000000000 +0000
+++ portage.PAPPY/sys-apps/grub/grub-0.93.20030118.ebuild   2003-09-04
16:54:33.000000000 +0000
@@ -42,6 +42,11 @@
 
    use static && export LDFLAGS="${LDFLAGS} -static"
                                                                                                                                               
+   if has_version 'sys-devel/hardened-gcc' && [ ${CC} = "gcc" ]; then
+       einfo "hardened-gcc: adding ${CC} -yet_exec"
+       CC="${CC} -yet_exec"
+   fi
+
    econf --exec-prefix=/ \
        --disable-auto-linux-mem-opt || die
    emake || die
diff -u -r -N portage/sys-apps/lilo/lilo-22.5.7.2.ebuild
portage.PAPPY/sys-apps/lilo/lilo-22.5.7.2.ebuild
--- portage/sys-apps/lilo/lilo-22.5.7.2.ebuild  2003-09-01
19:24:55.000000000 +0000
+++ portage.PAPPY/sys-apps/lilo/lilo-22.5.7.2.ebuild    2003-09-04
16:36:47.000000000 +0000
@@ -41,7 +41,16 @@
 }

 src_compile() {
-   emake CC="${CC:=gcc}" lilo || die
+
+   # http://www.gentoo.org/proj/en/hardened/etdyn-ssp.xml
+   # sys-apps/lilo is using inline assembler, hardened-gcc does not
like this
+   # when autocompiling for etdyn and position independent executables
+   if has_version 'sys-devel/hardened-gcc'; then
+       einfo "hardened-gcc: adding ${CC} -yet_exec"
+       emake CC="${CC:=gcc} -yet_exec" lilo || die 
+   else
+       emake CC="${CC:=gcc}" lilo || die
+   fi
 }

 src_install() {
diff -u -r -N
portage/sys-apps/module-init-tools/module-init-tools-0.9.13_pre2.ebuild
portage.PAPPY/sys-apps/module-init-tools/module-init-tools-0.9.13_pre2.ebuild
---
portage/sys-apps/module-init-tools/module-init-tools-0.9.13_pre2.ebuild
2003-08-10 20:45:13.000000000 +0000
+++
portage.PAPPY/sys-apps/module-init-tools/module-init-tools-0.9.13_pre2.ebuild   2003-09-04 18:18:05.000000000 +0000
@@ -66,6 +66,11 @@
    einfo "Building modutils..."
    cd ${WORKDIR}/modutils-${MODUTILS_PV}

+    if has_version 'sys-devel/hardened-gcc' && [ ${CC} = "gcc" ]; then
+        einfo "hardened-gcc: adding ${CC} -yet_exec ${CFLAGS}"
+        CFLAGS="${CFLAGS}
-yet_exec"                                                                                                           
+    fi
+
    econf \
        --disable-strip \
        --prefix=/ \
diff -u -r -N portage/sys-apps/modutils/modutils-2.4.25.ebuild
portage.PAPPY/sys-apps/modutils/modutils-2.4.25.ebuild
--- portage/sys-apps/modutils/modutils-2.4.25.ebuild    2003-07-06
09:17:58.000000000 +0000
+++ portage.PAPPY/sys-apps/modutils/modutils-2.4.25.ebuild  2003-09-04
18:11:20.000000000 +0000
@@ -28,6 +28,11 @@
    # version do not want to autoload modules :(
    myconf="${myconf} --disable-zlib"

+    if has_version 'sys-devel/hardened-gcc' && [ ${CC} = "gcc" ]; then
+        einfo "hardened-gcc: adding ${CC} -yet_exec ${CFLAGS}"
+        CFLAGS="${CFLAGS} -yet_exec"
+    fi
+
    econf \
        --prefix=/ \
        --disable-strip \

from the simplific nature of these changes, we can see that most of the
times, CFLAGS is used for adding the compatibility flags for
hardened-gcc.

if you find packages with broken ASM inline or malfunctioning
./configure or make, feel free to open bugs to pappy@g.o with
this according bugfix enlisted: you can always add -yet_exec for proper
operation when hardened-gcc is found on the machine respectively.

just take care that sometimes the CC is better than CFLAGS because they
may get stuck and dismissed by borken Makefiles and build processes ;-)

mplayer and libmpeg3 still need appropriate treatment in this direction.

most of the packages we compiled so far in system and world are immune
to such errors or like util-linux have been made compatible by solar
and/or me because of the importance of the package.

nevertheless there will be special cases where people decide to use
hardened-gcc to compile software that relies on assembler inline
constructions and/or uses broken misleading configure magic.

for these packages we have decided to introduce this "ignore" logic that
will compile the package as yet_exec as long as it cannot be made
totally PIC compileable.

But it has always been the high goal of hardened-gcc to protect server
based environments with a strong subset of given applications like smtp,
dns and http.

if such an "exposed" problematic package is found that should not be
made "ignorant" of hardened-gcc but should be made compatible and et-dyn
for proper protection by PaX in the kernel, please feel free to contact
me directly to ask for further help in processing it.

have fun and enjoy the weekend!

sincerely,

Alex


--
gentoo-hardened@g.o mailing list