aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMagnus Granberg <zorry@ume.nu>2009-09-05 18:38:50 +0200
committerMagnus Granberg <zorry@ume.nu>2009-09-05 18:38:50 +0200
commite64261f297641dd86dab8a841dec2f1c5621166f (patch)
tree5d3d04ceb45486d9ec80ebd24b0e81154e294d21 /sys-boot
parentAdd myself to list (diff)
downloadhardened-dev-e64261f297641dd86dab8a841dec2f1c5621166f.tar.gz
hardened-dev-e64261f297641dd86dab8a841dec2f1c5621166f.tar.bz2
hardened-dev-e64261f297641dd86dab8a841dec2f1c5621166f.zip
Added sys-boot/grub-0.97-r11 for testing the Grub2 -fPIE check
Diffstat (limited to 'sys-boot')
-rw-r--r--sys-boot/grub/ChangeLog10
-rw-r--r--sys-boot/grub/Manifest4
-rw-r--r--sys-boot/grub/files/grub-0.97-fpie_check.patch53
-rw-r--r--sys-boot/grub/grub-0.97-r11.ebuild282
-rw-r--r--sys-boot/grub/metadata.xml8
5 files changed, 357 insertions, 0 deletions
diff --git a/sys-boot/grub/ChangeLog b/sys-boot/grub/ChangeLog
new file mode 100644
index 00000000..7df0cf86
--- /dev/null
+++ b/sys-boot/grub/ChangeLog
@@ -0,0 +1,10 @@
+# ChangeLog for sys-boot/grub
+# Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
+# $Header: $
+
+*grub-0.97-r11 (05 Sep 2009)
+
+ 05 Sep 2009; Magnus Granberg <zorry@ume.nu> +grub-0.97-r11.ebuild,
+ +files/grub-0.97-fpie_check.patch, +metadata.xml:
+ Ported the -fPIE check from Grub2 Revision 2564
+
diff --git a/sys-boot/grub/Manifest b/sys-boot/grub/Manifest
index 8760baca..e64e27ef 100644
--- a/sys-boot/grub/Manifest
+++ b/sys-boot/grub/Manifest
@@ -1,6 +1,10 @@
+AUX grub-0.97-fpie_check.patch 1426 RMD160 a1b2f494e50f67fd3327eced036f6a96473d5085 SHA1 3267e7615bd67da70383b34191457d77c36a5145 SHA256 41a7990d9ffa50fc41e0a542f372c193e6b649c02d522002816fdaf9faa60dd9
AUX grub-0.97-gcc4-hardened.patch 462 RMD160 f1429fd7ebddede7dcc243e897ae3ff24ee19e06 SHA1 75860a643ac0588ef60fcc8e26fca734b11b3dae SHA256 24f135ba1404ac68a379d21885563adec58a38a7e2c05735a9328cd78aef19c2
AUX grub.conf.gentoo 659 RMD160 9ab841d6fdd03be3f99f109ed3dfe0a5027e66d2 SHA1 26455e5c3ba2043be970bf64ce2386119fd35f30 SHA256 5e3a209af537090456546704e52e0dee8f8600944a34184f79776523cdaa9a25
DIST grub-0.97-patches-1.9.tar.bz2 51809 RMD160 a745902212dbd22f4d9f0bb0d563ffd44b429eaa SHA1 1d9da2df8bccef9821ebbbc2f5c5353dbd90bf4d SHA256 6b8445c9260803f059031cbe7475a45fee6499fc2dbd911288af6169455c4028
DIST grub-0.97.tar.gz 971783 RMD160 7fb5674edf0c950bd38e94f85ff1e2909aa741f0 SHA1 2580626c4579bd99336d3af4482c346c95dac4fb SHA256 4e1d15d12dbd3e9208111d6b806ad5a9857ca8850c47877d36575b904559260b
DIST splash.xpm.gz 33856 RMD160 2fead61f91c368429e80936248bb02af2bdf15ff SHA1 98e679f9698be43426f971f89a088c053e8c804a SHA256 b95600f777331b0dd31d51c68f60f0e846e4c8b628857a41165f4e6b30e6acaf
EBUILD grub-0.97-r10.ebuild 9101 RMD160 f7616847570e143952587dc1aa1dd2737c60041a SHA1 24110a0dbff3b596fcb8ef12afb7d6ad840138cd SHA256 46bf359b9805b1b4b06b46f3d4bef0903df61d41e296660c7ce0ea8d178c146a
+EBUILD grub-0.97-r11.ebuild 9157 RMD160 f587abcc95ea54c87bdee283fbd29327700ce130 SHA1 ccb416e530227946685d0216f87e48d9246fce74 SHA256 77e916e3e0e1dbc547c5a97baa01c994e09ac09c4cc0c6dda21ed5c48d136c7d
+MISC ChangeLog 316 RMD160 bebb6be3f4e80306483c8fc2b1385c43ea55b265 SHA1 b018a0a5204f94b3d8644ab50cfdb5f6f163aaf9 SHA256 c33bf392151e2e9f5409a332acf24b06ca379fa9b1c1d4130275eb80be474f7f
+MISC metadata.xml 262 RMD160 afabce9377772aefb54102e9ef237de6bb1561f5 SHA1 c38f9b99d8a84beb40c114283d8d7ddd4ac43d9e SHA256 35a9c56d9c8418806062854a360c27690d25159524df71f28bbd4d644e8706f3
diff --git a/sys-boot/grub/files/grub-0.97-fpie_check.patch b/sys-boot/grub/files/grub-0.97-fpie_check.patch
new file mode 100644
index 00000000..63844668
--- /dev/null
+++ b/sys-boot/grub/files/grub-0.97-fpie_check.patch
@@ -0,0 +1,53 @@
+2009-09-05 Magnus Granberg <zorry@ume.nu>
+
+ # #139277 #168834 #281246
+ * configure.ac: Add grub_CHECK_PIE. It check if the compiler
+ include -fPIE in the default specs.
+ * configure.ac: Check if pie_possible is yes and add -nopie
+ to STAGE1_CFLAGS and STAGE2_CFLAGS.
+
+--- configure.ac.zorry 2009-09-05 15:54:43.000000000 +0200
++++ configure.ac 2009-09-05 16:35:48.000000000 +0200
+@@ -110,6 +110,42 @@
+ fi
+ fi
+
++AC_DEFUN(grub_CHECK_PIE,[
++[# Position independent executable.
++pie_possible=yes]
++AC_MSG_CHECKING([whether `$CC' has `-fPIE' as default])
++# Is this a reliable test case?
++AC_LANG_CONFTEST([[
++#ifdef __PIE__
++int main() {
++ return 0;
++}
++#else
++#error NO __PIE__ DEFINED
++#endif
++]])
++
++[# `$CC -c -o ...' might not be portable. But, oh, well... Is calling
++# `ac_compile' like this correct, after all?
++if eval "$ac_compile -S -o conftest.s" 2> /dev/null; then]
++ AC_MSG_RESULT([yes])
++ [# Should we clear up other files as well, having called `AC_LANG_CONFTEST'?
++ rm -f conftest.s
++else
++ pie_possible=no]
++ AC_MSG_RESULT([no])
++[fi]
++])
++
++# Position independent executable.
++grub_CHECK_PIE
++[# Need that, because some distributions ship compilers that include
++# `-fPIE' in the default specs.
++if [ x"$pie_possible" = xyes ]; then
++ STAGE1_CFLAGS="$STAGE1_CFLAGS -nopie"
++ STAGE2_CFLAGS="$STAGE2_CFLAGS -nopie"
++fi]
++
+ AC_SUBST(STAGE1_CFLAGS)
+ AC_SUBST(STAGE2_CFLAGS)
+ AC_SUBST(GRUB_CFLAGS)
diff --git a/sys-boot/grub/grub-0.97-r11.ebuild b/sys-boot/grub/grub-0.97-r11.ebuild
new file mode 100644
index 00000000..59b92fa6
--- /dev/null
+++ b/sys-boot/grub/grub-0.97-r11.ebuild
@@ -0,0 +1,282 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/grub-0.97-r11.ebuild,v 1.56 2009/08/14 18:46:05 zorry Exp $
+
+# XXX: we need to review menu.lst vs grub.conf handling. We've been converting
+# all systems to grub.conf (and symlinking menu.lst to grub.conf), but
+# we never updated any of the source code (it still all wants menu.lst),
+# and there is no indication that upstream is making the transition.
+
+inherit mount-boot eutils flag-o-matic toolchain-funcs autotools linux-info
+
+PATCHVER="1.9" # Should match the revision ideally
+DESCRIPTION="GNU GRUB Legacy boot loader"
+HOMEPAGE="http://www.gnu.org/software/grub/"
+SRC_URI="mirror://gentoo/${P}.tar.gz
+ ftp://alpha.gnu.org/gnu/${PN}/${P}.tar.gz
+ mirror://gentoo/splash.xpm.gz
+ mirror://gentoo/${P}-patches-${PATCHVER}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 x86 ~x86-fbsd"
+IUSE="custom-cflags ncurses netboot static"
+
+DEPEND="ncurses? (
+ >=sys-libs/ncurses-5.2-r5
+ amd64? ( app-emulation/emul-linux-x86-baselibs )
+ )"
+PROVIDE="virtual/bootloader"
+
+pkg_setup() {
+ local arch="$(tc-arch)"
+ case ${arch} in
+ amd64) CONFIG_CHECK='~IA32_EMULATION' check_extra_config ;;
+ esac
+}
+
+src_unpack() {
+ unpack ${A}
+ cd "${S}"
+
+ # patch breaks booting for some people #111885
+ rm "${WORKDIR}"/patch/400_*
+
+ # Grub will not handle a kernel larger than EXTENDED_MEMSIZE Mb as
+ # discovered in bug 160801. We can change this, however, using larger values
+ # for this variable means that Grub needs more memory to run and boot. For a
+ # kernel of size N, Grub needs (N+1)*2. Advanced users should set a custom
+ # value in make.conf, it is possible to make kernels ~16Mb in size, but it
+ # needs the kitchen sink built-in.
+ local t="custom"
+ if [[ -z ${GRUB_MAX_KERNEL_SIZE} ]] ; then
+ case $(tc-arch) in
+ amd64) GRUB_MAX_KERNEL_SIZE=7 ;;
+ x86) GRUB_MAX_KERNEL_SIZE=3 ;;
+ esac
+ t="default"
+ fi
+ einfo "Grub will support the ${t} maximum kernel size of ${GRUB_MAX_KERNEL_SIZE} Mb (GRUB_MAX_KERNEL_SIZE)"
+
+ sed -i \
+ -e "/^#define.*EXTENDED_MEMSIZE/s,3,${GRUB_MAX_KERNEL_SIZE},g" \
+ "${S}"/grub/asmstub.c \
+ || die "Failed to hack memory size"
+
+ # Bug #279536 sys-boot/grub-0.97 segfaults with >=sys-devel/gcc-4.1 SSP
+ epatch "${FILESDIR}"/grub-0.97-gcc4-hardened.patch
+
+ # Bugs #139277 #168834 #281246
+ epatch "${FILESDIR}"/grub-0.97-fpie_check.patch
+
+ if [[ -n ${PATCHVER} ]] ; then
+ EPATCH_SUFFIX="patch"
+ epatch "${WORKDIR}"/patch
+ eautoreconf
+ fi
+}
+
+src_compile() {
+
+ use amd64 && multilib_toolchain_setup x86
+
+ unset BLOCK_SIZE #73499
+
+ ### i686-specific code in the boot loader is a bad idea; disabling to ensure
+ ### at least some compatibility if the hard drive is moved to an older or
+ ### incompatible system.
+
+ # grub-0.95 added -fno-stack-protector detection, to disable ssp for stage2,
+ # but the objcopy's (faulty) test fails if -fstack-protector is default.
+ # create a cache telling configure that objcopy is ok, and add -C to econf
+ # to make use of the cache.
+ #
+ # CFLAGS has to be undefined running econf, else -fno-stack-protector detection fails.
+ # STAGE2_CFLAGS is not allowed to be used on emake command-line, it overwrites
+ # -fno-stack-protector detected by configure, removed from netboot's emake.
+ use custom-cflags || unset CFLAGS
+
+ export grub_cv_prog_objcopy_absolute=yes #79734
+ use static && append-ldflags -static
+
+ # Per bug 216625, the emul packages do not provide .a libs for performing
+ # suitable static linking
+ if use amd64 && use static ; then
+ if [ -z "${GRUB_STATIC_PACKAGE_BUILDING}" ]; then
+ die "You must use the grub-static package if you want a static Grub on amd64!"
+ else
+ eerror "You have set GRUB_STATIC_PACKAGE_BUILDING. This"
+ eerror "is specifically intended for building the tarballs for the"
+ eerror "grub-static package via USE='static -ncurses'."
+ eerror "All bets are now off."
+ ebeep 10
+ fi
+ fi
+
+ # build the net-bootable grub first, but only if "netboot" is set
+ if use netboot ; then
+ econf \
+ --libdir=/lib \
+ --datadir=/usr/lib/grub \
+ --exec-prefix=/ \
+ --disable-auto-linux-mem-opt \
+ --enable-diskless \
+ --enable-{3c{5{03,07,09,29,95},90x},cs89x0,davicom,depca,eepro{,100}} \
+ --enable-{epic100,exos205,ni5210,lance,ne2100,ni{50,65}10,natsemi} \
+ --enable-{ne,ns8390,wd,otulip,rtl8139,sis900,sk-g16,smc9000,tiara} \
+ --enable-{tulip,via-rhine,w89c840} || die "netboot econf failed"
+
+ emake w89c840_o_CFLAGS="-O" || die "making netboot stuff"
+
+ mv -f stage2/{nbgrub,pxegrub} "${S}"/
+ mv -f stage2/stage2 stage2/stage2.netboot
+
+ make clean || die "make clean failed"
+ fi
+
+ # Now build the regular grub
+ # Note that FFS and UFS2 support are broken for now - stage1_5 files too big
+ econf \
+ --libdir=/lib \
+ --datadir=/usr/lib/grub \
+ --exec-prefix=/ \
+ --disable-auto-linux-mem-opt \
+ $(use_with ncurses curses) \
+ || die "econf failed"
+
+ # sanity check due to common failure
+ use ncurses && ! grep -qs "HAVE_LIBCURSES.*1" config.h && die "USE=ncurses but curses not found"
+
+ emake || die "making regular stuff"
+}
+
+src_test() {
+ # non-default block size also give false pass/fails.
+ unset BLOCK_SIZE
+ make check || die "make check failed"
+}
+
+src_install() {
+ emake DESTDIR="${D}" install || die
+ if use netboot ; then
+ exeinto /usr/lib/grub/${CHOST}
+ doexe nbgrub pxegrub stage2/stage2.netboot || die "netboot install"
+ fi
+
+ dodoc AUTHORS BUGS ChangeLog NEWS README THANKS TODO
+ newdoc docs/menu.lst grub.conf.sample
+ dodoc "${FILESDIR}"/grub.conf.gentoo
+ prepalldocs
+
+ [ -n "${GRUB_STATIC_PACKAGE_BUILDING}" ] && \
+ mv \
+ "${D}"/usr/share/doc/${PF} \
+ "${D}"/usr/share/doc/grub-static-${PF/grub-}
+
+ insinto /usr/share/grub
+ doins "${DISTDIR}"/splash.xpm.gz
+}
+
+setup_boot_dir() {
+ local boot_dir=$1
+ local dir=${boot_dir}
+
+ mkdir -p "${dir}"
+ [[ ! -L ${dir}/boot ]] && ln -s . "${dir}/boot"
+ dir="${dir}/grub"
+ if [[ ! -e ${dir} ]] ; then
+ mkdir "${dir}" || die "${dir} does not exist!"
+ fi
+
+ # change menu.lst to grub.conf
+ if [[ ! -e ${dir}/grub.conf ]] && [[ -e ${dir}/menu.lst ]] ; then
+ mv -f "${dir}"/menu.lst "${dir}"/grub.conf
+ ewarn
+ ewarn "*** IMPORTANT NOTE: menu.lst has been renamed to grub.conf"
+ ewarn
+ fi
+
+ if [[ ! -e ${dir}/menu.lst ]]; then
+ einfo "Linking from new grub.conf name to menu.lst"
+ ln -snf grub.conf "${dir}"/menu.lst
+ fi
+
+ if [[ -e ${dir}/stage2 ]] ; then
+ mv "${dir}"/stage2{,.old}
+ ewarn "*** IMPORTANT NOTE: you must run grub and install"
+ ewarn "the new version's stage1 to your MBR. Until you do,"
+ ewarn "stage1 and stage2 will still be the old version, but"
+ ewarn "later stages will be the new version, which could"
+ ewarn "cause problems such as an unbootable system."
+ ewarn "This means you must use either grub-install or perform"
+ ewarn "root/setup manually! For more help, see the handbook:"
+ ewarn "http://www.gentoo.org/doc/en/handbook/handbook-${ARCH}.xml?part=1&chap=10#grub-install-auto"
+ ebeep
+ fi
+
+ einfo "Copying files from /lib/grub, /usr/lib/grub and /usr/share/grub to ${dir}"
+ for x in \
+ "${ROOT}"/lib*/grub/*/* \
+ "${ROOT}"/usr/lib*/grub/*/* \
+ "${ROOT}"/usr/share/grub/* ; do
+ [[ -f ${x} ]] && cp -p "${x}" "${dir}"/
+ done
+
+ if [[ ! -e ${dir}/grub.conf ]] ; then
+ s="${ROOT}/usr/share/doc/${PF}/grub.conf.gentoo"
+ [[ -e "${s}" ]] && cat "${s}" >${dir}/grub.conf
+ [[ -e "${s}.gz" ]] && zcat "${s}.gz" >${dir}/grub.conf
+ [[ -e "${s}.bz2" ]] && bzcat "${s}.bz2" >${dir}/grub.conf
+ fi
+
+ # Per bug 218599, we support grub.conf.install for users that want to run a
+ # specific set of Grub setup commands rather than the default ones.
+ grub_config=${dir}/grub.conf.install
+ [[ -e ${grub_config} ]] || grub_config=${dir}/grub.conf
+ if [[ -e ${grub_config} ]] ; then
+ egrep \
+ -v '^[[:space:]]*(#|$|default|fallback|initrd|password|splashimage|timeout|title)' \
+ "${grub_config}" | \
+ /sbin/grub --batch \
+ --device-map="${dir}"/device.map \
+ > /dev/null
+ fi
+
+ # the grub default commands silently piss themselves if
+ # the default file does not exist ahead of time
+ if [[ ! -e ${dir}/default ]] ; then
+ grub-set-default --root-directory="${boot_dir}" default
+ fi
+ einfo "Grub has been installed to ${boot_dir} successfully."
+}
+
+pkg_postinst() {
+ if [[ -n ${DONT_MOUNT_BOOT} ]]; then
+ elog "WARNING: you have DONT_MOUNT_BOOT in effect, so you must apply"
+ elog "the following instructions for your /boot!"
+ elog "Neglecting to do so may cause your system to fail to boot!"
+ elog
+ else
+ setup_boot_dir "${ROOT}"/boot
+ # Trailing output because if this is run from pkg_postinst, it gets mixed into
+ # the other output.
+ einfo ""
+ fi
+ elog "To interactively install grub files to another device such as a USB"
+ elog "stick, just run the following and specify the directory as prompted:"
+ elog " emerge --config =${PF}"
+ elog "Alternately, you can export GRUB_ALT_INSTALLDIR=/path/to/use to tell"
+ elog "grub where to install in a non-interactive way."
+
+}
+
+pkg_config() {
+ local dir
+ if [ ! -d "${GRUB_ALT_INSTALLDIR}" ]; then
+ einfo "Enter the directory where you want to setup grub:"
+ read dir
+ else
+ dir="${GRUB_ALT_INSTALLDIR}"
+ fi
+ setup_boot_dir "${dir}"
+}
diff --git a/sys-boot/grub/metadata.xml b/sys-boot/grub/metadata.xml
new file mode 100644
index 00000000..6684143e
--- /dev/null
+++ b/sys-boot/grub/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>base-system</herd>
+<use>
+ <flag name='multislot'>Allow grub1 and grub2 to be installed simultaneously</flag>
+</use>
+</pkgmetadata>