Initial commit
This commit is contained in:
Your Name
@@ -0,0 +1,44 @@
|
||||
From b5545c08e6c674c49aef14b47a56a3e92df4d2a7 Mon Sep 17 00:00:00 2001
|
||||
From: Khem Raj <raj.khem@gmail.com>
|
||||
Date: Wed, 17 Feb 2016 07:36:34 +0000
|
||||
Subject: [pseudo][PATCH] configure: Prune PIE flags
|
||||
|
||||
LDFLAGS are not taken from environment and CFLAGS is used for LDFLAGS
|
||||
however when using security options -fpie and -pie options are coming
|
||||
as part of ARCH_FLAGS and they get into LDFLAGS of shared objects as
|
||||
well so we end up with conflicting options -shared -pie, which gold
|
||||
rejects outright and bfd linker lets the one appearning last in cmdline
|
||||
take effect. This create quite a unpleasant situation in OE when
|
||||
security flags are enabled and gold or not-gold options are used
|
||||
it errors out but errors are not same.
|
||||
|
||||
Anyway, with this patch we filter pie options from ARCH_FLAGS
|
||||
ouright and take control of generating PIC objects
|
||||
|
||||
Helps with errors like
|
||||
|
||||
| /mnt/oe/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/5.3.0/ld: pseudo_client.o: relocation R_X86_64_PC32 against symbol `pseudo_util_debug_flags' can not be used when making a shared object; recompile with -fPIC
|
||||
| /mnt/oe/build/tmp-glibc/sysroots/x86_64-linux/usr/libexec/x86_64-oe-linux/gcc/x86_64-oe-linux/5.3.0/ld: final link failed: Bad value
|
||||
| collect2: error: ld returned 1 exit status
|
||||
| make: *** [lib/pseudo/lib64/libpseudo.so] Error 1
|
||||
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
Upstream-Status: Submitted
|
||||
|
||||
configure | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/configure b/configure
|
||||
index e5ef9ce..83b0890 100755
|
||||
--- a/configure
|
||||
+++ b/configure
|
||||
@@ -339,3 +339,5 @@ sed -e '
|
||||
s,@ARCH@,'"$opt_arch"',g
|
||||
s,@BITS@,'"$opt_bits"',g
|
||||
' < Makefile.in > Makefile
|
||||
+
|
||||
+sed -i -e 's/\-[f]*pie//g' Makefile
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Script to re-generate pseudo-prebuilt-2.33.tar.xz
|
||||
#
|
||||
# Copyright (C) 2021 Richard Purdie
|
||||
#
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
#
|
||||
|
||||
for i in x86_64 aarch64 i686; do
|
||||
if [ ! -e $i-nativesdk-libc.tar.xz ]; then
|
||||
wget http://downloads.yoctoproject.org/releases/uninative/3.2/$i-nativesdk-libc.tar.xz
|
||||
fi
|
||||
tar -xf $i-nativesdk-libc.tar.xz --wildcards \*/lib/libpthread\* \*/lib/libdl\*
|
||||
cd $i-linux/lib
|
||||
ln -s libdl.so.2 libdl.so
|
||||
ln -s libpthread.so.0 libpthread.so
|
||||
cd ../..
|
||||
done
|
||||
tar -cJf pseudo-prebuilt-2.33.tar.xz *-linux
|
||||
@@ -0,0 +1,3 @@
|
||||
root:*:0:
|
||||
mail:*:8:
|
||||
nobody:*:99:
|
||||
@@ -0,0 +1,3 @@
|
||||
root::0:0:root:/home/root:/bin/sh
|
||||
pseudopasswd:*:1:1:this-is-the-pseudo-passwd:/nonexistent:/bin/sh
|
||||
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
|
||||
@@ -0,0 +1,57 @@
|
||||
If we link against a newer glibc 2.34 and then try and our LD_PRELOAD is run against a
|
||||
binary on a host with an older libc, we see symbol errors since in glibc 2.34, pthread
|
||||
and dl are merged into libc itself.
|
||||
|
||||
We need to use the older form of linking so use glibc binaries from an older release
|
||||
to force this. We only use minimal symbols from these anyway.
|
||||
|
||||
pthread_atfork is problematic, particularly on arm so use the internal glibc routine
|
||||
it maps too. This was always present in the main libc from 2.3.2 onwards.
|
||||
|
||||
Yes this is horrible. Better solutions welcome.
|
||||
|
||||
There is more info in the bug: [YOCTO #14521]
|
||||
|
||||
Upstream-Status: Inappropriate [this patch is native and nativesdk]
|
||||
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
||||
|
||||
Tweak library search order, make prebuilt lib ahead of recipe lib
|
||||
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
|
||||
---
|
||||
Makefile.in | 2 +-
|
||||
pseudo_wrappers.c | 5 ++++-
|
||||
2 files changed, 5 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/Makefile.in b/Makefile.in
|
||||
--- a/Makefile.in
|
||||
+++ b/Makefile.in
|
||||
@@ -120,7 +120,7 @@ $(PSEUDODB): pseudodb.o $(SHOBJS) $(DBOBJS) pseudo_ipc.o | $(BIN)
|
||||
libpseudo: $(LIBPSEUDO)
|
||||
|
||||
$(LIBPSEUDO): $(WRAPOBJS) pseudo_client.o pseudo_ipc.o $(SHOBJS) | $(LIB)
|
||||
- $(CC) $(CFLAGS) $(CFLAGS_PSEUDO) -shared -o $(LIBPSEUDO) \
|
||||
+ $(CC) $(CFLAGS) -Lprebuilt/$(shell uname -m)-linux/lib/ $(CFLAGS_PSEUDO) -shared -o $(LIBPSEUDO) \
|
||||
pseudo_client.o pseudo_ipc.o \
|
||||
$(WRAPOBJS) $(SHOBJS) $(LDFLAGS) $(CLIENT_LDFLAGS)
|
||||
|
||||
diff --git a/pseudo_wrappers.c b/pseudo_wrappers.c
|
||||
--- a/pseudo_wrappers.c
|
||||
+++ b/pseudo_wrappers.c
|
||||
@@ -100,10 +100,13 @@ static void libpseudo_atfork_child(void)
|
||||
pseudo_mutex_holder = 0;
|
||||
}
|
||||
|
||||
+extern void *__dso_handle;
|
||||
+extern int __register_atfork (void (*) (void), void (*) (void), void (*) (void), void *);
|
||||
+
|
||||
static void
|
||||
_libpseudo_init(void) {
|
||||
if (!_libpseudo_initted)
|
||||
- pthread_atfork(NULL, NULL, libpseudo_atfork_child);
|
||||
+ __register_atfork (NULL, NULL, libpseudo_atfork_child, &__dso_handle == NULL ? NULL : __dso_handle);
|
||||
|
||||
pseudo_getlock();
|
||||
pseudo_antimagic();
|
||||
--
|
||||
2.27.0
|
||||
|
||||
@@ -0,0 +1,158 @@
|
||||
# Note: Due to the bitbake wrapper script, making changes to pseudo can be
|
||||
# difficult. To work around the current version of the wrapper use:
|
||||
# BBFETCH2=True PSEUDO_BUILD=1 ../bitbake/bin/bitbake pseudo-native [-c CMD]
|
||||
|
||||
SUMMARY = "Pseudo gives fake root capabilities to a normal user"
|
||||
HOMEPAGE = "http://git.yoctoproject.org/cgit/cgit.cgi/pseudo"
|
||||
DESCRIPTION = "The pseudo utility offers a way to run commands in a virtualized root environment."
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=a1d8023a6f953ac6ea4af765ff62d574"
|
||||
SECTION = "base"
|
||||
LICENSE = "LGPL-2.1-only"
|
||||
DEPENDS = "sqlite3 attr"
|
||||
|
||||
FILES:${PN} = "${prefix}/lib/pseudo/lib*/libpseudo.so ${bindir}/* ${localstatedir}/pseudo ${prefix}/var/pseudo"
|
||||
INSANE_SKIP:${PN} += "libdir"
|
||||
INSANE_SKIP:${PN}-dbg += "libdir"
|
||||
|
||||
PROVIDES += "virtual/fakeroot"
|
||||
|
||||
MAKEOPTS = ""
|
||||
MAKEOPTS:class-native = "'RPATH=-Wl,--rpath=XORIGIN/../../../sqlite3-native/usr/lib/'"
|
||||
|
||||
inherit siteinfo pkgconfig
|
||||
|
||||
do_configure () {
|
||||
:
|
||||
}
|
||||
|
||||
NO32LIBS ??= "1"
|
||||
NO32LIBS:class-nativesdk = "1"
|
||||
|
||||
PSEUDO_EXTRA_OPTS ?= "--enable-force-async --without-passwd-fallback --enable-epoll --enable-xattr"
|
||||
|
||||
# Compile for the local machine arch...
|
||||
do_compile () {
|
||||
if [ "${SITEINFO_BITS}" = "64" ]; then
|
||||
${S}/configure ${PSEUDO_EXTRA_OPTS} --prefix=${prefix} --libdir=${prefix}/lib/pseudo/lib${SITEINFO_BITS} --with-sqlite-lib=${baselib} --with-sqlite=${STAGING_DIR_TARGET}${exec_prefix} --cflags="${CFLAGS}" --bits=${SITEINFO_BITS} --without-rpath
|
||||
else
|
||||
${S}/configure ${PSEUDO_EXTRA_OPTS} --prefix=${prefix} --libdir=${prefix}/lib/pseudo/lib --with-sqlite-lib=${baselib} --with-sqlite=${STAGING_DIR_TARGET}${exec_prefix} --cflags="${CFLAGS}" --bits=${SITEINFO_BITS} --without-rpath
|
||||
fi
|
||||
oe_runmake ${MAKEOPTS}
|
||||
}
|
||||
do_compile[vardepsexclude] = "SITEINFO_BITS"
|
||||
|
||||
maybe_make32() {
|
||||
# We probably don't need to build 32-bit binaries.
|
||||
make32=false
|
||||
if [ "${SITEINFO_BITS}" = "64" ]; then
|
||||
case "${NO32LIBS}" in
|
||||
0) make32=true
|
||||
;;
|
||||
1) make32=false
|
||||
;;
|
||||
*) # If unset, build 32-bit if we think we can.
|
||||
if [ -e "/usr/include/gnu/stubs-32.h" ]; then
|
||||
make32=true
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
if $make32; then
|
||||
if ! [ -e "/usr/include/gnu/stubs-32.h" ]; then
|
||||
warn_32bit_missing
|
||||
else
|
||||
bbnote "Attempting to build 32-bit libpseudo.so for ${PN}."
|
||||
fi
|
||||
else
|
||||
bbnote "Building/installing only 64-bit libpseudo.so for ${PN}."
|
||||
bbnote "If you need to run 32-bit executables, ensure that NO32LIBS is set to 0."
|
||||
fi
|
||||
}
|
||||
maybe_make32[vardepsexclude] = "SITEINFO_BITS"
|
||||
|
||||
warn_32bit_missing() {
|
||||
bbwarn "Can't find stubs-32.h, but usually need it to build 32-bit libpseudo."
|
||||
bbwarn "If the build fails, install 32-bit developer packages."
|
||||
bbwarn "If you are using 32-bit binaries, the 32-bit libpseudo is NOT optional."
|
||||
}
|
||||
|
||||
# Two below are the same
|
||||
# If necessary compile for the alternative machine arch. This is only
|
||||
# necessary in a native build.
|
||||
do_compile:prepend:class-native () {
|
||||
maybe_make32
|
||||
if $make32; then
|
||||
# We need the 32-bit libpseudo on a 64-bit machine...
|
||||
# Note that this is not well-tested outside of x86/x86_64.
|
||||
|
||||
# if we're being rebuilt due to a dependency change, we need to make sure
|
||||
# everything is clean before we configure and build -- if we haven't previously
|
||||
# built this will fail and be ignored.
|
||||
make ${MAKEOPTS} distclean || :
|
||||
|
||||
./configure ${PSEUDO_EXTRA_OPTS} --prefix=${prefix} --libdir=${prefix}/lib/pseudo/lib --with-sqlite-lib=${baselib} --with-sqlite=${STAGING_DIR_TARGET}${exec_prefix} --bits=32 --without-rpath
|
||||
save_traps=$(trap)
|
||||
trap 'warn_32bit_missing' 0
|
||||
oe_runmake ${MAKEOPTS} libpseudo
|
||||
eval "$save_traps"
|
||||
# prevent it from removing the lib, but remove everything else
|
||||
make 'LIB=foo' ${MAKEOPTS} distclean
|
||||
fi
|
||||
}
|
||||
|
||||
do_compile:prepend:class-nativesdk () {
|
||||
maybe_make32
|
||||
if $make32; then
|
||||
# We need the 32-bit libpseudo on a 64-bit machine.
|
||||
# Note that this is not well-tested outside of x86/x86_64.
|
||||
./configure ${PSEUDO_EXTRA_OPTS} --prefix=${prefix} --libdir=${prefix}/lib/pseudo/lib --with-sqlite-lib=${baselib} --with-sqlite=${STAGING_DIR_TARGET}${exec_prefix} --bits=32 --without-rpath
|
||||
oe_runmake ${MAKEOPTS} libpseudo
|
||||
# prevent it from removing the lib, but remove everything else
|
||||
make 'LIB=foo' ${MAKEOPTS} distclean
|
||||
fi
|
||||
}
|
||||
|
||||
do_compile:append:class-native () {
|
||||
if [ '${@bb.data.inherits_class('uninative', d)}' = 'True' ]; then
|
||||
for i in PSEUDO_PORT_UNIX_SYNCFS PSEUDO_PORT_UIDS_GENERIC PSEUDO_PORT_LINUX_NEWCLONE PSEUDO_PORT_LINUX_XATTR PSEUDO_PORT_LINUX_STATVFS; do
|
||||
grep $i.1 ${S}/pseudo_ports.h
|
||||
if [ $? != 0 ]; then
|
||||
echo "$i not enabled in pseudo which is incompatible with uninative"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
do_install () {
|
||||
oe_runmake 'DESTDIR=${D}' ${MAKEOPTS} 'LIB=lib/pseudo/lib$(MARK64)' install
|
||||
}
|
||||
|
||||
do_install:append:class-native () {
|
||||
chrpath ${D}${bindir}/pseudo -r `chrpath ${D}${bindir}/pseudo | cut -d = -f 2 | sed s/XORIGIN/\\$ORIGIN/`
|
||||
install -d ${D}${sysconfdir}
|
||||
# The fallback files should never be modified
|
||||
install -m 444 ${WORKDIR}/fallback-passwd ${D}${sysconfdir}/passwd
|
||||
install -m 444 ${WORKDIR}/fallback-group ${D}${sysconfdir}/group
|
||||
|
||||
# Two native/nativesdk entries below are the same
|
||||
# If necessary install for the alternative machine arch. This is only
|
||||
# necessary in a native build.
|
||||
maybe_make32
|
||||
if $make32; then
|
||||
mkdir -p ${D}${prefix}/lib/pseudo/lib
|
||||
cp lib/pseudo/lib/libpseudo.so ${D}${prefix}/lib/pseudo/lib/.
|
||||
fi
|
||||
}
|
||||
|
||||
do_install:append:class-nativesdk () {
|
||||
maybe_make32
|
||||
if $make32; then
|
||||
mkdir -p ${D}${prefix}/lib/pseudo/lib
|
||||
cp lib/pseudo/lib/libpseudo.so ${D}${prefix}/lib/pseudo/lib/.
|
||||
fi
|
||||
chrpath -d ${D}${prefix}/lib/pseudo/lib*/libpseudo.so
|
||||
}
|
||||
|
||||
BBCLASSEXTEND = "native nativesdk"
|
||||
@@ -0,0 +1,28 @@
|
||||
require pseudo.inc
|
||||
|
||||
SRC_URI = "git://git.yoctoproject.org/pseudo;branch=master;protocol=https \
|
||||
file://0001-configure-Prune-PIE-flags.patch \
|
||||
file://fallback-passwd \
|
||||
file://fallback-group \
|
||||
"
|
||||
SRC_URI:append:class-native = " \
|
||||
http://downloads.yoctoproject.org/mirror/sources/pseudo-prebuilt-2.33.tar.xz;subdir=git/prebuilt;name=prebuilt \
|
||||
file://older-glibc-symbols.patch"
|
||||
SRC_URI:append:class-nativesdk = " \
|
||||
http://downloads.yoctoproject.org/mirror/sources/pseudo-prebuilt-2.33.tar.xz;subdir=git/prebuilt;name=prebuilt \
|
||||
file://older-glibc-symbols.patch"
|
||||
SRC_URI[prebuilt.sha256sum] = "ed9f456856e9d86359f169f46a70ad7be4190d6040282b84c8d97b99072485aa"
|
||||
|
||||
SRCREV = "ec6151a2b057109b3f798f151a36690af582e166"
|
||||
S = "${WORKDIR}/git"
|
||||
PV = "1.9.0+git${SRCPV}"
|
||||
|
||||
# largefile and 64bit time_t support adds these macros via compiler flags globally
|
||||
# remove them for pseudo since pseudo intercepts some of the functions which will be
|
||||
# aliased due to this e.g. open/open64 and it will complain about duplicate definitions
|
||||
# pseudo on 32bit systems is not much of use anyway and these features are not of much
|
||||
# use for it.
|
||||
TARGET_CC_ARCH:remove = "-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -D_TIME_BITS=64"
|
||||
|
||||
# error: use of undeclared identifier '_STAT_VER'
|
||||
COMPATIBLE_HOST:libc-musl = 'null'
|
||||
Reference in New Issue
Block a user