bin/misc-functions.sh

   1 #!/bin/bash
   2 # Copyright 1999-2011 Gentoo Foundation
   3 # Distributed under the terms of the GNU General Public License v2
   4 #
   5 # Miscellaneous shell functions that make use of the ebuild env but don't need
   6 # to be included directly in ebuild.sh.
   7 #
   8 # We're sourcing ebuild.sh here so that we inherit all of it's goodness,
   9 # including bashrc trickery.  This approach allows us to do our miscellaneous
  10 # shell work withing the same env that ebuild.sh has, but without polluting
  11 # ebuild.sh itself with unneeded logic and shell code.
  12 #
  13 # XXX hack: clear the args so ebuild.sh doesn't see them
  14 MISC_FUNCTIONS_ARGS="$@"
  15 shift $#
  16
  17 source "${PORTAGE_BIN_PATH:-/usr/lib/portage/bin}/ebuild.sh"
  18
  19 install_symlink_html_docs() {
  20         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
  21                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
  22         cd "${ED}" || die "cd failed"
  23         #symlink the html documentation (if DOC_SYMLINKS_DIR is set in make.conf)
  24         if [ -n "${DOC_SYMLINKS_DIR}" ] ; then
  25                 local mydocdir docdir
  26                 for docdir in "${HTMLDOC_DIR:-does/not/exist}" "${PF}/html" "${PF}/HTML" "${P}/html" "${P}/HTML" ; do
  27                         if [ -d "usr/share/doc/${docdir}" ] ; then
  28                                 mydocdir="/usr/share/doc/${docdir}"
  29                         fi
  30                 done
  31                 if [ -n "${mydocdir}" ] ; then
  32                         local mysympath
  33                         if [ -z "${SLOT}" -o "${SLOT}" = "0" ] ; then
  34                                 mysympath="${DOC_SYMLINKS_DIR}/${CATEGORY}/${PN}"
  35                         else
  36                                 mysympath="${DOC_SYMLINKS_DIR}/${CATEGORY}/${PN}-${SLOT}"
  37                         fi
  38                         einfo "Symlinking ${mysympath} to the HTML documentation"
  39                         dodir "${DOC_SYMLINKS_DIR}/${CATEGORY}"
  40                         dosym "${mydocdir}" "${mysympath}"
  41                 fi
  42         fi
  43 }
  44
  45 # replacement for "readlink -f" or "realpath"
  46 canonicalize() {
  47         local f=$1 b n=10 wd=$(pwd)
  48         while (( n-- > 0 )); do
  49                 while [[ ${f: -1} = / && ${#f} -gt 1 ]]; do
  50                         f=${f%/}
  51                 done
  52                 b=${f##*/}
  53                 cd "${f%"${b}"}" 2>/dev/null || break
  54                 if [[ ! -L ${b} ]]; then
  55                         f=$(pwd -P)
  56                         echo "${f%/}/${b}"
  57                         cd "${wd}"
  58                         return 0
  59                 fi
  60                 f=$(readlink "${b}")
  61         done
  62         cd "${wd}"
  63         return 1
  64 }
  65
  66 prepcompress() {
  67         local -a include exclude incl_d incl_f
  68         local f g i real_f real_d
  69         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
  70                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
  71
  72         # Canonicalize path names and check for their existence.
  73         real_d=$(canonicalize "${ED}")
  74         for (( i = 0; i < ${#PORTAGE_DOCOMPRESS[@]}; i++ )); do
  75                 real_f=$(canonicalize "${ED}${PORTAGE_DOCOMPRESS[i]}")
  76                 f=${real_f#"${real_d}"}
  77                 if [[ ${real_f} != "${f}" ]] && [[ -d ${real_f} || -f ${real_f} ]]
  78                 then
  79                         include[${#include[@]}]=${f:-/}
  80                 elif [[ ${i} -ge 3 ]]; then
  81                         ewarn "prepcompress:" \
  82                                 "ignoring nonexistent path '${PORTAGE_DOCOMPRESS[i]}'"
  83                 fi
  84         done
  85         for (( i = 0; i < ${#PORTAGE_DOCOMPRESS_SKIP[@]}; i++ )); do
  86                 real_f=$(canonicalize "${ED}${PORTAGE_DOCOMPRESS_SKIP[i]}")
  87                 f=${real_f#"${real_d}"}
  88                 if [[ ${real_f} != "${f}" ]] && [[ -d ${real_f} || -f ${real_f} ]]
  89                 then
  90                         exclude[${#exclude[@]}]=${f:-/}
  91                 elif [[ ${i} -ge 1 ]]; then
  92                         ewarn "prepcompress:" \
  93                                 "ignoring nonexistent path '${PORTAGE_DOCOMPRESS_SKIP[i]}'"
  94                 fi
  95         done
  96
  97         # Remove redundant entries from lists.
  98         # For the include list, remove any entries that are:
  99         # a) contained in a directory in the include or exclude lists, or
 100         # b) identical with an entry in the exclude list.
 101         for (( i = ${#include[@]} - 1; i >= 0; i-- )); do
 102                 f=${include[i]}
 103                 for g in "${include[@]}"; do
 104                         if [[ ${f} == "${g%/}"/* ]]; then
 105                                 unset include[i]
 106                                 continue 2
 107                         fi
 108                 done
 109                 for g in "${exclude[@]}"; do
 110                         if [[ ${f} = "${g}" || ${f} == "${g%/}"/* ]]; then
 111                                 unset include[i]
 112                                 continue 2
 113                         fi
 114                 done
 115         done
 116         # For the exclude list, remove any entries that are:
 117         # a) contained in a directory in the exclude list, or
 118         # b) _not_ contained in a directory in the include list.
 119         for (( i = ${#exclude[@]} - 1; i >= 0; i-- )); do
 120                 f=${exclude[i]}
 121                 for g in "${exclude[@]}"; do
 122                         if [[ ${f} == "${g%/}"/* ]]; then
 123                                 unset exclude[i]
 124                                 continue 2
 125                         fi
 126                 done
 127                 for g in "${include[@]}"; do
 128                         [[ ${f} == "${g%/}"/* ]] && continue 2
 129                 done
 130                 unset exclude[i]
 131         done
 132
 133         # Split the include list into directories and files
 134         for f in "${include[@]}"; do
 135                 if [[ -d ${ED}${f} ]]; then
 136                         incl_d[${#incl_d[@]}]=${f}
 137                 else
 138                         incl_f[${#incl_f[@]}]=${f}
 139                 fi
 140         done
 141
 142         # Queue up for compression.
 143         # ecompress{,dir} doesn't like to be called with empty argument lists.
 144         [[ ${#incl_d[@]} -gt 0 ]] && ecompressdir --queue "${incl_d[@]}"
 145         [[ ${#incl_f[@]} -gt 0 ]] && ecompress --queue "${incl_f[@]/#/${ED}}"
 146         [[ ${#exclude[@]} -gt 0 ]] && ecompressdir --ignore "${exclude[@]}"
 147         return 0
 148 }
 149
 150 install_qa_check() {
 151         local f i x
 152         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
 153                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
 154
 155         cd "${ED}" || die "cd failed"
 156
 157         export STRIP_MASK
 158         prepall
 159         has "${EAPI}" 0 1 2 3 || prepcompress
 160         ecompressdir --dequeue
 161         ecompress --dequeue
 162
 163         # Prefix specific checks
 164         [[ ${ED} != ${D} ]] && install_qa_check_prefix
 165
 166         f=
 167         for x in etc/app-defaults usr/man usr/info usr/X11R6 usr/doc usr/locale ; do
 168                 [[ -d ${ED}/$x ]] && f+="  $x\n"
 169         done
 170
 171         if [[ -n $f ]] ; then
 172                 eqawarn "QA Notice: This ebuild installs into the following deprecated directories:"
 173                 eqawarn
 174                 eqawarn "$f"
 175         fi
 176
 177         # Now we look for all world writable files.
 178         local unsafe_files=$(find "${ED}" -type f -perm -2 | sed -e "s:^${ED}:- :")
 179         if [[ -n ${unsafe_files} ]] ; then
 180                 vecho "QA Security Notice: world writable file(s):"
 181                 vecho "${unsafe_files}"
 182                 vecho "- This may or may not be a security problem, most of the time it is one."
 183                 vecho "- Please double check that $PF really needs a world writeable bit and file bugs accordingly."
 184                 sleep 1
 185         fi
 186
 187         if type -P scanelf > /dev/null && ! has binchecks ${RESTRICT}; then
 188                 local qa_var insecure_rpath=0 tmp_quiet=${PORTAGE_QUIET}
 189                 local x
 190
 191                 # display warnings when using stricter because we die afterwards
 192                 if has stricter ${FEATURES} ; then
 193                         unset PORTAGE_QUIET
 194                 fi
 195
 196                 # Make sure we disallow insecure RUNPATH/RPATHs.
 197                 #   1) References to PORTAGE_BUILDDIR are banned because it's a
 198                 #      security risk. We don't want to load files from a
 199                 #      temporary directory.
 200                 #   2) If ROOT != "/", references to ROOT are banned because
 201                 #      that directory won't exist on the target system.
 202                 #   3) Null paths are banned because the loader will search $PWD when
 203                 #      it finds null paths.
 204                 local forbidden_dirs="${PORTAGE_BUILDDIR}"
 205                 if [[ -n "${ROOT}" && "${ROOT}" != "/" ]]; then
 206                         forbidden_dirs+=" ${ROOT}"
 207                 fi
 208                 local dir l rpath_files=$(scanelf -F '%F:%r' -qBR "${ED}")
 209                 f=""
 210                 for dir in ${forbidden_dirs}; do
 211                         for l in $(echo "${rpath_files}" | grep -E ":${dir}|::|: "); do
 212                                 f+="  ${l%%:*}\n"
 213                                 if ! has stricter ${FEATURES}; then
 214                                         vecho "Auto fixing rpaths for ${l%%:*}"
 215                                         TMPDIR="${dir}" scanelf -BXr "${l%%:*}" -o /dev/null
 216                                 fi
 217                         done
 218                 done
 219
 220                 # Reject set*id binaries with $ORIGIN in RPATH #260331
 221                 x=$(
 222                         find "${ED}" -type f \( -perm -u+s -o -perm -g+s \) -print0 | \
 223                         xargs -0 scanelf -qyRF '%r %p' | grep '$ORIGIN'
 224                 )
 225
 226                 # Print QA notice.
 227                 if [[ -n ${f}${x} ]] ; then
 228                         vecho -ne '\n'
 229                         eqawarn "QA Notice: The following files contain insecure RUNPATHs"
 230                         eqawarn " Please file a bug about this at http://bugs.gentoo.org/"
 231                         eqawarn " with the maintaining herd of the package."
 232                         eqawarn "${f}${f:+${x:+\n}}${x}"
 233                         vecho -ne '\n'
 234                         if [[ -n ${x} ]] || has stricter ${FEATURES} ; then
 235                                 insecure_rpath=1
 236                         fi
 237                 fi
 238
 239                 # TEXTRELs are baaaaaaaad
 240                 # Allow devs to mark things as ignorable ... e.g. things that are
 241                 # binary-only and upstream isn't cooperating (nvidia-glx) ... we
 242                 # allow ebuild authors to set QA_TEXTRELS_arch and QA_TEXTRELS ...
 243                 # the former overrides the latter ... regexes allowed ! :)
 244                 qa_var="QA_TEXTRELS_${ARCH/-/_}"
 245                 [[ -n ${!qa_var} ]] && QA_TEXTRELS=${!qa_var}
 246                 [[ -n ${QA_STRICT_TEXTRELS} ]] && QA_TEXTRELS=""
 247                 export QA_TEXTRELS="${QA_TEXTRELS} lib*/modules/*.ko"
 248                 f=$(scanelf -qyRF '%t %p' "${ED}" | grep -v 'usr/lib/debug/')
 249                 if [[ -n ${f} ]] ; then
 250                         scanelf -qyRAF '%T %p' "${PORTAGE_BUILDDIR}"/ &> "${T}"/scanelf-textrel.log
 251                         vecho -ne '\n'
 252                         eqawarn "QA Notice: The following files contain runtime text relocations"
 253                         eqawarn " Text relocations force the dynamic linker to perform extra"
 254                         eqawarn " work at startup, waste system resources, and may pose a security"
 255                         eqawarn " risk.  On some architectures, the code may not even function"
 256                         eqawarn " properly, if at all."
 257                         eqawarn " For more information, see http://hardened.gentoo.org/pic-fix-guide.xml"
 258                         eqawarn " Please include the following list of files in your report:"
 259                         eqawarn "${f}"
 260                         vecho -ne '\n'
 261                         die_msg="${die_msg} textrels,"
 262                         sleep 1
 263                 fi
 264
 265                 # Also, executable stacks only matter on linux (and just glibc atm ...)
 266                 f=""
 267                 case ${CTARGET:-${CHOST}} in
 268                         *-linux-gnu*)
 269                         # Check for files with executable stacks, but only on arches which
 270                         # are supported at the moment.  Keep this list in sync with
 271                         # http://hardened.gentoo.org/gnu-stack.xml (Arch Status)
 272                         case ${CTARGET:-${CHOST}} in
 273                                 arm*|i?86*|ia64*|m68k*|s390*|sh*|x86_64*)
 274                                         # Allow devs to mark things as ignorable ... e.g. things
 275                                         # that are binary-only and upstream isn't cooperating ...
 276                                         # we allow ebuild authors to set QA_EXECSTACK_arch and
 277                                         # QA_EXECSTACK ... the former overrides the latter ...
 278                                         # regexes allowed ! :)
 279
 280                                         qa_var="QA_EXECSTACK_${ARCH/-/_}"
 281                                         [[ -n ${!qa_var} ]] && QA_EXECSTACK=${!qa_var}
 282                                         [[ -n ${QA_STRICT_EXECSTACK} ]] && QA_EXECSTACK=""
 283                                         qa_var="QA_WX_LOAD_${ARCH/-/_}"
 284                                         [[ -n ${!qa_var} ]] && QA_WX_LOAD=${!qa_var}
 285                                         [[ -n ${QA_STRICT_WX_LOAD} ]] && QA_WX_LOAD=""
 286                                         export QA_EXECSTACK="${QA_EXECSTACK} lib*/modules/*.ko"
 287                                         export QA_WX_LOAD="${QA_WX_LOAD} lib*/modules/*.ko"
 288                                         f=$(scanelf -qyRAF '%e %p' "${ED}" | grep -v 'usr/lib/debug/')
 289                                         ;;
 290                         esac
 291                         ;;
 292                 esac
 293                 if [[ -n ${f} ]] ; then
 294                         # One more pass to help devs track down the source
 295                         scanelf -qyRAF '%e %p' "${PORTAGE_BUILDDIR}"/ &> "${T}"/scanelf-execstack.log
 296                         vecho -ne '\n'
 297                         eqawarn "QA Notice: The following files contain writable and executable sections"
 298                         eqawarn " Files with such sections will not work properly (or at all!) on some"
 299                         eqawarn " architectures/operating systems.  A bug should be filed at"
 300                         eqawarn " http://bugs.gentoo.org/ to make sure the issue is fixed."
 301                         eqawarn " For more information, see http://hardened.gentoo.org/gnu-stack.xml"
 302                         eqawarn " Please include the following list of files in your report:"
 303                         eqawarn " Note: Bugs should be filed for the respective maintainers"
 304                         eqawarn " of the package in question and not hardened@g.o."
 305                         eqawarn "${f}"
 306                         vecho -ne '\n'
 307                         die_msg="${die_msg} execstacks"
 308                         sleep 1
 309                 fi
 310
 311                 # Check for files built without respecting LDFLAGS
 312                 if [[ "${LDFLAGS}" == *,--hash-style=gnu* ]] && [[ "${PN}" != *-bin ]] ; then
 313                         qa_var="QA_DT_HASH_${ARCH/-/_}"
 314                         eval "[[ -n \${!qa_var} ]] && QA_DT_HASH=(\"\${${qa_var}[@]}\")"
 315                         f=$(scanelf -qyRF '%k %p' -k .hash "${ED}" | sed -e "s:\.hash ::")
 316                         if [[ -n ${f} ]] ; then
 317                                 echo "${f}" > "${T}"/scanelf-ignored-LDFLAGS.log
 318                                 if [ "${QA_STRICT_DT_HASH-unset}" == unset ] ; then
 319                                         if [[ ${#QA_DT_HASH[@]} -gt 1 ]] ; then
 320                                                 for x in "${QA_DT_HASH[@]}" ; do
 321                                                         sed -e "s#^${x#/}\$##" -i "${T}"/scanelf-ignored-LDFLAGS.log
 322                                                 done
 323                                         else
 324                                                 local shopts=$-
 325                                                 set -o noglob
 326                                                 for x in ${QA_DT_HASH} ; do
 327                                                         sed -e "s#^${x#/}\$##" -i "${T}"/scanelf-ignored-LDFLAGS.log
 328                                                 done
 329                                                 set +o noglob
 330                                                 set -${shopts}
 331                                         fi
 332                                 fi
 333                                 # Filter anything under /usr/lib/debug/ in order to avoid
 334                                 # duplicate warnings for splitdebug files.
 335                                 sed -e "s#^usr/lib/debug/.*##" -e "/^\$/d" -e "s#^#/#" \
 336                                         -i "${T}"/scanelf-ignored-LDFLAGS.log
 337                                 f=$(<"${T}"/scanelf-ignored-LDFLAGS.log)
 338                                 if [[ -n ${f} ]] ; then
 339                                         vecho -ne '\n'
 340                                         eqawarn "${BAD}QA Notice: Files built without respecting LDFLAGS have been detected${NORMAL}"
 341                                         eqawarn " Please include the following list of files in your report:"
 342                                         eqawarn "${f}"
 343                                         vecho -ne '\n'
 344                                         sleep 1
 345                                 else
 346                                         rm -f "${T}"/scanelf-ignored-LDFLAGS.log
 347                                 fi
 348                         fi
 349                 fi
 350
 351                 # Save NEEDED information after removing self-contained providers
 352                 rm -f "$PORTAGE_BUILDDIR"/build-info/NEEDED{,.ELF.2}
 353                 scanelf -qyRF '%a;%p;%S;%r;%n' "${D}" | { while IFS= read -r l; do
 354                         arch=${l%%;*}; l=${l#*;}
 355                         obj="/${l%%;*}"; l=${l#*;}
 356                         soname=${l%%;*}; l=${l#*;}
 357                         rpath=${l%%;*}; l=${l#*;}; [ "${rpath}" = "  -  " ] && rpath=""
 358                         needed=${l%%;*}; l=${l#*;}
 359                         if [ -z "${rpath}" -o -n "${rpath//*ORIGIN*}" ]; then
 360                                 # object doesn't contain $ORIGIN in its runpath attribute
 361                                 echo "${obj} ${needed}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED
 362                                 echo "${arch:3};${obj};${soname};${rpath};${needed}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED.ELF.2
 363                         else
 364                                 dir=${obj%/*}
 365                                 # replace $ORIGIN with the dirname of the current object for the lookup
 366                                 opath=$(echo :${rpath}: | sed -e "s#.*:\(.*\)\$ORIGIN\(.*\):.*#\1${dir}\2#")
 367                                 sneeded=$(echo ${needed} | tr , ' ')
 368                                 rneeded=""
 369                                 for lib in ${sneeded}; do
 370                                         found=0
 371                                         for path in ${opath//:/ }; do
 372                                                 [ -e "${D}/${path}/${lib}" ] && found=1 && break
 373                                         done
 374                                         [ "${found}" -eq 0 ] && rneeded="${rneeded},${lib}"
 375                                 done
 376                                 rneeded=${rneeded:1}
 377                                 if [ -n "${rneeded}" ]; then
 378                                         echo "${obj} ${rneeded}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED
 379                                         echo "${arch:3};${obj};${soname};${rpath};${rneeded}" >> "${PORTAGE_BUILDDIR}"/build-info/NEEDED.ELF.2
 380                                 fi
 381                         fi
 382                 done }
 383
 384                 [ -n "${QA_SONAME_NO_SYMLINK}" ] && \
 385                         echo "${QA_SONAME_NO_SYMLINK}" > \
 386                         "${PORTAGE_BUILDDIR}"/build-info/QA_SONAME_NO_SYMLINK
 387
 388                 if [[ ${insecure_rpath} -eq 1 ]] ; then
 389                         die "Aborting due to serious QA concerns with RUNPATH/RPATH"
 390                 elif [[ -n ${die_msg} ]] && has stricter ${FEATURES} ; then
 391                         die "Aborting due to QA concerns: ${die_msg}"
 392                 fi
 393
 394                 # Check for shared libraries lacking SONAMEs
 395                 qa_var="QA_SONAME_${ARCH/-/_}"
 396                 eval "[[ -n \${!qa_var} ]] && QA_SONAME=(\"\${${qa_var}[@]}\")"
 397                 f=$(scanelf -ByF '%S %p' "${ED}"{,usr/}lib*/lib*.so* | gawk '$2 == "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
 398                 if [[ -n ${f} ]] ; then
 399                         echo "${f}" > "${T}"/scanelf-missing-SONAME.log
 400                         if [[ "${QA_STRICT_SONAME-unset}" == unset ]] ; then
 401                                 if [[ ${#QA_SONAME[@]} -gt 1 ]] ; then
 402                                         for x in "${QA_SONAME[@]}" ; do
 403                                                 sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-SONAME.log
 404                                         done
 405                                 else
 406                                         local shopts=$-
 407                                         set -o noglob
 408                                         for x in ${QA_SONAME} ; do
 409                                                 sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-SONAME.log
 410                                         done
 411                                         set +o noglob
 412                                         set -${shopts}
 413                                 fi
 414                         fi
 415                         sed -e "/^\$/d" -i "${T}"/scanelf-missing-SONAME.log
 416                         f=$(<"${T}"/scanelf-missing-SONAME.log)
 417                         if [[ -n ${f} ]] ; then
 418                                 vecho -ne '\n'
 419                                 eqawarn "QA Notice: The following shared libraries lack a SONAME"
 420                                 eqawarn "${f}"
 421                                 vecho -ne '\n'
 422                                 sleep 1
 423                         else
 424                                 rm -f "${T}"/scanelf-missing-SONAME.log
 425                         fi
 426                 fi
 427
 428                 # Check for shared libraries lacking NEEDED entries
 429                 qa_var="QA_DT_NEEDED_${ARCH/-/_}"
 430                 eval "[[ -n \${!qa_var} ]] && QA_DT_NEEDED=(\"\${${qa_var}[@]}\")"
 431                 f=$(scanelf -ByF '%n %p' "${ED}"{,usr/}lib*/lib*.so* | gawk '$2 == "" { print }' | sed -e "s:^[[:space:]]${ED}:/:")
 432                 if [[ -n ${f} ]] ; then
 433                         echo "${f}" > "${T}"/scanelf-missing-NEEDED.log
 434                         if [[ "${QA_STRICT_DT_NEEDED-unset}" == unset ]] ; then
 435                                 if [[ ${#QA_DT_NEEDED[@]} -gt 1 ]] ; then
 436                                         for x in "${QA_DT_NEEDED[@]}" ; do
 437                                                 sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-NEEDED.log
 438                                         done
 439                                 else
 440                                         local shopts=$-
 441                                         set -o noglob
 442                                         for x in ${QA_DT_NEEDED} ; do
 443                                                 sed -e "s#^/${x#/}\$##" -i "${T}"/scanelf-missing-NEEDED.log
 444                                         done
 445                                         set +o noglob
 446                                         set -${shopts}
 447                                 fi
 448                         fi
 449                         sed -e "/^\$/d" -i "${T}"/scanelf-missing-NEEDED.log
 450                         f=$(<"${T}"/scanelf-missing-NEEDED.log)
 451                         if [[ -n ${f} ]] ; then
 452                                 vecho -ne '\n'
 453                                 eqawarn "QA Notice: The following shared libraries lack NEEDED entries"
 454                                 eqawarn "${f}"
 455                                 vecho -ne '\n'
 456                                 sleep 1
 457                         else
 458                                 rm -f "${T}"/scanelf-missing-NEEDED.log
 459                         fi
 460                 fi
 461
 462                 PORTAGE_QUIET=${tmp_quiet}
 463         fi
 464
 465         local unsafe_files=$(find "${ED}" -type f '(' -perm -2002 -o -perm -4002 ')' | sed -e "s:^${ED}:/:")
 466         if [[ -n ${unsafe_files} ]] ; then
 467                 eqawarn "QA Notice: Unsafe files detected (set*id and world writable)"
 468                 eqawarn "${unsafe_files}"
 469                 die "Unsafe files found in \${D}.  Portage will not install them."
 470         fi
 471
 472         if [[ -d ${D}/${D} ]] ; then
 473                 declare -i INSTALLTOD=0
 474                 for i in $(find "${D}/${D}/"); do
 475                         eqawarn "QA Notice: /${i##${D}/${D}} installed in \${D}/\${D}"
 476                         ((INSTALLTOD++))
 477                 done
 478                 die "Aborting due to QA concerns: ${INSTALLTOD} files installed in ${D}/${D}"
 479                 unset INSTALLTOD
 480         fi
 481
 482         # Sanity check syntax errors in init.d scripts
 483         local d
 484         for d in /etc/conf.d /etc/init.d ; do
 485                 [[ -d ${ED}/${d} ]] || continue
 486                 for i in "${ED}"/${d}/* ; do
 487                         [[ -L ${i} ]] && continue
 488                         # if empty conf.d/init.d dir exists (baselayout), then i will be "/etc/conf.d/*" and not exist
 489                         [[ ! -e ${i} ]] && continue
 490                         bash -n "${i}" || die "The init.d file has syntax errors: ${i}"
 491                 done
 492         done
 493
 494         # this should help to ensure that all (most?) shared libraries are executable
 495         # and that all libtool scripts / static libraries are not executable
 496         local j
 497         for i in "${ED}"opt/*/lib{,32,64} \
 498                  "${ED}"lib{,32,64}       \
 499                  "${ED}"usr/lib{,32,64}   \
 500                  "${ED}"usr/X11R6/lib{,32,64} ; do
 501                 [[ ! -d ${i} ]] && continue
 502
 503                 for j in "${i}"/*.so.* "${i}"/*.so ; do
 504                         [[ ! -e ${j} ]] && continue
 505                         [[ -L ${j} ]] && continue
 506                         [[ -x ${j} ]] && continue
 507                         vecho "making executable: ${j#${ED}}"
 508                         chmod +x "${j}"
 509                 done
 510
 511                 for j in "${i}"/*.a "${i}"/*.la ; do
 512                         [[ ! -e ${j} ]] && continue
 513                         [[ -L ${j} ]] && continue
 514                         [[ ! -x ${j} ]] && continue
 515                         vecho "removing executable bit: ${j#${ED}}"
 516                         chmod -x "${j}"
 517                 done
 518
 519                 for j in "${i}"/*.{a,dll,dylib,sl,so}.* "${i}"/*.{a,dll,dylib,sl,so} ; do
 520                         [[ ! -e ${j} ]] && continue
 521                         [[ ! -L ${j} ]] && continue
 522                         linkdest=$(readlink "${j}")
 523                         if [[ ${linkdest} == /* ]] ; then
 524                                 vecho -ne '\n'
 525                                 eqawarn "QA Notice: Found an absolute symlink in a library directory:"
 526                                 eqawarn "           ${j#${D}} -> ${linkdest}"
 527                                 eqawarn "           It should be a relative symlink if in the same directory"
 528                                 eqawarn "           or a linker script if it crosses the /usr boundary."
 529                         fi
 530                 done
 531         done
 532
 533         # When installing static libraries into /usr/lib and shared libraries into
 534         # /lib, we have to make sure we have a linker script in /usr/lib along side
 535         # the static library, or gcc will utilize the static lib when linking :(.
 536         # http://bugs.gentoo.org/4411
 537         abort="no"
 538         local a s
 539         for a in "${ED}"usr/lib*/*.a ; do
 540                 s=${a%.a}.so
 541                 if [[ ! -e ${s} ]] ; then
 542                         s=${s%usr/*}${s##*/usr/}
 543                         if [[ -e ${s} ]] ; then
 544                                 vecho -ne '\n'
 545                                 eqawarn "QA Notice: Missing gen_usr_ldscript for ${s##*/}"
 546                                 abort="yes"
 547                         fi
 548                 fi
 549         done
 550         [[ ${abort} == "yes" ]] && die "add those ldscripts"
 551
 552         # Make sure people don't store libtool files or static libs in /lib
 553         f=$(ls "${ED}"lib*/*.{a,la} 2>/dev/null)
 554         if [[ -n ${f} ]] ; then
 555                 vecho -ne '\n'
 556                 eqawarn "QA Notice: Excessive files found in the / partition"
 557                 eqawarn "${f}"
 558                 vecho -ne '\n'
 559                 die "static archives (*.a) and libtool library files (*.la) do not belong in /"
 560         fi
 561
 562         # Verify that the libtool files don't contain bogus $D entries.
 563         local abort=no gentoo_bug=no always_overflow=no
 564         for a in "${ED}"usr/lib*/*.la ; do
 565                 s=${a##*/}
 566                 if grep -qs "${ED}" "${a}" ; then
 567                         vecho -ne '\n'
 568                         eqawarn "QA Notice: ${s} appears to contain PORTAGE_TMPDIR paths"
 569                         abort="yes"
 570                 fi
 571         done
 572         [[ ${abort} == "yes" ]] && die "soiled libtool library files found"
 573
 574         # Evaluate misc gcc warnings
 575         if [[ -n ${PORTAGE_LOG_FILE} && -r ${PORTAGE_LOG_FILE} ]] ; then
 576                 # In debug mode, this variable definition and corresponding grep calls
 577                 # will produce false positives if they're shown in the trace.
 578                 local reset_debug=0
 579                 if [[ ${-/x/} != $- ]] ; then
 580                         set +x
 581                         reset_debug=1
 582                 fi
 583                 local m msgs=(
 584                         ": warning: dereferencing type-punned pointer will break strict-aliasing rules"
 585                         ": warning: dereferencing pointer .* does break strict-aliasing rules"
 586                         ": warning: implicit declaration of function"
 587                         ": warning: incompatible implicit declaration of built-in function"
 588                         ": warning: is used uninitialized in this function" # we'll ignore "may" and "might"
 589                         ": warning: comparisons like X<=Y<=Z do not have their mathematical meaning"
 590                         ": warning: null argument where non-null required"
 591                         ": warning: array subscript is below array bounds"
 592                         ": warning: array subscript is above array bounds"
 593                         ": warning: attempt to free a non-heap object"
 594                         ": warning: .* called with .*bigger.* than .* destination buffer"
 595                         ": warning: call to .* will always overflow destination buffer"
 596                         ": warning: assuming pointer wraparound does not occur when comparing"
 597                         ": warning: hex escape sequence out of range"
 598                         ": warning: [^ ]*-hand operand of comma .*has no effect"
 599                         ": warning: converting to non-pointer type .* from NULL"
 600                         ": warning: NULL used in arithmetic"
 601                         ": warning: passing NULL to non-pointer argument"
 602                         ": warning: the address of [^ ]* will always evaluate as"
 603                         ": warning: the address of [^ ]* will never be NULL"
 604                         ": warning: too few arguments for format"
 605                         ": warning: reference to local variable .* returned"
 606                         ": warning: returning reference to temporary"
 607                         ": warning: function returns address of local variable"
 608                         # this may be valid code :/
 609                         #": warning: multi-character character constant"
 610                         # need to check these two ...
 611                         #": warning: assuming signed overflow does not occur when"
 612                         #": warning: comparison with string literal results in unspecified behav"
 613                         # yacc/lex likes to trigger this one
 614                         #": warning: extra tokens at end of .* directive"
 615                         # only gcc itself triggers this ?
 616                         #": warning: .*noreturn.* function does return"
 617                         # these throw false positives when 0 is used instead of NULL
 618                         #": warning: missing sentinel in function call"
 619                         #": warning: not enough variable arguments to fit a sentinel"
 620                 )
 621                 abort="no"
 622                 i=0
 623                 local grep_cmd=grep
 624                 [[ $PORTAGE_LOG_FILE = *.gz ]] && grep_cmd=zgrep
 625                 while [[ -n ${msgs[${i}]} ]] ; do
 626                         m=${msgs[$((i++))]}
 627                         # force C locale to work around slow unicode locales #160234
 628                         f=$(LC_ALL=C $grep_cmd "${m}" "${PORTAGE_LOG_FILE}")
 629                         if [[ -n ${f} ]] ; then
 630                                 abort="yes"
 631                                 # for now, don't make this fatal (see bug #337031)
 632                                 #case "$m" in
 633                                 #       ": warning: call to .* will always overflow destination buffer") always_overflow=yes ;;
 634                                 #esac
 635                                 if [[ $always_overflow = yes ]] ; then
 636                                         eerror
 637                                         eerror "QA Notice: Package triggers severe warnings which indicate that it"
 638                                         eerror "           may exhibit random runtime failures."
 639                                         eerror
 640                                         eerror "${f}"
 641                                         eerror
 642                                         eerror " Please file a bug about this at http://bugs.gentoo.org/"
 643                                         eerror " with the maintaining herd of the package."
 644                                         eerror
 645                                 else
 646                                         vecho -ne '\n'
 647                                         eqawarn "QA Notice: Package triggers severe warnings which indicate that it"
 648                                         eqawarn "           may exhibit random runtime failures."
 649                                         eqawarn "${f}"
 650                                         vecho -ne '\n'
 651                                 fi
 652                         fi
 653                 done
 654                 local cat_cmd=cat
 655                 [[ $PORTAGE_LOG_FILE = *.gz ]] && cat_cmd=zcat
 656                 [[ $reset_debug = 1 ]] && set -x
 657                 f=$($cat_cmd "${PORTAGE_LOG_FILE}" | \
 658                         "${PORTAGE_PYTHON:-/usr/bin/python}" "$PORTAGE_BIN_PATH"/check-implicit-pointer-usage.py || die "check-implicit-pointer-usage.py failed")
 659                 if [[ -n ${f} ]] ; then
 660
 661                         # In the future this will be a forced "die". In preparation,
 662                         # increase the log level from "qa" to "eerror" so that people
 663                         # are aware this is a problem that must be fixed asap.
 664
 665                         # just warn on 32bit hosts but bail on 64bit hosts
 666                         case ${CHOST} in
 667                                 alpha*|hppa64*|ia64*|powerpc64*|mips64*|sparc64*|sparcv9*|x86_64*) gentoo_bug=yes ;;
 668                         esac
 669
 670                         abort=yes
 671
 672                         if [[ $gentoo_bug = yes ]] ; then
 673                                 eerror
 674                                 eerror "QA Notice: Package triggers severe warnings which indicate that it"
 675                                 eerror "           will almost certainly crash on 64bit architectures."
 676                                 eerror
 677                                 eerror "${f}"
 678                                 eerror
 679                                 eerror " Please file a bug about this at http://bugs.gentoo.org/"
 680                                 eerror " with the maintaining herd of the package."
 681                                 eerror
 682                         else
 683                                 vecho -ne '\n'
 684                                 eqawarn "QA Notice: Package triggers severe warnings which indicate that it"
 685                                 eqawarn "           will almost certainly crash on 64bit architectures."
 686                                 eqawarn "${f}"
 687                                 vecho -ne '\n'
 688                         fi
 689
 690                 fi
 691                 if [[ ${abort} == "yes" ]] ; then
 692                         if [[ $gentoo_bug = yes || $always_overflow = yes ]] ; then
 693                                 die "install aborted due to" \
 694                                         "severe warnings shown above"
 695                         else
 696                                 echo "Please do not file a Gentoo bug and instead" \
 697                                 "report the above QA issues directly to the upstream" \
 698                                 "developers of this software." | fmt -w 70 | \
 699                                 while read -r line ; do eqawarn "${line}" ; done
 700                                 eqawarn "Homepage: ${HOMEPAGE}"
 701                                 has stricter ${FEATURES} && die "install aborted due to" \
 702                                         "severe warnings shown above"
 703                         fi
 704                 fi
 705         fi
 706
 707         # Portage regenerates this on the installed system.
 708         rm -f "${ED}"/usr/share/info/dir{,.gz,.bz2}
 709
 710         if has multilib-strict ${FEATURES} && \
 711            [[ -x /usr/bin/file && -x /usr/bin/find ]] && \
 712            [[ -n ${MULTILIB_STRICT_DIRS} && -n ${MULTILIB_STRICT_DENY} ]]
 713         then
 714                 local abort=no dir file firstrun=yes
 715                 MULTILIB_STRICT_EXEMPT=$(echo ${MULTILIB_STRICT_EXEMPT} | sed -e 's:\([(|)]\):\\\1:g')
 716                 for dir in ${MULTILIB_STRICT_DIRS} ; do
 717                         [[ -d ${ED}/${dir} ]] || continue
 718                         for file in $(find ${ED}/${dir} -type f | grep -v "^${ED}/${dir}/${MULTILIB_STRICT_EXEMPT}"); do
 719                                 if file ${file} | egrep -q "${MULTILIB_STRICT_DENY}" ; then
 720                                         if [[ ${firstrun} == yes ]] ; then
 721                                                 echo "Files matching a file type that is not allowed:"
 722                                                 firstrun=no
 723                                         fi
 724                                         abort=yes
 725                                         echo "   ${file#${ED}//}"
 726                                 fi
 727                         done
 728                 done
 729                 [[ ${abort} == yes ]] && die "multilib-strict check failed!"
 730         fi
 731
 732         # ensure packages don't install systemd units automagically
 733         if ! has systemd ${INHERITED} && \
 734                 [[ -d "${ED}"/lib/systemd/system ]]
 735         then
 736                 eqawarn "QA Notice: package installs systemd unit files (/lib/systemd/system)"
 737                 eqawarn "           but does not inherit systemd.eclass."
 738                 has stricter ${FEATURES} \
 739                         && die "install aborted due to missing inherit of systemd.eclass"
 740         fi
 741 }
 742
 743 install_qa_check_prefix() {
 744         if [[ -d ${ED}/${D} ]] ; then
 745                 find "${ED}/${D}" | \
 746                 while read i ; do
 747                         eqawarn "QA Notice: /${i##${ED}/${D}} installed in \${ED}/\${D}"
 748                 done
 749                 die "Aborting due to QA concerns: files installed in ${ED}/${D}"
 750         fi
 751
 752         if [[ -d ${ED}/${EPREFIX} ]] ; then
 753                 find "${ED}/${EPREFIX}/" | \
 754                 while read i ; do
 755                         eqawarn "QA Notice: ${i#${D}} double prefix"
 756                 done
 757                 die "Aborting due to QA concerns: double prefix files installed"
 758         fi
 759
 760         if [[ -d ${D} ]] ; then
 761                 INSTALLTOD=$(find ${D%/} | egrep -v "^${ED}" | sed -e "s|^${D%/}||" | awk '{if (length($0) <= length("'"${EPREFIX}"'")) { if (substr("'"${EPREFIX}"'", 1, length($0)) != $0) {print $0;} } else if (substr($0, 1, length("'"${EPREFIX}"'")) != "'"${EPREFIX}"'") {print $0;} }')
 762                 if [[ -n ${INSTALLTOD} ]] ; then
 763                         eqawarn "QA Notice: the following files are outside of the prefix:"
 764                         eqawarn "${INSTALLTOD}"
 765                         die "Aborting due to QA concerns: there are files installed outside the prefix"
 766                 fi
 767         fi
 768
 769         # all further checks rely on ${ED} existing
 770         [[ -d ${ED} ]] || return
 771
 772         # this does not really belong here, but it's closely tied to
 773         # the code below; many runscripts generate positives here, and we
 774         # know they don't work (bug #196294) so as long as that one
 775         # remains an issue, simply remove them as they won't work
 776         # anyway, avoid etc/init.d/functions.sh from being thrown away
 777         if [[ ( -d "${ED}"/etc/conf.d || -d "${ED}"/etc/init.d ) && ! -f "${ED}"/etc/init.d/functions.sh ]] ; then
 778                 ewarn "removed /etc/init.d and /etc/conf.d directories until bug #196294 has been resolved"
 779                 rm -Rf "${ED}"/etc/{conf,init}.d
 780         fi
 781
 782         # check shebangs, bug #282539
 783         rm -f "${T}"/non-prefix-shebangs-errs
 784         local WHITELIST=" /usr/bin/env "
 785         # this is hell expensive, but how else?
 786         find "${ED}" -executable \! -type d -print0 \
 787                         | xargs -0 grep -H -n -m1 "^#!" \
 788                         | while read f ;
 789         do
 790                 local fn=${f%%:*}
 791                 local pos=${f#*:} ; pos=${pos%:*}
 792                 local line=${f##*:}
 793                 # shebang always appears on the first line ;)
 794                 [[ ${pos} != 1 ]] && continue
 795                 local oldIFS=${IFS}
 796                 IFS=$'\r'$'\n'$'\t'" "
 797                 line=( ${line#"#!"} )
 798                 IFS=${oldIFS}
 799                 [[ ${WHITELIST} == *" ${line[0]} "* ]] && continue
 800                 local fp=${fn#${D}} ; fp=/${fp%/*}
 801                 # line[0] can be an absolutised path, bug #342929
 802                 local eprefix=$(canonicalize ${EPREFIX})
 803                 local rf=${fn}
 804                 # in case we deal with a symlink, make sure we don't replace it
 805                 # with a real file (sed -i does that)
 806                 if [[ -L ${fn} ]] ; then
 807                         rf=$(readlink ${fn})
 808                         [[ ${rf} != /* ]] && rf=${fn%/*}/${rf}
 809                         # ignore symlinks pointing to outside prefix
 810                         # as seen in sys-devel/native-cctools
 811                         [[ $(canonicalize "/${rf#${D}}") != ${eprefix}/* ]] && continue
 812                 fi
 813                 # does the shebang start with ${EPREFIX}, and does it exist?
 814                 if [[ ${line[0]} == ${EPREFIX}/* || ${line[0]} == ${eprefix}/* ]] ; then
 815                         if [[ ! -e ${ROOT%/}${line[0]} && ! -e ${D%/}${line[0]} ]] ; then
 816                                 # hmm, refers explicitly to $EPREFIX, but doesn't exist,
 817                                 # if it's in PATH that's wrong in any case
 818                                 if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
 819                                         echo "${fn#${D}}:${line[0]} (explicit EPREFIX but target not found)" \
 820                                                 >> "${T}"/non-prefix-shebangs-errs
 821                                 else
 822                                         eqawarn "${fn#${D}} has explicit EPREFIX in shebang but target not found (${line[0]})"
 823                                 fi
 824                         fi
 825                         continue
 826                 fi
 827                 # unprefixed shebang, is the script directly in $PATH?
 828                 if [[ ":${PATH}:" == *":${fp}:"* ]] ; then
 829                         if [[ -e ${EROOT}${line[0]} || -e ${ED}${line[0]} ]] ; then
 830                                 # is it unprefixed, but we can just fix it because a
 831                                 # prefixed variant exists
 832                                 eqawarn "prefixing shebang of ${fn#${D}}"
 833                                 # statement is made idempotent on purpose, because
 834                                 # symlinks may point to the same target, and hence the
 835                                 # same real file may be sedded multiple times since we
 836                                 # read the shebangs in one go upfront for performance
 837                                 # reasons
 838                                 sed -i -e '1s:^#! \?'"${line[0]}"':#!'"${EPREFIX}"${line[0]}':' "${rf}"
 839                                 continue
 840                         else
 841                                 # this is definitely wrong: script in $PATH and invalid shebang
 842                                 echo "${fn#${D}}:${line[0]} (script ${fn##*/} installed in PATH but interpreter ${line[0]} not found)" \
 843                                         >> "${T}"/non-prefix-shebangs-errs
 844                         fi
 845                 else
 846                         # unprefixed/invalid shebang, but outside $PATH, this may be
 847                         # intended (e.g. config.guess) so remain silent by default
 848                         has stricter ${FEATURES} && \
 849                                 eqawarn "invalid shebang in ${fn#${D}}: ${line[0]}"
 850                 fi
 851         done
 852         if [[ -e "${T}"/non-prefix-shebangs-errs ]] ; then
 853                 eqawarn "QA Notice: the following files use invalid (possible non-prefixed) shebangs:"
 854                 while read line ; do
 855                         eqawarn "  ${line}"
 856                 done < "${T}"/non-prefix-shebangs-errs
 857                 rm -f "${T}"/non-prefix-shebangs-errs
 858                 die "Aborting due to QA concerns: invalid shebangs found"
 859         fi
 860 }
 861
 862 install_mask() {
 863         local root="$1"
 864         shift
 865         local install_mask="$*"
 866
 867         # we don't want globbing for initial expansion, but afterwards, we do
 868         local shopts=$-
 869         set -o noglob
 870         local no_inst
 871         for no_inst in ${install_mask}; do
 872                 set +o noglob
 873                 quiet_mode || einfo "Removing ${no_inst}"
 874                 # normal stuff
 875                 rm -Rf "${root}"/${no_inst} >&/dev/null
 876
 877                 # we also need to handle globs (*.a, *.h, etc)
 878                 find "${root}" \( -path "${no_inst}" -or -name "${no_inst}" \) \
 879                         -exec rm -fR {} \; >/dev/null 2>&1
 880         done
 881         # set everything back the way we found it
 882         set +o noglob
 883         set -${shopts}
 884 }
 885
 886 preinst_mask() {
 887         if [ -z "${D}" ]; then
 888                  eerror "${FUNCNAME}: D is unset"
 889                  return 1
 890         fi
 891
 892         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
 893                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
 894
 895         # Make sure $PWD is not ${D} so that we don't leave gmon.out files
 896         # in there in case any tools were built with -pg in CFLAGS.
 897         cd "${T}"
 898
 899         # remove man pages, info pages, docs if requested
 900         local f
 901         for f in man info doc; do
 902                 if has no${f} $FEATURES; then
 903                         INSTALL_MASK="${INSTALL_MASK} /usr/share/${f}"
 904                 fi
 905         done
 906
 907         install_mask "${ED}" "${INSTALL_MASK}"
 908
 909         # remove share dir if unnessesary
 910         if has nodoc $FEATURES || has noman $FEATURES || has noinfo $FEATURES; then
 911                 rmdir "${ED}usr/share" &> /dev/null
 912         fi
 913 }
 914
 915 preinst_sfperms() {
 916         if [ -z "${D}" ]; then
 917                  eerror "${FUNCNAME}: D is unset"
 918                  return 1
 919         fi
 920
 921         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
 922                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
 923
 924         # Smart FileSystem Permissions
 925         if has sfperms $FEATURES; then
 926                 local i
 927                 find "${ED}" -type f -perm -4000 -print0 | \
 928                 while read -r -d $'\0' i ; do
 929                         if [ -n "$(find "$i" -perm -2000)" ] ; then
 930                                 ebegin ">>> SetUID and SetGID: [chmod o-r] /${i#${ED}}"
 931                                 chmod o-r "$i"
 932                                 eend $?
 933                         else
 934                                 ebegin ">>> SetUID: [chmod go-r] /${i#${ED}}"
 935                                 chmod go-r "$i"
 936                                 eend $?
 937                         fi
 938                 done
 939                 find "${ED}" -type f -perm -2000 -print0 | \
 940                 while read -r -d $'\0' i ; do
 941                         if [ -n "$(find "$i" -perm -4000)" ] ; then
 942                                 # This case is already handled
 943                                 # by the SetUID check above.
 944                                 true
 945                         else
 946                                 ebegin ">>> SetGID: [chmod o-r] /${i#${ED}}"
 947                                 chmod o-r "$i"
 948                                 eend $?
 949                         fi
 950                 done
 951         fi
 952 }
 953
 954 preinst_suid_scan() {
 955         if [ -z "${D}" ]; then
 956                  eerror "${FUNCNAME}: D is unset"
 957                  return 1
 958         fi
 959
 960         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
 961                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
 962
 963         # total suid control.
 964         if has suidctl $FEATURES; then
 965                 local i sfconf x
 966                 sfconf=${PORTAGE_CONFIGROOT}etc/portage/suidctl.conf
 967                 # sandbox prevents us from writing directly
 968                 # to files outside of the sandbox, but this
 969                 # can easly be bypassed using the addwrite() function
 970                 addwrite "${sfconf}"
 971                 vecho ">>> Performing suid scan in ${ED}"
 972                 for i in $(find "${ED}" -type f \( -perm -4000 -o -perm -2000 \) ); do
 973                         if [ -s "${sfconf}" ]; then
 974                                 install_path=/${i#${ED}}
 975                                 if grep -q "^${install_path}\$" "${sfconf}" ; then
 976                                         vecho "- ${install_path} is an approved suid file"
 977                                 else
 978                                         vecho ">>> Removing sbit on non registered ${install_path}"
 979                                         for x in 5 4 3 2 1 0; do sleep 0.25 ; done
 980                                         ls_ret=$(ls -ldh "${i}")
 981                                         chmod ugo-s "${i}"
 982                                         grep "^#${install_path}$" "${sfconf}" > /dev/null || {
 983                                                 vecho ">>> Appending commented out entry to ${sfconf} for ${PF}"
 984                                                 echo "## ${ls_ret%${ED}*}${install_path}" >> "${sfconf}"
 985                                                 echo "#${install_path}" >> "${sfconf}"
 986                                                 # no delwrite() eh?
 987                                                 # delwrite ${sconf}
 988                                         }
 989                                 fi
 990                         else
 991                                 vecho "suidctl feature set but you are lacking a ${sfconf}"
 992                         fi
 993                 done
 994         fi
 995 }
 996
 997 preinst_selinux_labels() {
 998         if [ -z "${D}" ]; then
 999                  eerror "${FUNCNAME}: D is unset"
1000                  return 1
1001         fi
1002         if has selinux ${FEATURES}; then
1003                 # SELinux file labeling (needs to always be last in dyn_preinst)
1004                 # only attempt to label if setfiles is executable
1005                 # and 'context' is available on selinuxfs.
1006                 if [ -f /selinux/context -a -x /usr/sbin/setfiles -a -x /usr/sbin/selinuxconfig ]; then
1007                         vecho ">>> Setting SELinux security labels"
1008                         (
1009                                 eval "$(/usr/sbin/selinuxconfig)" || \
1010                                         die "Failed to determine SELinux policy paths.";
1011
1012                                 addwrite /selinux/context;
1013
1014                                 /usr/sbin/setfiles "${file_contexts_path}" -r "${D}" "${D}"
1015                         ) || die "Failed to set SELinux security labels."
1016                 else
1017                         # nonfatal, since merging can happen outside a SE kernel
1018                         # like during a recovery situation
1019                         vecho "!!! Unable to set SELinux security labels"
1020                 fi
1021         fi
1022 }
1023
1024 dyn_package() {
1025
1026         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
1027                 case "$EAPI" in 0|1|2) local ED=${D} ;; esac
1028
1029         # Make sure $PWD is not ${D} so that we don't leave gmon.out files
1030         # in there in case any tools were built with -pg in CFLAGS.
1031         cd "${T}"
1032         install_mask "${ED}" "${PKG_INSTALL_MASK}"
1033         local tar_options=""
1034         [[ $PORTAGE_VERBOSE = 1 ]] && tar_options+=" -v"
1035         # Sandbox is disabled in case the user wants to use a symlink
1036         # for $PKGDIR and/or $PKGDIR/All.
1037         export SANDBOX_ON="0"
1038         [ -z "${PORTAGE_BINPKG_TMPFILE}" ] && \
1039                 die "PORTAGE_BINPKG_TMPFILE is unset"
1040         mkdir -p "${PORTAGE_BINPKG_TMPFILE%/*}" || die "mkdir failed"
1041         tar $tar_options -cf - $PORTAGE_BINPKG_TAR_OPTS -C "${D}" . | \
1042                 $PORTAGE_BZIP2_COMMAND -c > "$PORTAGE_BINPKG_TMPFILE"
1043         assert "failed to pack binary package: '$PORTAGE_BINPKG_TMPFILE'"
1044         PYTHONPATH=${PORTAGE_PYM_PATH}${PYTHONPATH:+:}${PYTHONPATH} \
1045                 "${PORTAGE_PYTHON:-/usr/bin/python}" "$PORTAGE_BIN_PATH"/xpak-helper.py recompose \
1046                 "$PORTAGE_BINPKG_TMPFILE" "$PORTAGE_BUILDDIR/build-info"
1047         if [ $? -ne 0 ]; then
1048                 rm -f "${PORTAGE_BINPKG_TMPFILE}"
1049                 die "Failed to append metadata to the tbz2 file"
1050         fi
1051         local md5_hash=""
1052         if type md5sum &>/dev/null ; then
1053                 md5_hash=$(md5sum "${PORTAGE_BINPKG_TMPFILE}")
1054                 md5_hash=${md5_hash%% *}
1055         elif type md5 &>/dev/null ; then
1056                 md5_hash=$(md5 "${PORTAGE_BINPKG_TMPFILE}")
1057                 md5_hash=${md5_hash##* }
1058         fi
1059         [ -n "${md5_hash}" ] && \
1060                 echo ${md5_hash} > "${PORTAGE_BUILDDIR}"/build-info/BINPKGMD5
1061         vecho ">>> Done."
1062         cd "${PORTAGE_BUILDDIR}"
1063         >> "$PORTAGE_BUILDDIR/.packaged" || \
1064                 die "Failed to create $PORTAGE_BUILDDIR/.packaged"
1065 }
1066
1067 dyn_spec() {
1068         local sources_dir=/usr/src/rpm/SOURCES
1069         mkdir -p "${sources_dir}"
1070         declare -a tar_args=("${EBUILD}")
1071         [[ -d ${FILESDIR} ]] && tar_args=("${EBUILD}" "${FILESDIR}")
1072         tar czf "${sources_dir}/${PF}.tar.gz" \
1073                 "${tar_args[@]}" || \
1074                 die "Failed to create base rpm tarball."
1075
1076         cat <<__END1__ > ${PF}.spec
1077 Summary: ${DESCRIPTION}
1078 Name: ${PN}
1079 Version: ${PV}
1080 Release: ${PR}
1081 Copyright: GPL
1082 Group: portage/${CATEGORY}
1083 Source: ${PF}.tar.gz
1084 Buildroot: ${D}
1085 %description
1086 ${DESCRIPTION}
1087
1088 ${HOMEPAGE}
1089
1090 %prep
1091 %setup -c
1092
1093 %build
1094
1095 %install
1096
1097 %clean
1098
1099 %files
1100 /
1101 __END1__
1102
1103 }
1104
1105 dyn_rpm() {
1106
1107         [[ " ${FEATURES} " == *" force-prefix "* ]] || \
1108                 case "$EAPI" in 0|1|2) local EPREFIX= ;; esac
1109
1110         cd "${T}" || die "cd failed"
1111         local machine_name=$(uname -m)
1112         local dest_dir=${EPREFIX}/usr/src/rpm/RPMS/${machine_name}
1113         addwrite ${EPREFIX}/usr/src/rpm
1114         addwrite "${RPMDIR}"
1115         dyn_spec
1116         rpmbuild -bb --clean --rmsource "${PF}.spec" || die "Failed to integrate rpm spec file"
1117         install -D "${dest_dir}/${PN}-${PV}-${PR}.${machine_name}.rpm" \
1118                 "${RPMDIR}/${CATEGORY}/${PN}-${PV}-${PR}.rpm" || \
1119                 die "Failed to move rpm"
1120 }
1121
1122 die_hooks() {
1123         [[ -f $PORTAGE_BUILDDIR/.die_hooks ]] && return
1124         local x
1125         for x in $EBUILD_DEATH_HOOKS ; do
1126                 $x >&2
1127         done
1128         > "$PORTAGE_BUILDDIR/.die_hooks"
1129 }
1130
1131 success_hooks() {
1132         local x
1133         for x in $EBUILD_SUCCESS_HOOKS ; do
1134                 $x
1135         done
1136 }
1137
1138 install_hooks() {
1139         local hooks_dir="${PORTAGE_CONFIGROOT}etc/portage/hooks/install"
1140         local fp
1141         local ret=0
1142         shopt -s nullglob
1143         for fp in "${hooks_dir}"/*; do
1144                 if [ -x "$fp" ]; then
1145                         "$fp"
1146                         ret=$(( $ret | $? ))
1147                 fi
1148         done
1149         shopt -u nullglob
1150         return $ret
1151 }
1152
1153 if [ -n "${MISC_FUNCTIONS_ARGS}" ]; then
1154         source_all_bashrcs
1155         [ "$PORTAGE_DEBUG" == "1" ] && set -x
1156         for x in ${MISC_FUNCTIONS_ARGS}; do
1157                 ${x}
1158         done
1159         unset x
1160         [[ -n $PORTAGE_EBUILD_EXIT_FILE ]] && > "$PORTAGE_EBUILD_EXIT_FILE"
1161         if [[ -n $PORTAGE_IPC_DAEMON ]] ; then
1162                 [[ ! -s $SANDBOX_LOG ]]
1163                 "$PORTAGE_BIN_PATH"/ebuild-ipc exit $?
1164         fi
1165 fi
1166
1167 :