+++ /dev/null
-From 3d4ab15670079aa8e898f80a650b3be941230486 Mon Sep 17 00:00:00 2001
-From: Lars Wendler <polynomial-c@gentoo.org>
-Date: Tue, 6 Feb 2018 15:30:21 +0100
-Subject: [PATCH] Change libseccomp logic to not be automagic only
-
-Introduce --without-libseccomp configure option so that users can
-disable seccomp even if libseccomp is available on the system.
-
-The default is unchanged from before this patch. If no
---with(out)-libseccomp has been given on the command line, the macro
-looks for presence of libseccomp and uses that if found.
-
-* m4/man-libseccomp.m4: Guard pkg-config test with a command-line
-option.
----
-
-diff --git a/configure b/configure
-index 3f949306..8eaca64e 100755
---- a/configure
-+++ b/configure
-@@ -1718,6 +1718,7 @@ with_included_regex
- enable_nls
- with_libiconv_prefix
- with_libintl_prefix
-+with_libseccomp
- '
- ac_precious_vars='build_alias
- host_alias
-@@ -2459,6 +2460,7 @@ Optional Packages:
- --without-libiconv-prefix don't search for libiconv in includedir and libdir
- --with-libintl-prefix[=DIR] search for libintl in DIR/include and DIR/lib
- --without-libintl-prefix don't search for libintl in includedir and libdir
-+ --without-libseccomp do not confine subprocesses using seccomp
-
- Some influential environment variables:
- CC C compiler command
-@@ -47295,6 +47297,15 @@ fi
-
- # Check for libseccomp library.
-
-+# Check whether --with-libseccomp was given.
-+if test "${with_libseccomp+set}" = set; then :
-+ withval=$with_libseccomp;
-+else
-+ with_libseccomp=check
-+fi
-+
-+ if test "x$with_libseccomp" != "xno"; then
-+
- pkg_failed=no
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libseccomp" >&5
- $as_echo_n "checking for libseccomp... " >&6; }
-@@ -47353,11 +47364,15 @@ fi
- # Put the nasty error message in config.log where it belongs
- echo "$libseccomp_PKG_ERRORS" >&5
-
-- :
-+ if test "x$with_libseccomp" = "xyes"; then
-+ as_fn_error $? "--with-libseccomp given but cannot find libseccomp" "$LINENO" 5
-+ fi
- elif test $pkg_failed = untried; then
- { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
- $as_echo "no" >&6; }
-- :
-+ if test "x$with_libseccomp" = "xyes"; then
-+ as_fn_error $? "--with-libseccomp given but cannot find libseccomp" "$LINENO" 5
-+ fi
- else
- libseccomp_CFLAGS=$pkg_cv_libseccomp_CFLAGS
- libseccomp_LIBS=$pkg_cv_libseccomp_LIBS
-@@ -47367,6 +47382,7 @@ $as_echo "yes" >&6; }
- $as_echo "#define HAVE_LIBSECCOMP 1" >>confdefs.h
-
- fi
-+ fi
-
-
- { $as_echo "$as_me:${as_lineno-$LINENO}: default CC = \"$CC\"" >&5
-diff --git a/m4/man-libseccomp.m4 b/m4/man-libseccomp.m4
-index a9377317..c90e3aa4 100644
---- a/m4/man-libseccomp.m4
-+++ b/m4/man-libseccomp.m4
-@@ -1,9 +1,18 @@
--# man-libseccomp.m4 serial 1
-+# man-libseccomp.m4 serial 2
- dnl MAN_LIBSECCOMP
--dnl Check for the libseccomp library.
-+dnl Add a --without-libseccomp option; check for the libseccomp library.
- AC_DEFUN([MAN_LIBSECCOMP],
--[PKG_CHECK_MODULES([libseccomp], [libseccomp],
-- [AC_DEFINE([HAVE_LIBSECCOMP], [1],
-- [Define to 1 if you have the `libseccomp' library.])],
-- [:])
-+ [AC_ARG_WITH([libseccomp],
-+ [AS_HELP_STRING([--without-libseccomp],
-+ [do not confine subprocesses using seccomp])],
-+ [],
-+ [with_libseccomp=check])
-+ if test "x$with_libseccomp" != "xno"; then
-+ PKG_CHECK_MODULES([libseccomp], [libseccomp],
-+ [AC_DEFINE([HAVE_LIBSECCOMP], [1],
-+ [Define to 1 if you have the `libseccomp' library.])],
-+ [if test "x$with_libseccomp" = "xyes"; then
-+ AC_MSG_ERROR([--with-libseccomp given but cannot find libseccomp])
-+ fi])
-+ fi
- ]) # MAN_LIBSECCOMP
---
-2.16.1
-
+++ /dev/null
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit ltprune user versionator
-
-DESCRIPTION="a man replacement that utilizes berkdb instead of flat files"
-HOMEPAGE="http://www.nongnu.org/man-db/"
-SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-linux ~arm-linux ~x86-linux"
-IUSE="berkdb +gdbm +manpager nls selinux static-libs zlib"
-
-CDEPEND="
- !sys-apps/man
- >=dev-libs/libpipeline-1.5.0
- sys-apps/groff
- berkdb? ( sys-libs/db:= )
- gdbm? ( sys-libs/gdbm:= )
- !berkdb? ( !gdbm? ( sys-libs/gdbm:= ) )
- zlib? ( sys-libs/zlib )
-"
-DEPEND="
- ${CDEPEND}
- app-arch/xz-utils
- virtual/pkgconfig
- nls? (
- >=app-text/po4a-0.45
- sys-devel/gettext
- )
-"
-RDEPEND="
- ${CDEPEND}
- selinux? ( sec-policy/selinux-mandb )
-"
-PDEPEND="manpager? ( app-text/manpager )"
-
-PATCHES=(
- "${FILESDIR}/${P}-libseccomp_automagic.patch"
-)
-
-pkg_setup() {
- # Create user now as Makefile in src_install does setuid/chown
- enewgroup man 15
- enewuser man 13 -1 /usr/share/man man
-
- if (use gdbm && use berkdb) || (use !gdbm && use !berkdb) ; then #496150
- ewarn "Defaulting to USE=gdbm due to ambiguous berkdb/gdbm USE flag settings"
- fi
-}
-
-src_configure() {
- export ac_cv_lib_z_gzopen=$(usex zlib)
- local myeconfargs=(
- --docdir='$(datarootdir)'/doc/${PF}
- --with-systemdtmpfilesdir="${EPREFIX}"/usr/lib/tmpfiles.d
- --enable-setuid
- --enable-cache-owner=man
- --with-sections="1 1p 8 2 3 3p 4 5 6 7 9 0p tcl n l p o 1x 2x 3x 4x 5x 6x 7x 8x"
- $(use_enable nls)
- $(use_enable static-libs static)
- --without-libseccomp
- --with-db=$(usex gdbm gdbm $(usex berkdb db gdbm))
- )
- econf "${myeconfargs[@]}"
-
- # Disable color output from groff so that the manpager can add it. #184604
- sed -i \
- -e '/^#DEFINE.*\<[nt]roff\>/{s:^#::;s:$: -c:}' \
- src/man_db.conf || die
-}
-
-src_install() {
- default
- dodoc docs/{HACKING,TODO}
- prune_libtool_files
-
- exeinto /etc/cron.daily
- newexe "${FILESDIR}"/man-db.cron man-db #289884
-}
-
-pkg_preinst() {
- local cachedir="${EROOT}var/cache/man"
- # If the system was already exploited, and the attacker is hiding in the
- # cachedir of the old man-db, let's wipe them out.
- # see bug #602588 comment 18
- local _replacing_version=
- local _setgid_vuln=0
- for _replacing_version in ${REPLACING_VERSIONS}; do
- if version_is_at_least '2.7.6.1-r2' "${_replacing_version}"; then
- debug-print "Skipping security bug #602588 ... existing installation (${_replacing_version}) should not be affected!"
- else
- _setgid_vuln=1
- debug-print "Applying cleanup for security bug #602588"
- fi
- done
- [[ ${_setgid_vuln} -eq 1 ]] && rm -rf "${cachedir}"
-
- # Fall back to recreating the cachedir
- if [[ ! -d ${cachedir} ]] ; then
- mkdir -p "${cachedir}" || die
- chown man:man "${cachedir}" || die
- fi
-
- # Update the whatis cache
- if [[ -f ${cachedir}/whatis ]] ; then
- einfo "Cleaning ${cachedir} from sys-apps/man"
- find "${cachedir}" -type f '!' '(' -name index.bt -o -name index.db ')' -delete
- fi
-}
-
-pkg_postinst() {
- if [[ $(get_version_component_range 2 ${REPLACING_VERSIONS}) -lt 7 ]] ; then
- einfo "Rebuilding man-db from scratch with new database format!"
- mandb --quiet --create
- fi
-}
projects / gentoo.git / commitdiff