[sys-boot/grub] Fix grub2 install on hardened systems

Package-Manager: portage-2.2.0_alpha51/cvs/Linux x86_64

4 files changed, 62 insertions, 12 deletions

diff --git a/sys-boot/grub/ChangeLog b/sys-boot/grub/ChangeLog
index 101cc23faefd..554ea6e2cfa3 100644
--- a/sys-boot/grub/ChangeLog
+++ b/sys-boot/grub/ChangeLog
@@ -1,6 +1,10 @@
 # ChangeLog for sys-boot/grub
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/ChangeLog,v 1.162 2011/08/30 06:45:04 scarabeus Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/ChangeLog,v 1.163 2011/08/31 11:27:51 alexxy Exp $
+
+  31 Aug 2011; Alexey Shvetsov <alexxy@gentoo.org> grub-1.99-r1.ebuild,
+  grub-9999.ebuild:
+  Fix grub2 install on hardened systems
 
   30 Aug 2011; Tomáš Chvátal <scarabeus@gentoo.org> files/grub.default:
   Fix typo entrys -> entries.
diff --git a/sys-boot/grub/Manifest b/sys-boot/grub/Manifest
index 1d0032390139..9f1d7b7552c5 100644
--- a/sys-boot/grub/Manifest
+++ b/sys-boot/grub/Manifest
@@ -1,5 +1,5 @@
 -----BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
+Hash: SHA256
 
 AUX 1.99-call_proper_grub_probe.patch 536 RMD160 28e914f6ef8e2d9eb73316fa8e5d29b6541d806f SHA1 91237ebbe574baf48d05302c01422c0f0b5c8b49 SHA256 0e27b4ba6a0deedef2f65822e3b76aea4a817cb7219b01c29c8f682c450bd5e8
 AUX grub-0.97-gpt.patch 10682 RMD160 53dd38d52f2b38fb28dfb670d6fd27e47a562bbb SHA1 6057a076110d469fb63e56e57711d281221f9b42 SHA256 5e38046cfb727420e5b4b19d71c7fb4ddff22cbcc356c9f888763b0c1963d389
@@ -37,14 +37,24 @@ EBUILD grub-0.97-r6.ebuild 8801 RMD160 3da0ba7ea62758c9fd352f7290b441c3e9f08fb6
 EBUILD grub-0.97-r8.ebuild 8941 RMD160 4caee80e02de14e6a88a3ab016df32f90c258f09 SHA1 be1f73938f4763cf6413afee97062abb8666ffbb SHA256 5876009e82e6556be90d2355defd3039d244f5a53313ba29ce937e9c14e169ff
 EBUILD grub-0.97-r9.ebuild 9045 RMD160 5db30743506d7ae274695a94bd1c7c5fea8003e2 SHA1 4796cd56c8e77239719bd31a0542b11129e7922f SHA256 153939f732549503f08dd2acff27325b3e398ffc065e16c1749281c6c66a97d5
 EBUILD grub-0.97.ebuild 4494 RMD160 f798b7101af90add6d45725e34aeb7f219e0b748 SHA1 fbb215b293127635ba41e7fa952518e5e07f118a SHA256 d08c03989b1cd6ad91fa2e1a098e0230994570472d0f11a6d926e21e06071c58
-EBUILD grub-1.99-r1.ebuild 6973 RMD160 88709b5e8ca598f293b446b5bdb4ae5dde14d826 SHA1 0168b841e32705b3117e6792e792eb903b5a70ed SHA256 63e64395ad077d8cb3f0427d9235022e0e627cc5198188c77347dbb184c5ecf7
-EBUILD grub-9999.ebuild 6971 RMD160 dcead9fa27720dadff5ed1605c4f111769eeff25 SHA1 adf0c9377860f173d84c952fdba9b845f5ce30e8 SHA256 93bc0f8facc540b518de7e05962be53c594d18db72280e05abe7b65c7fe6c66f
-MISC ChangeLog 33320 RMD160 303d226a7c8bf3b3c0138848a3d86a7e87583dbd SHA1 80705d67fd7da916c88993fd136fe0dd7a47964c SHA256 105e0a5484a598d0adada5001395e9d7904f58c9895b60b641ae4512680c7060
+EBUILD grub-1.99-r1.ebuild 7338 RMD160 3aadc2a4618f577b9fc68364592ead32463a59be SHA1 8a70a4b8fa2d6ea21eb13946aa2be5e476fcfc6d SHA256 6ff5faec027266f5daa2b83c4358f8ff8482e982995cad50587911c7f00b9d7a
+EBUILD grub-9999.ebuild 7336 RMD160 896a695954a8e3d1eaffd2675ddeca8bb360e2aa SHA1 e467a2e4438a7e9d1b8b32749e0819d03bd779e4 SHA256 a9858a80fbaf3b83e7b585c0ea6e75acd7bb109b4557bf222b6e89327603c52d
+MISC ChangeLog 33450 RMD160 86dfe680dc7e1a18d5f6e1abbc6f912523ad02cd SHA1 e0b6b98cbb3392279c551c69db06559cddf8fbd3 SHA256 b40d568aecb8931683a19dd3d63fe1fdc75883d544ef2e68f192c721c400cfc6
 MISC metadata.xml 515 RMD160 7ff103974a6e301b4ba14c55c674c1bf35b1a045 SHA1 05d70f211a5f37e1368b74f7a74b0830d8198787 SHA256 dc713fb7db877b0d8405ac8dba28c4253347205a46d677ffe71901c2f017fb0c
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.18 (GNU/Linux)
 
-iEYEARECAAYFAk5ch8UACgkQHB6c3gNBRYcnMQCgvrD8zGlBi3y9Rnzt1qXczRpM
-4GMAni/iWnS7UwF4TsXptwHWBp7cjPLW
-=YQmu
+iQIcBAEBCAAGBQJOXhq4AAoJEOf+E+/4L5LmM3kP/3hsFtxsB07hInbndKnZh5v+
+CSfl/2feW2ymPQWQWRaDonVXOLczYkbL0qIhbGz7Qj3oajIU/aRG8jf3NDZ9QloC
+CQv5lnr5kD8z/n5yJb9kPm2zMQWGu1BRZlRSEoqjv+tx/81RAxgRvkCw2MfJRQn0
+zjgCbrODvPpufolMceYq4ZG0RYU9Bo6EKec9Gl7fPMXQGtccJyQUoEEOAgdREse/
+bLQCX8kdmqC0XaKONvcTXLlEmz0WLaoP8JllZS0Wu1TvBvrwQNdxUVObjPSpUFMK
+l7PU1KjBTzq37r92QD2yujHsjmpWuMC4yEiHETumk9e725+gJXUIjJYKHxYfDOZf
+d9j9UNUpQif/DNi0Nr1GbksTt7767asAwisO2vUuwGhM92EQMyZZ7+6vKfcdlb9F
+EqvFppxuUNDkkmJmJOIdqCG0YaMpjU0Wi671WTsvjBMaQ+JWn7ziWEC9nGjkGQBC
+EaXA9OdRcybyO+wzeitEYAXsf5aux/2lxK4wOfHB6xChq2bBawdDkogBponjxfP3
+jpGUrGIGlUOhyEeI+4/E3/yE6YJdx+//h4vRMylQVWd6vEYra38VA+/R+bn1wnqW
+IUrW7Qat6fXHClGC9rSPju+vu2BOgo2BxIZLj3/5A2AO8uG+dhu2B5b3Cs3BmoN9
+jjolHdyLJ1bLkeZbvut2
+=3Z39
 -----END PGP SIGNATURE-----
diff --git a/sys-boot/grub/grub-1.99-r1.ebuild b/sys-boot/grub/grub-1.99-r1.ebuild
index f6142f833214..7d48192597aa 100644
--- a/sys-boot/grub/grub-1.99-r1.ebuild
+++ b/sys-boot/grub/grub-1.99-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2011 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/grub-1.99-r1.ebuild,v 1.1 2011/08/28 10:50:33 scarabeus Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/grub-1.99-r1.ebuild,v 1.2 2011/08/31 11:27:51 alexxy Exp $
 
 EAPI=4
 
@@ -15,7 +15,7 @@ else
 	S=${WORKDIR}/${MY_P}
 fi
 
-inherit mount-boot eutils flag-o-matic toolchain-funcs ${LIVE_ECLASS}
+inherit mount-boot eutils flag-o-matic pax-utils toolchain-funcs ${LIVE_ECLASS}
 unset LIVE_ECLASS
 
 DESCRIPTION="GNU GRUB boot loader"
@@ -211,6 +211,24 @@ src_install() {
 	mv "${ED}"/usr/share/info/grub.info \
 		"${ED}"/usr/share/info/grub2.info || die
 
+	# Do pax marking
+	local PAX=(
+		"sbin/grub2-probe"
+		"sbin/grub2-setup"
+		"sbin/grub2-mkdevicemap"
+		"bin/grub2-script-check"
+		"bin/grub2-fstest"
+		"bin/grub2-mklayout"
+		"bin/grub2-menulst2cfg"
+		"bin/grub2-mkrelpath"
+		"bin/grub2-mkpasswd-pbkdf2"
+		"bin/grub2-editenv"
+		"bin/grub2-mkimage"
+	)
+	for e in ${PAX[@]}; do
+		pax-mark -mpx "${ED}/${e}"
+	done
+
 	# can't be in docs array as we use defualt_src_install in different builddir
 	dodoc AUTHORS ChangeLog NEWS README THANKS TODO
 	insinto /etc/default
diff --git a/sys-boot/grub/grub-9999.ebuild b/sys-boot/grub/grub-9999.ebuild
index d379c1baca06..60f118802b45 100644
--- a/sys-boot/grub/grub-9999.ebuild
+++ b/sys-boot/grub/grub-9999.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2011 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/grub-9999.ebuild,v 1.39 2011/08/28 10:50:33 scarabeus Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-boot/grub/grub-9999.ebuild,v 1.40 2011/08/31 11:27:51 alexxy Exp $
 
 EAPI=4
 
@@ -15,7 +15,7 @@ else
 	S=${WORKDIR}/${MY_P}
 fi
 
-inherit mount-boot eutils flag-o-matic toolchain-funcs ${LIVE_ECLASS}
+inherit mount-boot eutils flag-o-matic pax-utils toolchain-funcs ${LIVE_ECLASS}
 unset LIVE_ECLASS
 
 DESCRIPTION="GNU GRUB boot loader"
@@ -211,6 +211,24 @@ src_install() {
 	mv "${ED}"/usr/share/info/grub.info \
 		"${ED}"/usr/share/info/grub2.info || die
 
+	# Do pax marking
+	local PAX=(
+		"sbin/grub2-probe"
+		"sbin/grub2-setup"
+		"sbin/grub2-mkdevicemap"
+		"bin/grub2-script-check"
+		"bin/grub2-fstest"
+		"bin/grub2-mklayout"
+		"bin/grub2-menulst2cfg"
+		"bin/grub2-mkrelpath"
+		"bin/grub2-mkpasswd-pbkdf2"
+		"bin/grub2-editenv"
+		"bin/grub2-mkimage"
+	)
+	for e in ${PAX[@]}; do
+		pax-mark -mpx "${ED}/${e}"
+	done
+
 	# can't be in docs array as we use defualt_src_install in different builddir
 	dodoc AUTHORS ChangeLog NEWS README THANKS TODO
 	insinto /etc/default