| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Files being installed by Portage are generally trusted but also the
syscalls allowed by file are quite broad anyway.
With e.g. new libc or sandbox version (or any number of things...), the
syscalls used by file can change which leads to its seccomp filter killing
the process. This is an acceptable tradeoff when users are calling file(1),
but it makes less sense with trusted input within Portage, especially
where it may lead to confusing errors (swallowed within pipes, subshells,
etc).
Indeed, it might even be the case that file(1) is broken, but the user
needs to complete a world upgrade to get a newer file/portage/???, but
can't because of various ebuilds (like ones using this eclass) failing.
Disable seccomp for these calls to keep working.
Bug: https://bugs.gentoo.org/811462
Bug: https://bugs.gentoo.org/815877
Bug: https://bugs.gentoo.org/889046
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Files being installed by Portage are generally trusted but also the
syscalls allowed by file are quite broad anyway.
With e.g. new libc or sandbox version (or any number of things...), the
syscalls used by file can change which leads to its seccomp filter killing
the process. This is an acceptable tradeoff when users are calling file(1),
but it makes less sense with trusted input within Portage, especially
where it may lead to confusing errors (swallowed within pipes, subshells,
etc).
Indeed, it might even be the case that file(1) is broken, but the user
needs to complete a world upgrade to get a newer file/portage/???, but
can't because of various ebuilds (like ones using this eclass) failing.
Disable seccomp for these calls to keep working.
Bug: https://bugs.gentoo.org/811462
Bug: https://bugs.gentoo.org/815877
Bug: https://bugs.gentoo.org/889046
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Files being installed by Portage are generally trusted but also the
syscalls allowed by file are quite broad anyway.
With e.g. new libc or sandbox version (or any number of things...), the
syscalls used by file can change which leads to its seccomp filter killing
the process. This is an acceptable tradeoff when users are calling file(1),
but it makes less sense with trusted input within Portage, especially
where it may lead to confusing errors (swallowed within pipes, subshells,
etc).
Indeed, it might even be the case that file(1) is broken, but the user
needs to complete a world upgrade to get a newer file/portage/???, but
can't because of various ebuilds (like ones using this eclass) failing.
Disable seccomp for these calls to keep working.
Bug: https://bugs.gentoo.org/811462
Bug: https://bugs.gentoo.org/815877
Bug: https://bugs.gentoo.org/889046
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
| |
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
| |
It's a policy requirement that ebuilds produce verbose logs, so ebuilds themselves
must not set CMAKE_VERBOSE. But users can.
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
| |
It's generally useful and already directly used by three packages. I
need to use it to fix cross-compiling of LLVM.
Signed-off-by: James Le Cuirot <chewi@gentoo.org>
|
|
|
|
|
| |
Closes: https://github.com/gentoo/gentoo/pull/28912
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
|
|
|
| |
* Both eclasses are not used by vala.eclass.
* Any ebuilds relying on the transitive inherit should be fixed instead.
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: Michał Górny <mgorny@gentoo.org>
|
|
|
|
|
|
|
|
|
|
|
|
| |
USE=hardened will now imply:
- default -D_FORTIFY_SOURCE=3 (instead of 2 for normal profiles)
- default -D_GLIBCXX_ASSERTIONS
Bug: https://bugs.gentoo.org/876895
Bug: https://bugs.gentoo.org/884417
Bug: https://bugs.gentoo.org/847148
Bug: https://bugs.gentoo.org/876893
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
| |
Bug: https://bugs.gentoo.org/889216
Bug: https://bugs.gentoo.org/889218
Signed-off-by: Rolf Eike Beer <eike@sf-mail.de>
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
|
|
| |
This reverts commit 3a2f8ddaec09ebc439453016bb669627bf8a6d6d.
Bug: https://bugs.gentoo.org/889216
Bug: https://bugs.gentoo.org/889218
Signed-off-by: Rolf Eike Beer <eike@sf-mail.de>
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
|
| |
Fixes: 24dcd3918e1ac751ff9c8d868509ea1fd6390f78
Fixes: bbc98bfdcbeb0d54f0a389eb7c92f1ffd64af7c6
Closes: https://bugs.gentoo.org/889218
Closes: https://bugs.gentoo.org/889216
Signed-off-by: Sam James <sam@gentoo.org>
|
|
|
|
|
|
|
|
|
| |
Clang is supported by the CPU optimization patch. (USE=experimental)
Check for CC=clang and do not drop this patch.
Closes: https://bugs.gentoo.org/888727
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
|
|
|
|
|
|
| |
In case someone would re-add the || die without looking into this.
Signed-off-by: Ionen Wolkens <ionen@gentoo.org>
|
|
|
|
|
|
|
|
|
| |
Emergency fix given this apparently broke potentially several
packages, at least e.g. virtualbox-modules, and zenpower3 from guru.
Fixes: bc0ef44947363a33b5cd9b18bcc0d3c32b808311
Closes: https://bugs.gentoo.org/888679
Signed-off-by: Ionen Wolkens <ionen@gentoo.org>
|
|
|
|
|
|
|
|
| |
This was happening when running a prefix as root, which we don't really
support, but also when building a prefixed system under ROOT.
Closes: https://bugs.gentoo.org/779181
Signed-off-by: James Le Cuirot <chewi@gentoo.org>
|
|
|
|
| |
Signed-off-by: Michał Górny <mgorny@gentoo.org>
|
|
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
Closes: https://github.com/gentoo/gentoo/pull/28787
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
|
| |
Closes: https://bugs.gentoo.org/778812
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
|
|
| |
* eutils.eclass functionality was not used in EAPI 7.
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|
|
|
|
| |
Signed-off-by: David Seifert <soap@gentoo.org>
|