mirror of
git://slackware.nl/current.git
synced 2024-12-28 09:59:53 +01:00
73d387f569
a/kernel-firmware-20190212_28f5f7d-noarch-1.txz: Upgraded.
a/kernel-generic-4.19.21-x86_64-1.txz: Upgraded.
a/kernel-huge-4.19.21-x86_64-1.txz: Upgraded.
a/kernel-modules-4.19.21-x86_64-1.txz: Upgraded.
ap/lxc-2.0.9_d3a03247-x86_64-1.txz: Upgraded.
This update fixes a security issue where a malicious privileged container
could overwrite the host binary and thus gain root-level code execution on
the host. As the LXC project considers privileged containers to be unsafe
no CVE has been assigned for this issue for LXC. To prevent this attack,
LXC has been patched to create a temporary copy of the calling binary
itself when it starts or attaches to containers. To do this LXC creates an
anonymous, in-memory file using the memfd_create() system call and copies
itself into the temporary in-memory file, which is then sealed to prevent
further modifications. LXC then executes this sealed, in-memory file
instead of the original on-disk binary.
For more information, see:
https://seclists.org/oss-sec/2019/q1/119
(* Security fix *)
d/kernel-headers-4.19.21-x86-1.txz: Upgraded.
k/kernel-source-4.19.21-noarch-1.txz: Upgraded.
l/libbluray-1.1.0-x86_64-1.txz: Upgraded.
l/libcap-2.26-x86_64-2.txz: Rebuilt.
Don't ship static library.
l/xapian-core-1.4.10-x86_64-1.txz: Upgraded.
n/gnupg2-2.2.13-x86_64-1.txz: Upgraded.
n/irssi-1.2.0-x86_64-1.txz: Upgraded.
n/libassuan-2.5.3-x86_64-1.txz: Upgraded.
x/bitmap-1.0.9-x86_64-1.txz: Upgraded.
x/libXau-1.0.9-x86_64-1.txz: Upgraded.
x/pixman-0.38.0-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
200 lines
6.4 KiB
Bash
Executable file
200 lines
6.4 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
# Copyright 2011, 2012, 2013, 2014, 2015, 2016, 2017, 2018 Patrick J. Volkerding, Sebeka, Minnesota, USA
|
|
# All rights reserved.
|
|
#
|
|
# Redistribution and use of this script, with or without modification, is
|
|
# permitted provided that the following conditions are met:
|
|
#
|
|
# 1. Redistributions of this script must retain the above copyright
|
|
# notice, this list of conditions and the following disclaimer.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
|
|
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
|
|
# EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
|
|
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
|
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
|
|
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
|
|
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
# Modified by Matteo Bernardini <ponce@slackbuilds.org> (2014)
|
|
|
|
cd $(dirname $0) ; CWD=$(pwd)
|
|
|
|
PKGNAM=lxc
|
|
VERSION=${VERSION:-$(echo $PKGNAM-*.tar.?z* | rev | cut -f 3- -d . | rev | cut -f 2- -d -)}
|
|
BUILD=${BUILD:-1}
|
|
|
|
# Automatically determine the architecture we're building on:
|
|
if [ -z "$ARCH" ]; then
|
|
case "$( uname -m )" in
|
|
i?86) export ARCH=i586 ;;
|
|
arm*) export ARCH=arm ;;
|
|
# Unless $ARCH is already set, use uname -m for all other archs:
|
|
*) export ARCH=$( uname -m ) ;;
|
|
esac
|
|
fi
|
|
|
|
# If the variable PRINT_PACKAGE_NAME is set, then this script will report what
|
|
# the name of the created package would be, and then exit. This information
|
|
# could be useful to other scripts.
|
|
if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then
|
|
echo "$PKGNAM-$(echo $VERSION | tr - _)-$ARCH-$BUILD.txz"
|
|
exit 0
|
|
fi
|
|
|
|
NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "}
|
|
|
|
if [ "$ARCH" = "i586" ]; then
|
|
SLKCFLAGS="-O2 -march=i586 -mtune=i686"
|
|
LIBDIRSUFFIX=""
|
|
elif [ "$ARCH" = "s390" ]; then
|
|
SLKCFLAGS="-O2"
|
|
LIBDIRSUFFIX=""
|
|
elif [ "$ARCH" = "x86_64" ]; then
|
|
SLKCFLAGS="-O2 -fPIC"
|
|
LIBDIRSUFFIX="64"
|
|
else
|
|
SLKCFLAGS="-O2"
|
|
LIBDIRSUFFIX=""
|
|
fi
|
|
|
|
TMP=${TMP:-/tmp}
|
|
PKG=$TMP/package-$PKGNAM
|
|
|
|
rm -rf $PKG
|
|
mkdir -p $TMP $PKG
|
|
|
|
cd $TMP
|
|
rm -rf $PKGNAM-$VERSION
|
|
tar xvf $CWD/$PKGNAM-$VERSION.tar.?z* || exit 1
|
|
cd $PKGNAM-$VERSION
|
|
|
|
chown -R root:root .
|
|
find . \
|
|
\( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \
|
|
-exec chmod 755 {} \; -o \
|
|
\( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
|
|
-exec chmod 644 {} \;
|
|
|
|
# Add the template file:
|
|
cat $CWD/lxc-slackware.in > templates/lxc-slackware.in
|
|
|
|
# Our python package is not split:
|
|
sed -i "s|PKG_CHECK_MODULES(\[PYTHONDEV.*||" configure.ac || exit 1
|
|
|
|
if [ ! -r configure ]; then
|
|
NOCONFIGURE=1 ./autogen.sh
|
|
fi
|
|
|
|
# Enable python stuff only if python3 is installed
|
|
python=""
|
|
[ -x /usr/bin/python3 ] && export PYTHON=/usr/bin/python3 && python="--enable-python"
|
|
|
|
# Configure:
|
|
# lua is autodetected
|
|
CFLAGS="$SLKCFLAGS" \
|
|
./configure \
|
|
--prefix=/usr \
|
|
--sysconfdir=/etc \
|
|
--libdir=/usr/lib${LIBDIRSUFFIX} \
|
|
--localstatedir=/var \
|
|
--mandir=/usr/man \
|
|
--docdir=/usr/doc/$PKGNAM-$VERSION \
|
|
--infodir=/usr/info \
|
|
--with-global-conf=/etc/lxc/lxc.conf \
|
|
--with-rootfs-path=/var/lib/rootfs-lxc \
|
|
--enable-cgmanager=no \
|
|
--disable-werror \
|
|
--disable-apparmor \
|
|
--disable-static \
|
|
$python \
|
|
--build=$ARCH-slackware-linux || exit 1
|
|
|
|
# Build and install:
|
|
make $NUMJOBS || make || exit 1
|
|
make install DESTDIR=$PKG || exit 1
|
|
|
|
# Don't ship .la files:
|
|
rm -f $PKG/usr/lib${LIBDIRSUFFIX}/*.la
|
|
|
|
# Add the modified Slackware startup scripts:
|
|
mkdir -p $PKG/usr/share/lxc/scripts/slackware
|
|
cp -a $CWD/scripts/*.lxc $PKG/usr/share/lxc/scripts/slackware
|
|
chown root:root $PKG/usr/share/lxc/scripts/slackware/*
|
|
chmod 644 $PKG/usr/share/lxc/scripts/slackware/*
|
|
|
|
# Make the default configuration directories and an empty rootfs folder:
|
|
mkdir -p $PKG/var/lib/lxc $PKG/etc/lxc $PKG/var/lib/rootfs-lxc
|
|
|
|
# Create a sample default configuration file:
|
|
echo "lxcpath = /var/lib/lxc" > $PKG/etc/lxc/lxc.conf.sample
|
|
|
|
# Move the other config files to .new:
|
|
mv $PKG/etc/lxc/default.conf $PKG/etc/lxc/default.conf.new
|
|
mv $PKG/etc/default/lxc $PKG/etc/default/lxc.new
|
|
|
|
# Install an init script (non executable by default):
|
|
install -D -m 0644 $CWD/rc.lxc $PKG/etc/rc.d/rc.lxc.new
|
|
|
|
# Put bash completion file in system directory:
|
|
mkdir -p $PKG/usr/share/bash-completion/completions/
|
|
mv $PKG/etc/bash_completion.d/lxc \
|
|
$PKG/usr/share/bash-completion/completions/lxc
|
|
rmdir --parents $PKG/etc/bash_completion.d 2>/dev/null
|
|
# Replace illegal characters in the bash completion file:
|
|
sed -i "s/lxc-generic-/lxc_generic_/g" $PKG/usr/share/bash-completion/completions/lxc
|
|
|
|
# Strip binaries:
|
|
( cd $PKG
|
|
find . | xargs file | grep "executable" | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null
|
|
find . | xargs file | grep "shared object" | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null
|
|
)
|
|
|
|
# Add a documentation directory:
|
|
mkdir -p $PKG/usr/doc/${PKGNAM}-$VERSION
|
|
cp -a \
|
|
AUTHORS CONTRIBUTING COPYING* INSTALL MAINTAINERS NEWS README* TODO \
|
|
doc/FAQ.txt \
|
|
$PKG/usr/doc/${PKGNAM}-$VERSION
|
|
|
|
mkdir -p $PKG/usr/doc/${PKGNAM}-$VERSION/examples
|
|
cp -a doc/examples/*.conf $PKG/usr/doc/${PKGNAM}-$VERSION/examples
|
|
|
|
# Fix up man pages to stop 'man' from barfing a warning:
|
|
( cd $PKG/usr/man
|
|
fgrep -lr -- '-*- coding: us-ascii -*-' . | xargs sed -i '/-*- coding: us-ascii -*-/d' )
|
|
|
|
# Compress and if needed symlink the man pages:
|
|
if [ -d $PKG/usr/man ]; then
|
|
( cd $PKG/usr/man
|
|
for manpagedir in $(find . -type d -name "man*") ; do
|
|
( cd $manpagedir
|
|
for eachpage in $( find . -type l -maxdepth 1) ; do
|
|
ln -s $( readlink $eachpage ).gz $eachpage.gz
|
|
rm $eachpage
|
|
done
|
|
gzip -9 *.?
|
|
)
|
|
done
|
|
)
|
|
fi
|
|
|
|
# If there's a ChangeLog, installing at least part of the recent history
|
|
# is useful, but don't let it get totally out of control:
|
|
if [ -r ChangeLog ]; then
|
|
DOCSDIR=$(echo $PKG/usr/doc/${PKGNAM}-$VERSION)
|
|
cat ChangeLog | head -n 1000 > $DOCSDIR/ChangeLog
|
|
touch -r ChangeLog $DOCSDIR/ChangeLog
|
|
fi
|
|
|
|
mkdir -p $PKG/install
|
|
cat $CWD/slack-desc > $PKG/install/slack-desc
|
|
cat $CWD/doinst.sh > $PKG/install/doinst.sh
|
|
|
|
cd $PKG
|
|
/sbin/makepkg -l y -c n $TMP/$PKGNAM-$(echo $VERSION | tr - _)-$ARCH-$BUILD.txz
|
|
|