From 2d09b7457a5c97591238b34ef717734a84167ec2 Mon Sep 17 00:00:00 2001 From: Patrick J Volkerding Date: Fri, 27 Dec 2019 22:54:53 +0000 Subject: Fri Dec 27 22:54:53 UTC 2019 a/kernel-generic-5.4.6-x86_64-2.txz: Rebuilt. a/kernel-huge-5.4.6-x86_64-2.txz: Rebuilt. a/kernel-modules-5.4.6-x86_64-2.txz: Rebuilt. ap/vim-8.2.0050-x86_64-1.txz: Upgraded. d/kernel-headers-5.4.6-x86-2.txz: Rebuilt. k/kernel-source-5.4.6-noarch-2.txz: Rebuilt. Apparently MODULE_SIG was enabled by SECURITY_LOCKDOWN_LSM. We'll turn both of those off to avoid needlessly tainting the kernel. -LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY n -LOCK_DOWN_KERNEL_FORCE_INTEGRITY n -LOCK_DOWN_KERNEL_FORCE_NONE y -MODULE_SIG_ALL n -MODULE_SIG_FORCE n -MODULE_SIG_FORMAT y -MODULE_SIG_HASH "sha256" -MODULE_SIG_KEY "certs/signing_key.pem" -MODULE_SIG_SHA1 n -MODULE_SIG_SHA224 n -MODULE_SIG_SHA256 y -MODULE_SIG_SHA384 n -MODULE_SIG_SHA512 n -SECURITY_LOCKDOWN_LSM_EARLY y MODULE_SIG y -> n SECURITY_LOCKDOWN_LSM y -> n l/imagemagick-7.0.9_12-x86_64-1.txz: Upgraded. l/libcap-2.29-x86_64-1.txz: Upgraded. xap/vim-gvim-8.2.0050-x86_64-1.txz: Upgraded. isolinux/initrd.img: Rebuilt. kernels/*: Rebuilt. usb-and-pxe-installers/usbboot.img: Rebuilt. --- source/k/kernel-configs/config-generic-5.4.6 | 18 ++---------------- source/k/kernel-configs/config-generic-5.4.6.x64 | 18 ++---------------- source/k/kernel-configs/config-generic-smp-5.4.6-smp | 18 ++---------------- source/k/kernel-configs/config-huge-5.4.6 | 18 ++---------------- source/k/kernel-configs/config-huge-5.4.6.x64 | 18 ++---------------- source/k/kernel-configs/config-huge-smp-5.4.6-smp | 18 ++---------------- source/l/libcap/libcap.SlackBuild | 17 ++++++++++++----- source/l/libcap/libcap.golang.install.source.path.diff | 14 ++++++++++++++ 8 files changed, 38 insertions(+), 101 deletions(-) create mode 100644 source/l/libcap/libcap.golang.install.source.path.diff (limited to 'source') diff --git a/source/k/kernel-configs/config-generic-5.4.6 b/source/k/kernel-configs/config-generic-5.4.6 index 7688ad136..e3750f084 100644 --- a/source/k/kernel-configs/config-generic-5.4.6 +++ b/source/k/kernel-configs/config-generic-5.4.6 @@ -786,22 +786,13 @@ CONFIG_GCC_PLUGINS=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 -CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y CONFIG_MODULE_FORCE_LOAD=y CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -# CONFIG_MODULE_SIG_FORCE is not set -# CONFIG_MODULE_SIG_ALL is not set -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA224 is not set -CONFIG_MODULE_SIG_SHA256=y -# CONFIG_MODULE_SIG_SHA384 is not set -# CONFIG_MODULE_SIG_SHA512 is not set -CONFIG_MODULE_SIG_HASH="sha256" +# CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y CONFIG_UNUSED_SYMBOLS=y @@ -8199,11 +8190,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set -# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity" @@ -8437,7 +8424,6 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/source/k/kernel-configs/config-generic-5.4.6.x64 b/source/k/kernel-configs/config-generic-5.4.6.x64 index 6c4af203d..ec7dc5934 100644 --- a/source/k/kernel-configs/config-generic-5.4.6.x64 +++ b/source/k/kernel-configs/config-generic-5.4.6.x64 @@ -829,22 +829,13 @@ CONFIG_GCC_PLUGINS=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 -CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y CONFIG_MODULE_FORCE_LOAD=y CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -# CONFIG_MODULE_SIG_FORCE is not set -# CONFIG_MODULE_SIG_ALL is not set -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA224 is not set -CONFIG_MODULE_SIG_SHA256=y -# CONFIG_MODULE_SIG_SHA384 is not set -# CONFIG_MODULE_SIG_SHA512 is not set -CONFIG_MODULE_SIG_HASH="sha256" +# CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y CONFIG_UNUSED_SYMBOLS=y @@ -8187,11 +8178,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set -# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity" @@ -8447,7 +8434,6 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/source/k/kernel-configs/config-generic-smp-5.4.6-smp b/source/k/kernel-configs/config-generic-smp-5.4.6-smp index e19e7e5db..393dc8834 100644 --- a/source/k/kernel-configs/config-generic-smp-5.4.6-smp +++ b/source/k/kernel-configs/config-generic-smp-5.4.6-smp @@ -826,22 +826,13 @@ CONFIG_GCC_PLUGINS=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 -CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y CONFIG_MODULE_FORCE_LOAD=y CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -# CONFIG_MODULE_SIG_FORCE is not set -# CONFIG_MODULE_SIG_ALL is not set -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA224 is not set -CONFIG_MODULE_SIG_SHA256=y -# CONFIG_MODULE_SIG_SHA384 is not set -# CONFIG_MODULE_SIG_SHA512 is not set -CONFIG_MODULE_SIG_HASH="sha256" +# CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y CONFIG_UNUSED_SYMBOLS=y @@ -8263,11 +8254,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set -# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity" @@ -8500,7 +8487,6 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/source/k/kernel-configs/config-huge-5.4.6 b/source/k/kernel-configs/config-huge-5.4.6 index d9b0b2141..67bdaba2a 100644 --- a/source/k/kernel-configs/config-huge-5.4.6 +++ b/source/k/kernel-configs/config-huge-5.4.6 @@ -786,22 +786,13 @@ CONFIG_GCC_PLUGINS=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 -CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y CONFIG_MODULE_FORCE_LOAD=y CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -# CONFIG_MODULE_SIG_FORCE is not set -# CONFIG_MODULE_SIG_ALL is not set -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA224 is not set -CONFIG_MODULE_SIG_SHA256=y -# CONFIG_MODULE_SIG_SHA384 is not set -# CONFIG_MODULE_SIG_SHA512 is not set -CONFIG_MODULE_SIG_HASH="sha256" +# CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y CONFIG_UNUSED_SYMBOLS=y @@ -8199,11 +8190,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set -# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity" @@ -8437,7 +8424,6 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/source/k/kernel-configs/config-huge-5.4.6.x64 b/source/k/kernel-configs/config-huge-5.4.6.x64 index b45fee5bc..e019cef1d 100644 --- a/source/k/kernel-configs/config-huge-5.4.6.x64 +++ b/source/k/kernel-configs/config-huge-5.4.6.x64 @@ -829,22 +829,13 @@ CONFIG_GCC_PLUGINS=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 -CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y CONFIG_MODULE_FORCE_LOAD=y CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -# CONFIG_MODULE_SIG_FORCE is not set -# CONFIG_MODULE_SIG_ALL is not set -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA224 is not set -CONFIG_MODULE_SIG_SHA256=y -# CONFIG_MODULE_SIG_SHA384 is not set -# CONFIG_MODULE_SIG_SHA512 is not set -CONFIG_MODULE_SIG_HASH="sha256" +# CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y CONFIG_UNUSED_SYMBOLS=y @@ -8187,11 +8178,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set -# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity" @@ -8447,7 +8434,6 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/source/k/kernel-configs/config-huge-smp-5.4.6-smp b/source/k/kernel-configs/config-huge-smp-5.4.6-smp index 26b43f409..45e8a1042 100644 --- a/source/k/kernel-configs/config-huge-smp-5.4.6-smp +++ b/source/k/kernel-configs/config-huge-smp-5.4.6-smp @@ -826,22 +826,13 @@ CONFIG_GCC_PLUGINS=y CONFIG_RT_MUTEXES=y CONFIG_BASE_SMALL=0 -CONFIG_MODULE_SIG_FORMAT=y CONFIG_MODULES=y CONFIG_MODULE_FORCE_LOAD=y CONFIG_MODULE_UNLOAD=y CONFIG_MODULE_FORCE_UNLOAD=y # CONFIG_MODVERSIONS is not set # CONFIG_MODULE_SRCVERSION_ALL is not set -CONFIG_MODULE_SIG=y -# CONFIG_MODULE_SIG_FORCE is not set -# CONFIG_MODULE_SIG_ALL is not set -# CONFIG_MODULE_SIG_SHA1 is not set -# CONFIG_MODULE_SIG_SHA224 is not set -CONFIG_MODULE_SIG_SHA256=y -# CONFIG_MODULE_SIG_SHA384 is not set -# CONFIG_MODULE_SIG_SHA512 is not set -CONFIG_MODULE_SIG_HASH="sha256" +# CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS=y CONFIG_UNUSED_SYMBOLS=y @@ -8263,11 +8254,7 @@ CONFIG_FORTIFY_SOURCE=y # CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set # CONFIG_SECURITY_SAFESETID is not set -CONFIG_SECURITY_LOCKDOWN_LSM=y -CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y -CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y -# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set -# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set +# CONFIG_SECURITY_LOCKDOWN_LSM is not set # CONFIG_INTEGRITY is not set CONFIG_DEFAULT_SECURITY_DAC=y CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity" @@ -8500,7 +8487,6 @@ CONFIG_SIGNED_PE_FILE_VERIFICATION=y # # Certificates for signature checking # -CONFIG_MODULE_SIG_KEY="certs/signing_key.pem" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set diff --git a/source/l/libcap/libcap.SlackBuild b/source/l/libcap/libcap.SlackBuild index c124bbf66..8cf4f16ed 100755 --- a/source/l/libcap/libcap.SlackBuild +++ b/source/l/libcap/libcap.SlackBuild @@ -1,6 +1,6 @@ #!/bin/bash -# Copyright 2009, 2010, 2011, 2018 Patrick J. Volkerding, Sebeka, MN, USA +# Copyright 2009, 2010, 2011, 2018, 2019 Patrick J. Volkerding, Sebeka, MN, USA # All rights reserved. # # Redistribution and use of this script, with or without modification, is @@ -28,6 +28,9 @@ PKGNAM=libcap VERSION=${VERSION:-$(echo $PKGNAM-*.tar.xz | cut -d - -f 2 | rev | cut -f 3- -d . | rev)} BUILD=${BUILD:-1} +# Building Go support is currently disabled until something actually needs it: +GOSUPPORT=${GOSUPPORT:-no} + # Automatically determine the architecture we're building on: if [ -z "$ARCH" ]; then case "$( uname -m )" in @@ -46,7 +49,8 @@ if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then exit 0 fi -NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "} +# Recent versions haven't worked well with -j: +#NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "} if [ "$ARCH" = "i586" ]; then SLKCFLAGS="-O2 -march=i586 -mtune=i686" @@ -88,12 +92,15 @@ sed -i.orig "s/^\(DEBUG =\).*/\1$SLKCFLAGS/" Make.Rules # Disable broken gperf support: sed 's@^BUILD_GPERF@#\0@' -i Make.Rules +# Fix installing Go objects: +zcat $CWD/libcap.golang.install.source.path.diff.gz | patch -p1 --verbose || exit 1 -make DYNAMIC=yes $NUMJOBS || make DYNAMIC=yes || exit 1 -make install RAISE_SETFCAP=no DESTDIR=$PKG man_prefix=/usr || exit 1 +make DYNAMIC=yes GOLANG=$GOSUPPORT || exit 1 +make install RAISE_SETFCAP=no GOLANG=$GOSUPPORT DESTDIR=$PKG man_prefix=/usr || exit 1 chmod 755 $PKG/lib${LIBDIRSUFFIX}/libcap.so* -# Don't ship static library: +# Don't ship the static libcap.a. Leave libpsx.a alone, though - there's no +# dynamic equivalent for that one: rm -f $PKG/lib*/libcap.a find $PKG | xargs file | grep -e "executable" -e "shared object" | grep ELF \ diff --git a/source/l/libcap/libcap.golang.install.source.path.diff b/source/l/libcap/libcap.golang.install.source.path.diff new file mode 100644 index 000000000..5cb54f00c --- /dev/null +++ b/source/l/libcap/libcap.golang.install.source.path.diff @@ -0,0 +1,14 @@ +--- ./libcap/Makefile.orig 2019-12-22 18:12:31.000000000 -0600 ++++ ./libcap/Makefile 2019-12-27 13:07:04.168648079 -0600 +@@ -88,9 +88,9 @@ + install -m 0644 libcap.pc $(FAKEROOT)$(PKGCONFIGDIR)/libcap.pc + ifeq ($(GOLANG),yes) + mkdir -p -m 0755 $(FAKEROOT)$(GOPKGDIR)/libcap/cap +- install -m 0644 src/libcap/cap/* $(FAKEROOT)$(GOPKGDIR)/libcap/cap/ ++ install -m 0644 ../go/src/libcap/cap/* $(FAKEROOT)$(GOPKGDIR)/libcap/cap/ + mkdir -p -m 0755 $(FAKEROOT)$(GOPKGDIR)/libcap/psx +- install -m 0644 src/libcap/psx/* $(FAKEROOT)$(GOPKGDIR)/libcap/psx/ ++ install -m 0644 ../go/src/libcap/psx/* $(FAKEROOT)$(GOPKGDIR)/libcap/psx/ + endif + + clean: -- cgit v1.2.3