[people/ms/ipfire-3.x.git] / pkgs / core / glibc / glibc.nm

###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2007, 2008, 2009 Michael Tremer & Christian Schmidt           #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

###############################################################################
# Definitions
###############################################################################

include $(PKGROOT)/Include

PKG_NAME       = glibc
PKG_VER        = 2.13
PKG_REL        = 1

# TODO tzdata

PKG_MAINTAINER = Michael Tremer <michael.tremer@ipfire.org>
PKG_GROUP      = System/Base
PKG_URL        = http://sources.redhat.com/glibc/
PKG_LICENSE    = GPLv2+ LGPLv2+
PKG_SUMMARY    = The GNU libc libraries.

PKG_BUILD_DEPS+= audit-devel autoconf automake gettext libcap-devel \
	libselinux-devel texinfo

define PKG_DESCRIPTION
	The glibc package contains standard libraries which are used by \
	multiple programs on the system. In order to save disk space and \
	memory, as well as to make upgrading easier, common system code is \
	kept in one place and shared between programs. This particular package \
	contains the most important sets of shared libraries: the standard C \
	library and the standard math library. Without these two libraries, a \
	Linux system will not function.
endef

GLIBC_FLAGS += -fno-strict-aliasing -mno-tls-direct-seg-refs -DNDEBUG

CFLAGS   += $(GLIBC_FLAGS)
CXXFLAGS += $(GLIBC_FLAGS)

OPTIMIZED_KERNEL = 2.6.32

PKG_OBJECTS   += $(THISAPP).tar.xz

# $(THISAPP)-pt_pax-1.patch - Support for PT_PaX markings.

# $(THISAPP)-strlcpy_strlcat-1.patch
#	This patch adds the strlcpy and strlcat functions and manual pages to Glibc.
#	A paper written about these functions is available here:
#	http://www.courtesan.com/todd/papers/strlcpy.html. The Glibc project has
#	refused to add these functions, and that mail tread starts here:
#	http://sources.redhat.com/ml/libc-alpha/2000-08/msg00052.html. Linus Torvalds
#	has added a similar function to the Linux kernel, and that mail thread is
#	here: http://lwn.net/Articles/33814/. The strlcpy() and strlcat() functions
#	are replacements for strncpy() and strncat(). The controversy of these
#	functions is that strlcpy() and strlcat() copy the source data to the
#	destination buffer until the destination is full, and discards the rest of
#	the data if there is any. This means that these functions will never
#	overflow. The basis for the Glibc team's refusal to add these functions is
#	that they silently hide programing errors, and they have a higher performance
#	hit than strncpy() and strncat(). These functions should not be needed in a
#	perfect world, but were invented to deal with the real world. Many packages
#	will use these functions if they are found, such as Perl and many BLFS
#	packages. These functions do reduce buffer overflows, and so they are
#	recommended. After installing this patch no other effort is needed to use it.
#	Packages will use autotools to detect whether they are available or not.

# $(THISAPP)-asprintf_reset2null-1.patch
#	The asprintf(3) and vasprintf(3) functions are GNU extentions, not defined
#	by C or Posix standards. In Glibc these functions leave (char **strp) undefined
#	after an error. This patch resets (char **strp) to NULL after an error, for
#	sanity. 

# $(THISAPP)-issetugid-1.patch
#	This patch adds the issetugid() function, which is a front-end to the
#	__libc_enable_secure() dynamic linker private function. This function
#	reports whether the program is running with matching real and effective
#	ID's, or not, to determine whether the program is running with set-uid or
#	set-gid privileges. Many packages will search for issetugid() and use it if
#	found, such as Ncurses. This is safer than allowing each program to
#	determine privileges itself because it is tested at a lower level which is
#	not manipulatable by the user. Apply this patch with the following command: 

# $(THISAPP)-localedef_trampoline-1.patch
#	The next patch modifies the localedef program so it does not use GCC
#	Trampoline code (http://gcc.gnu.org/onlinedocs/gccint/Trampolines.html),
#	which relies on an executable stack to run. Without this patch the localedef
#	program will be killed if it is run on a kernel with PaX memory protection.
#	See http://pax.grsecurity.net/docs/pageexec.txt and
#	http://pax.grsecurity.net/docs/segmexec.txt for more information.

# $(THISAPP)-sanitize_env.patch
#	This patch resticts the environment, particularly with setuid programs. 

# $(THISAPP)-mktemp_urandom.patch
#	The patch modifies __gen_tempname(), used by the mk*temp()/tmpnam() family
#	of functions, to use /dev/urandom instead of hp-timing, gettimeofday(), or
#	getpid(): 

# $(THISAPP)-res_randomid.patch
#	The res_randomid() function is a pseudo-random number generator, using
#	getpid() for entropy. See: http://www.openbsd.org/advisories/res_random.txt
#	for the vulnerability. This patch uses /dev/urandom instead.

# $(THISAPP)-resolv_response_length.patch
#	This patch does a check on the buffer size of res_* functions.

QUALITY_AGENT_RPATH_ALLOW_ORIGIN=yes

define STAGE_PREPARE
	@cd $(DIR_SRC) && $(DO_EXTRACT) $(DIR_DL)/$(firstword $(PKG_OBJECTS))
	@mkdir $(DIR_SRC)/glibc-build

	# In the vi_VN.TCVN locale, bash enters an infinite loop at startup. It is
	# unknown whether this is a bash bug or a Glibc problem. Disable
	# installation of this locale in order to avoid the problem.
	cd $(DIR_APP) && sed -i '/vi_VN.TCVN/d' localedata/SUPPORTED

	# The ldd shell script contains Bash-specific syntax. Change its default
	# program interpreter to /bin/bash in case another /bin/sh is installed.
	cd $(DIR_APP) && sed -i 's|@BASH@|/bin/bash|' elf/ldd.bash.in

	$(DO_PATCHES)

	# We don't install pt_chown(1) on the final system, so why install it to
	# $(TOOLS_DIR):
	cd $(DIR_APP) && sed -e "/^install.*pt_chown/d" -i login/Makefile

	# Build nscd with -fstack-protector-all, instead of -fstack-protector:
	cd $(DIR_APP) && sed -e "s/fstack-protector/&-all/" -i nscd/Makefile

	# We don't need to set -march=i?86 in confparams because GCC was built with
	# --with-arch=i?86.

	cat $(DIR_SOURCE)/$(PKG_NAME)-stack_chk_fail.c \
		> $(DIR_APP)/debug/stack_chk_fail.c

	#cd $(DIR_APP) && \
	#	sed -e "s|libs -o|libs -L/usr/lib -Wl,-dynamic-linker=$(shell readelf -l /bin/sh | sed -n 's@.*interpret.*$(TOOLS_DIR)\(.*\)]$$@\1@p') -o|" \
	#	-i scripts/test-installation.pl

	# Use gnu hash style
	cd $(DIR_APP) && sed -i Makeconfig \
		-e "s/-Wl,--hash-style=both/-Wl,--hash-style=gnu -Wl,-O1/"

	# stdlib/tst-putenvmod is not linked against libc.
	cd $(DIR_APP) && sed -i stdlib/Makefile \
		-e "s/^CFLAGS-tst-putenvmod.c.*/& -fno-stack-protector/g"

	# stdio-common/bug22 hits timeout.
	cd $(DIR_APP) && sed -i stdio-common/bug22.c \
		-e "s/#define TIMEOUT.*/#define TIMEOUT 300/"

	# These tests don't work or need more investigation:
	cd $(DIR_APP) && sed -i dlfcn/Makefile -e "s/default //g"

	cd $(DIR_APP) && sed -i nptl/Makefile \
		-e "s/tst-mutex5 //g" \
		-e "s/tst-mutex5a //g" \
		-e "s/tst-cond11 //g" \
		-e "s/tst-rwlock6 //g" \
		-e "s/tst-rwlock7 //g" \
		-e "s/tst-sem5 //g" \
		-e "s/tst-cancelx4 //g" \
		-e "s/tst-cancelx5 //g" \
		-e "s/tst-cancelx10 //g" \
		-e "s/tst-cancelx18 //g" \
		-e "s/tst-signal1 //g"

	# These are known to fail on x86:
	cd $(DIR_APP) && sed -i rt/Makefile \
		-e "s/tst-cpuclock1 //g" \
		-e "s/tst-cpuclock2 //g"

	cd $(DIR_APP) && sed -i elf/Makefile \
		-e "s/tst-tls1 //g" \
		-e "s/tst-tls1-static //g" \
		-e "s/tst-tls2 //g" \
		-e "s/tst-tls2-static //g" \
		-e "s/tst-tls3 //g" \
		-e "s/resolvfail //g" \
		-e "s/constload1 //g" \
		-e "s/order //g" \
		-e "s/lateglobal //g" \
		-e "s/dblload //g" \
		-e "s/dblunload //g" \
		-e "s/reldep6 //g" \
		-e "s/circleload1 //g" \
		-e "s/tst-global1 //g" \
		-e "s/tst-audit2 //g" \
		-e "s/check-localplt //g" \
		-e "s/check-localplt.out$$//g"

	cd $(DIR_APP) && sed -i signal/Makefile \
		-e "s/tst-sigset2//g"
endef

define STAGE_BUILD
	# --enable-stackguard-randomization could be added here, but this is primarily
	# for attacks by local users, and we shouldn't have those in the rebooted
	# system. Adding this will empty the /dev/random entropy pool (via
	# /dev/urandom), unless the system is running a Random Number Gathering Daemon
	# (rngd). This version of Glibc uses high precision timing with SSP, so the
	# canary value changes at run-time. This is not as good as /dev/urandom, but
	# it's better than nothing and has very good performance.

	cd $(DIR_SRC)/glibc-build && \
		CFLAGS= \
		CXXFLAGS= \
		../$(THISAPP)/configure \
			--prefix=/usr \
			--libexecdir=/usr/lib/glibc \
			--disable-profile \
			--enable-add-ons \
			--enable-kernel=$(OPTIMIZED_KERNEL) \
			--with-selinux \
			--disable-werror \
			--enable-bind-now \
			--enable-stackguard-randomization \
			--with-stack-protector=all \
			--enable-__thread \
			--enable-tls \
			--enable-experimental-malloc \
			--with-gd \
			--with-nss-crypt

	cd $(DIR_SRC)/glibc-build && sed -i config.make \
		-e "s/^build-pic-default=.*/build-pic-default=yes/"

	# Our GCC is already passing -fPIC, and that's all we want for the libraries.
	# LDFLAGS.so is appended to so we don't build shared libraries with
	# DT_TEXTREL (and to tell us if something goes wrong). For now we only build
	# the libraries, not the programs:
	echo "build-programs=no" \
		>> $(DIR_SRC)/glibc-build/configparms

	cd $(DIR_SRC)/glibc-build && make PARALLELMFLAGS=$(PARALLELISMFLAGS) \
		CFLAGS="$(CFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE" \
		CXXFLAGS="$(CXXFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE"

	# Then build the programs with hardening, so everything possible in
	# $(TOOLS_DIR) is hardened:
	echo "# Nothing in here :D" >  $(DIR_SRC)/glibc-build/configparms
	cd $(DIR_SRC)/glibc-build && make PARALLELMFLAGS=$(PARALLELISMFLAGS) \
		CFLAGS="$(CFLAGS)" CXXFLAGS="$(CXXFLAGS)"
endef

#define STAGE_TEST
#	cd $(DIR_SRC)/glibc-build && TIMEOUTFACTOR=16 make check \
#		CFLAGS="$(CFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE" \
#		CXXFLAGS="$(CXXFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE"
#endef

define STAGE_INSTALL
	cd $(DIR_SRC)/glibc-build && make install install_root=$(BUILDROOT)

	# Locales
	-mkdir -pv $(BUILDROOT)/usr/lib/locale
	# This would install all locales that are supported
	cd $(DIR_SRC)/glibc-build && make localedata/install-locales install_root=$(BUILDROOT)

	# Timezone
	cp -v --remove-destination $(BUILDROOT)/usr/share/zoneinfo/GMT $(BUILDROOT)/etc/localtime

	# Configuration
	cp -vf $(DIR_SOURCE)/{ld.so.conf,nsswitch.conf} $(BUILDROOT)/etc
	-mkdir -pv $(BUILDROOT)/etc/{default,ld.so.conf.d}
	install -p -m644 $(DIR_APP)/nis/nss $(BUILDROOT)/etc/default/nss

	# Remove unused binaries
	rm -vf $(BUILDROOT)/sbin/sln \
		$(BUILDROOT)/usr/bin/rpcinfo

	# Don't distribute linker cache
	rm -vf $(BUILDROOT)/etc/ld.so.cache

	# Include /usr/lib/gconv/gconv-modules.cache
	> $(BUILDROOT)/usr/lib/gconv/gconv-modules.cache
	chmod 644 $(BUILDROOT)/usr/lib/gconv/gconv-modules.cache

	strip -g $(BUILDROOT)/usr/lib/*.o

	# Move some libs to correct place
	mv -v $(BUILDROOT)/lib/lib{memusage,pcprofile}.so $(BUILDROOT)/usr/lib/
endef

### Packages

# glibc-common
PKG_PACKAGES  += $(PKG_NAME)-common
PKG_DEPS      += $(PKG_NAME)-common

define PKG_FILES-$(PKG_NAME)-common
	/usr/bin
	/usr/sbin
	/usr/share
	!/usr/share/zoneinfo
endef

# glibc-devel
PKG_PACKAGES  += $(PKG_NAME)-devel

PKG_SUMMARY-$(PKG_NAME)-devel = \
	Object files for development using standard C libraries.
PKG_GROUP-$(PKG_NAME)-devel = Development/Libraries
PKG_DEPS-$(PKG_NAME)-devel += $(PKG_NAME)-headers

define PKG_DESCRIPTION-$(PKG_NAME)-devel
	The glibc-devel package contains the object files necessary
	for developing programs which use the standard C libraries (which are
	used by nearly all programs).  If you are developing programs which
	will use the standard C libraries, your system needs to have these
	standard object files available in order to create the
	executables.

	Install glibc-devel if you are going to develop programs which will
	use the standard C libraries.
endef

PKG_FILES-$(PKG_NAME)-devel += /usr/lib/*.a /usr/lib/*.o

# glibc-headers
PKG_PACKAGES  += $(PKG_NAME)-headers

PKG_DEPS-$(PKG_NAME)-headers += kernel-headers

define PKG_DESCRIPTION-$(PKG_NAME)-heasders
	The glibc-headers package contains the header files necessary
	for developing programs which use the standard C libraries (which are
	used by nearly all programs).  If you are developing programs which
	will use the standard C libraries, your system needs to have these
	standard header files available in order to create the
	executables.

	Install glibc-headers if you are going to develop programs which will
	use the standard C libraries.
endef

define PKG_FILES-$(PKG_NAME)-headers
	/usr/include
	!/usr/include/linuxthreads
	!/usr/include/gnu/stubs-[32164]*.h
endef

# nscd
PKG_PACKAGES  += nscd

PKG_SUMMARY-nscd = A Name Service Caching Daemon (nscd).
PKG_GROUP-nscd   = System/Daemons

define PKG_DESCRIPTION-nscd
	Nscd caches name service lookups and can dramatically improve \
	performance with NIS+, and may help with DNS as well.
endef

define PKG_FILES-nscd
	/usr/sbin/nscd
endef

# glibc-utils
PKG_PACKAGES  += $(PKG_NAME)-utils

PKG_SUMMARY-$(PKG_NAME)-utils = Development utilities from GNU C library.
PKG_GROUP-$(PKG_NAME)-utils   = Development/Tools
define PKG_DESCRIPTION_$(PKG_NAME)-utils
	The glibc-utils package contains memusage, a memory usage profiler, \
	mtrace, a memory leak tracer and xtrace, a function call tracer \
	which can be helpful during program debugging.
endef

define PKG_FILES-$(PKG_NAME)-utils
	/usr/bin/memusage{,stat}
	/usr/bin/mtrace
	/usr/bin/pcprofiledump
	/usr/bin/xtrace
	/usr/lib/libmemusage.so
	/usr/lib/libpcprofile.so
endef
Commit	Line	Data
166a6c21 MT	1	###############################################################################
	2	# #
	3	# IPFire.org - A linux based firewall #
	4	# Copyright (C) 2007, 2008, 2009 Michael Tremer & Christian Schmidt #
	5	# #
	6	# This program is free software: you can redistribute it and/or modify #
	7	# it under the terms of the GNU General Public License as published by #
	8	# the Free Software Foundation, either version 3 of the License, or #
	9	# (at your option) any later version. #
	10	# #
	11	# This program is distributed in the hope that it will be useful, #
	12	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	13	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	14	# GNU General Public License for more details. #
	15	# #
	16	# You should have received a copy of the GNU General Public License #
	17	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	18	# #
	19	###############################################################################
	20
	21	###############################################################################
	22	# Definitions
	23	###############################################################################
	24
a7c97434	25	include $(PKGROOT)/Include
166a6c21 MT	26
166a6c21 MT	27	PKG_NAME = glibc
ba8de1f5 MT	28	PKG_VER = 2.13
ba8de1f5 MT	29	PKG_REL = 1
7f617709 MT	30
7f617709 MT	31	# TODO tzdata
166a6c21 MT	32
	33	PKG_MAINTAINER = Michael Tremer <michael.tremer@ipfire.org>
	34	PKG_GROUP = System/Base
	35	PKG_URL = http://sources.redhat.com/glibc/
	36	PKG_LICENSE = GPLv2+ LGPLv2+
	37	PKG_SUMMARY = The GNU libc libraries.
	38
7eaea6f8 MT	39	PKG_BUILD_DEPS+= audit-devel autoconf automake gettext libcap-devel \
7eaea6f8 MT	40	libselinux-devel texinfo
2777fcb0	41
166a6c21 MT	42	define PKG_DESCRIPTION
	43	The glibc package contains standard libraries which are used by \
	44	multiple programs on the system. In order to save disk space and \
	45	memory, as well as to make upgrading easier, common system code is \
	46	kept in one place and shared between programs. This particular package \
	47	contains the most important sets of shared libraries: the standard C \
	48	library and the standard math library. Without these two libraries, a \
	49	Linux system will not function.
	50	endef
	51
7f617709	52	GLIBC_FLAGS += -fno-strict-aliasing -mno-tls-direct-seg-refs -DNDEBUG
0bed08cd MT	53
	54	CFLAGS += $(GLIBC_FLAGS)
	55	CXXFLAGS += $(GLIBC_FLAGS)
166a6c21	56
0e22dbe2	57	OPTIMIZED_KERNEL = 2.6.32
166a6c21	58
d9a1ddc1	59	PKG_OBJECTS += $(THISAPP).tar.xz
166a6c21	60
b2ec3c8a MT	61	# $(THISAPP)-pt_pax-1.patch - Support for PT_PaX markings.
	62
	63	# $(THISAPP)-strlcpy_strlcat-1.patch
	64	# This patch adds the strlcpy and strlcat functions and manual pages to Glibc.
	65	# A paper written about these functions is available here:
	66	# http://www.courtesan.com/todd/papers/strlcpy.html. The Glibc project has
	67	# refused to add these functions, and that mail tread starts here:
	68	# http://sources.redhat.com/ml/libc-alpha/2000-08/msg00052.html. Linus Torvalds
	69	# has added a similar function to the Linux kernel, and that mail thread is
	70	# here: http://lwn.net/Articles/33814/. The strlcpy() and strlcat() functions
	71	# are replacements for strncpy() and strncat(). The controversy of these
	72	# functions is that strlcpy() and strlcat() copy the source data to the
	73	# destination buffer until the destination is full, and discards the rest of
	74	# the data if there is any. This means that these functions will never
	75	# overflow. The basis for the Glibc team's refusal to add these functions is
	76	# that they silently hide programing errors, and they have a higher performance
	77	# hit than strncpy() and strncat(). These functions should not be needed in a
	78	# perfect world, but were invented to deal with the real world. Many packages
	79	# will use these functions if they are found, such as Perl and many BLFS
	80	# packages. These functions do reduce buffer overflows, and so they are
	81	# recommended. After installing this patch no other effort is needed to use it.
	82	# Packages will use autotools to detect whether they are available or not.
	83
	84	# $(THISAPP)-asprintf_reset2null-1.patch
	85	# The asprintf(3) and vasprintf(3) functions are GNU extentions, not defined
	86	# by C or Posix standards. In Glibc these functions leave (char **strp) undefined
	87	# after an error. This patch resets (char **strp) to NULL after an error, for
	88	# sanity.
	89
	90	# $(THISAPP)-issetugid-1.patch
	91	# This patch adds the issetugid() function, which is a front-end to the
	92	# __libc_enable_secure() dynamic linker private function. This function
	93	# reports whether the program is running with matching real and effective
	94	# ID's, or not, to determine whether the program is running with set-uid or
	95	# set-gid privileges. Many packages will search for issetugid() and use it if
	96	# found, such as Ncurses. This is safer than allowing each program to
	97	# determine privileges itself because it is tested at a lower level which is
	98	# not manipulatable by the user. Apply this patch with the following command:
	99
	100	# $(THISAPP)-localedef_trampoline-1.patch
	101	# The next patch modifies the localedef program so it does not use GCC
	102	# Trampoline code (http://gcc.gnu.org/onlinedocs/gccint/Trampolines.html),
	103	# which relies on an executable stack to run. Without this patch the localedef
	104	# program will be killed if it is run on a kernel with PaX memory protection.
	105	# See http://pax.grsecurity.net/docs/pageexec.txt and
	106	# http://pax.grsecurity.net/docs/segmexec.txt for more information.
	107
	108	# $(THISAPP)-sanitize_env.patch
	109	# This patch resticts the environment, particularly with setuid programs.
	110
	111	# $(THISAPP)-mktemp_urandom.patch
	112	# The patch modifies __gen_tempname(), used by the mk*temp()/tmpnam() family
	113	# of functions, to use /dev/urandom instead of hp-timing, gettimeofday(), or
	114	# getpid():
	115
	116	# $(THISAPP)-res_randomid.patch
	117	# The res_randomid() function is a pseudo-random number generator, using
	118	# getpid() for entropy. See: http://www.openbsd.org/advisories/res_random.txt
	119	# for the vulnerability. This patch uses /dev/urandom instead.
	120
	121	# $(THISAPP)-resolv_response_length.patch
	122	# This patch does a check on the buffer size of res_* functions.
166a6c21	123
370830cf	124	QUALITY_AGENT_RPATH_ALLOW_ORIGIN=yes
166a6c21	125
17c0ee8a MT	126	define STAGE_PREPARE
17c0ee8a MT	127	@cd $(DIR_SRC) && $(DO_EXTRACT) $(DIR_DL)/$(firstword $(PKG_OBJECTS))
166a6c21 MT	128	@mkdir $(DIR_SRC)/glibc-build
	129
	130	# In the vi_VN.TCVN locale, bash enters an infinite loop at startup. It is
	131	# unknown whether this is a bash bug or a Glibc problem. Disable
	132	# installation of this locale in order to avoid the problem.
	133	cd $(DIR_APP) && sed -i '/vi_VN.TCVN/d' localedata/SUPPORTED
	134
	135	# The ldd shell script contains Bash-specific syntax. Change its default
	136	# program interpreter to /bin/bash in case another /bin/sh is installed.
	137	cd $(DIR_APP) && sed -i 's\|@BASH@\|/bin/bash\|' elf/ldd.bash.in
	138
	139	$(DO_PATCHES)
	140
	141	# We don't install pt_chown(1) on the final system, so why install it to
	142	# $(TOOLS_DIR):
	143	cd $(DIR_APP) && sed -e "/^install.*pt_chown/d" -i login/Makefile
	144
166a6c21 MT	145	# Build nscd with -fstack-protector-all, instead of -fstack-protector:
	146	cd $(DIR_APP) && sed -e "s/fstack-protector/&-all/" -i nscd/Makefile
	147
	148	# We don't need to set -march=i?86 in confparams because GCC was built with
	149	# --with-arch=i?86.
	150
bceb6c91	151	cat $(DIR_SOURCE)/$(PKG_NAME)-stack_chk_fail.c \
166a6c21	152	> $(DIR_APP)/debug/stack_chk_fail.c
f1fdd4d6	153
7c1fc7a0 MT	154	#cd $(DIR_APP) && \
	155	# sed -e "s\|libs -o\|libs -L/usr/lib -Wl,-dynamic-linker=$(shell readelf -l /bin/sh \| sed -n 's@.interpret.$(TOOLS_DIR)\(.*\)]$$@\1@p') -o\|" \
	156	# -i scripts/test-installation.pl
8a346372	157
0bed08cd MT	158	# Use gnu hash style
	159	cd $(DIR_APP) && sed -i Makeconfig \
	160	-e "s/-Wl,--hash-style=both/-Wl,--hash-style=gnu -Wl,-O1/"
342b9bc7 MT	161
	162	# stdlib/tst-putenvmod is not linked against libc.
	163	cd $(DIR_APP) && sed -i stdlib/Makefile \
	164	-e "s/^CFLAGS-tst-putenvmod.c.*/& -fno-stack-protector/g"
	165
	166	# stdio-common/bug22 hits timeout.
	167	cd $(DIR_APP) && sed -i stdio-common/bug22.c \
	168	-e "s/#define TIMEOUT.*/#define TIMEOUT 300/"
ce136479 MT	169
	170	# These tests don't work or need more investigation:
	171	cd $(DIR_APP) && sed -i dlfcn/Makefile -e "s/default //g"
	172
	173	cd $(DIR_APP) && sed -i nptl/Makefile \
	174	-e "s/tst-mutex5 //g" \
	175	-e "s/tst-mutex5a //g" \
	176	-e "s/tst-cond11 //g" \
	177	-e "s/tst-rwlock6 //g" \
	178	-e "s/tst-rwlock7 //g" \
	179	-e "s/tst-sem5 //g" \
	180	-e "s/tst-cancelx4 //g" \
	181	-e "s/tst-cancelx5 //g" \
	182	-e "s/tst-cancelx10 //g" \
	183	-e "s/tst-cancelx18 //g" \
80ac1d2c	184	-e "s/tst-signal1 //g"
ce136479 MT	185
	186	# These are known to fail on x86:
	187	cd $(DIR_APP) && sed -i rt/Makefile \
	188	-e "s/tst-cpuclock1 //g" \
	189	-e "s/tst-cpuclock2 //g"
	190
	191	cd $(DIR_APP) && sed -i elf/Makefile \
	192	-e "s/tst-tls1 //g" \
	193	-e "s/tst-tls1-static //g" \
	194	-e "s/tst-tls2 //g" \
	195	-e "s/tst-tls2-static //g" \
	196	-e "s/tst-tls3 //g" \
	197	-e "s/resolvfail //g" \
	198	-e "s/constload1 //g" \
	199	-e "s/order //g" \
	200	-e "s/lateglobal //g" \
	201	-e "s/dblload //g" \
	202	-e "s/dblunload //g" \
	203	-e "s/reldep6 //g" \
	204	-e "s/circleload1 //g" \
	205	-e "s/tst-global1 //g" \
	206	-e "s/tst-audit2 //g" \
	207	-e "s/check-localplt //g" \
	208	-e "s/check-localplt.out$$//g"
	209
80ac1d2c MT	210	cd $(DIR_APP) && sed -i signal/Makefile \
80ac1d2c MT	211	-e "s/tst-sigset2//g"
17c0ee8a	212	endef
166a6c21	213
17c0ee8a	214	define STAGE_BUILD
166a6c21 MT	215	# --enable-stackguard-randomization could be added here, but this is primarily
	216	# for attacks by local users, and we shouldn't have those in the rebooted
	217	# system. Adding this will empty the /dev/random entropy pool (via
	218	# /dev/urandom), unless the system is running a Random Number Gathering Daemon
	219	# (rngd). This version of Glibc uses high precision timing with SSP, so the
	220	# canary value changes at run-time. This is not as good as /dev/urandom, but
	221	# it's better than nothing and has very good performance.
	222
166a6c21 MT	223	cd $(DIR_SRC)/glibc-build && \
	224	CFLAGS= \
	225	CXXFLAGS= \
	226	../$(THISAPP)/configure \
166a6c21 MT	227	--prefix=/usr \
	228	--libexecdir=/usr/lib/glibc \
	229	--disable-profile \
	230	--enable-add-ons \
	231	--enable-kernel=$(OPTIMIZED_KERNEL) \
2777fcb0	232	--with-selinux \
166a6c21 MT	233	--disable-werror \
	234	--enable-bind-now \
	235	--enable-stackguard-randomization \
70b63715 MT	236	--with-stack-protector=all \
	237	--enable-__thread \
	238	--enable-tls \
	239	--enable-experimental-malloc \
	240	--with-gd \
	241	--with-nss-crypt
	242
	243	cd $(DIR_SRC)/glibc-build && sed -i config.make \
	244	-e "s/^build-pic-default=.*/build-pic-default=yes/"
166a6c21 MT	245
	246	# Our GCC is already passing -fPIC, and that's all we want for the libraries.
	247	# LDFLAGS.so is appended to so we don't build shared libraries with
	248	# DT_TEXTREL (and to tell us if something goes wrong). For now we only build
	249	# the libraries, not the programs:
	250	echo "build-programs=no" \
	251	>> $(DIR_SRC)/glibc-build/configparms
	252
	253	cd $(DIR_SRC)/glibc-build && make PARALLELMFLAGS=$(PARALLELISMFLAGS) \
0bed08cd MT	254	CFLAGS="$(CFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE" \
0bed08cd MT	255	CXXFLAGS="$(CXXFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE"
166a6c21 MT	256
	257	# Then build the programs with hardening, so everything possible in
	258	# $(TOOLS_DIR) is hardened:
0bed08cd	259	echo "# Nothing in here :D" > $(DIR_SRC)/glibc-build/configparms
166a6c21 MT	260	cd $(DIR_SRC)/glibc-build && make PARALLELMFLAGS=$(PARALLELISMFLAGS) \
166a6c21 MT	261	CFLAGS="$(CFLAGS)" CXXFLAGS="$(CXXFLAGS)"
17c0ee8a	262	endef
166a6c21	263
7c1fc7a0 MT	264	#define STAGE_TEST
	265	# cd $(DIR_SRC)/glibc-build && TIMEOUTFACTOR=16 make check \
	266	# CFLAGS="$(CFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE" \
	267	# CXXFLAGS="$(CXXFLAGS) -fno-stack-protector -U_FORTIFY_SOURCE"
	268	#endef
b6ca5178	269
17c0ee8a	270	define STAGE_INSTALL
166a6c21 MT	271	cd $(DIR_SRC)/glibc-build && make install install_root=$(BUILDROOT)
166a6c21 MT	272
166a6c21 MT	273	# Locales
166a6c21 MT	274	-mkdir -pv $(BUILDROOT)/usr/lib/locale
f1fdd4d6	275	# This would install all locales that are supported
166a6c21 MT	276	cd $(DIR_SRC)/glibc-build && make localedata/install-locales install_root=$(BUILDROOT)
166a6c21 MT	277
166a6c21 MT	278	# Timezone
	279	cp -v --remove-destination $(BUILDROOT)/usr/share/zoneinfo/GMT $(BUILDROOT)/etc/localtime
	280
	281	# Configuration
	282	cp -vf $(DIR_SOURCE)/{ld.so.conf,nsswitch.conf} $(BUILDROOT)/etc
7f617709 MT	283	-mkdir -pv $(BUILDROOT)/etc/{default,ld.so.conf.d}
7f617709 MT	284	install -p -m644 $(DIR_APP)/nis/nss $(BUILDROOT)/etc/default/nss
2cef8807 MT	285
2cef8807 MT	286	# Remove unused binaries
7f617709 MT	287	rm -vf $(BUILDROOT)/sbin/sln \
	288	$(BUILDROOT)/usr/bin/rpcinfo
	289
	290	# Don't distribute linker cache
	291	rm -vf $(BUILDROOT)/etc/ld.so.cache
	292
	293	# Include /usr/lib/gconv/gconv-modules.cache
	294	> $(BUILDROOT)/usr/lib/gconv/gconv-modules.cache
	295	chmod 644 $(BUILDROOT)/usr/lib/gconv/gconv-modules.cache
	296
	297	strip -g $(BUILDROOT)/usr/lib/*.o
	298
	299	# Move some libs to correct place
	300	mv -v $(BUILDROOT)/lib/lib{memusage,pcprofile}.so $(BUILDROOT)/usr/lib/
	301	endef
	302
	303	### Packages
	304
	305	# glibc-common
	306	PKG_PACKAGES += $(PKG_NAME)-common
	307	PKG_DEPS += $(PKG_NAME)-common
	308
	309	define PKG_FILES-$(PKG_NAME)-common
	310	/usr/bin
	311	/usr/sbin
	312	/usr/share
	313	!/usr/share/zoneinfo
	314	endef
	315
	316	# glibc-devel
	317	PKG_PACKAGES += $(PKG_NAME)-devel
	318
	319	PKG_SUMMARY-$(PKG_NAME)-devel = \
	320	Object files for development using standard C libraries.
	321	PKG_GROUP-$(PKG_NAME)-devel = Development/Libraries
	322	PKG_DEPS-$(PKG_NAME)-devel += $(PKG_NAME)-headers
	323
	324	define PKG_DESCRIPTION-$(PKG_NAME)-devel
	325	The glibc-devel package contains the object files necessary
	326	for developing programs which use the standard C libraries (which are
	327	used by nearly all programs). If you are developing programs which
	328	will use the standard C libraries, your system needs to have these
	329	standard object files available in order to create the
	330	executables.
	331
	332	Install glibc-devel if you are going to develop programs which will
	333	use the standard C libraries.
	334	endef
	335
	336	PKG_FILES-$(PKG_NAME)-devel += /usr/lib/.a /usr/lib/.o
	337
	338	# glibc-headers
	339	PKG_PACKAGES += $(PKG_NAME)-headers
	340
	341	PKG_DEPS-$(PKG_NAME)-headers += kernel-headers
	342
	343	define PKG_DESCRIPTION-$(PKG_NAME)-heasders
	344	The glibc-headers package contains the header files necessary
	345	for developing programs which use the standard C libraries (which are
	346	used by nearly all programs). If you are developing programs which
	347	will use the standard C libraries, your system needs to have these
	348	standard header files available in order to create the
	349	executables.
	350
351	Install glibc-headers if you are going to develop programs which will
352	use the standard C libraries.
353	endef
354
355	define PKG_FILES-$(PKG_NAME)-headers
356	/usr/include
357	!/usr/include/linuxthreads
358	!/usr/include/gnu/stubs-[32164]*.h
359	endef
360
361	# nscd
362	PKG_PACKAGES += nscd
363
364	PKG_SUMMARY-nscd = A Name Service Caching Daemon (nscd).
365	PKG_GROUP-nscd = System/Daemons
366
367	define PKG_DESCRIPTION-nscd
368	Nscd caches name service lookups and can dramatically improve \
369	performance with NIS+, and may help with DNS as well.
370	endef
371
372	define PKG_FILES-nscd
373	/usr/sbin/nscd
374	endef
375
376	# glibc-utils
377	PKG_PACKAGES += $(PKG_NAME)-utils
378
379	PKG_SUMMARY-$(PKG_NAME)-utils = Development utilities from GNU C library.
380	PKG_GROUP-$(PKG_NAME)-utils = Development/Tools
381	define PKG_DESCRIPTION_$(PKG_NAME)-utils
382	The glibc-utils package contains memusage, a memory usage profiler, \
383	mtrace, a memory leak tracer and xtrace, a function call tracer \
384	which can be helpful during program debugging.
385	endef
386
387	define PKG_FILES-$(PKG_NAME)-utils
388	/usr/bin/memusage{,stat}
389	/usr/bin/mtrace
390	/usr/bin/pcprofiledump
391	/usr/bin/xtrace
392	/usr/lib/libmemusage.so
393	/usr/lib/libpcprofile.so
17c0ee8a	394	endef