grub: Disable hardening for grub-script-check binary.

[people/ms/ipfire-3.x.git] / grub / grub.nm

diff --git a/grub/grub.nm b/grub/grub.nm
index 98658a0d49e926d9586b1395a8dee040242c71c7..b109a2ad191617712efbb4a33af2283a769a8a7b 100644 (file)
--- a/grub/grub.nm
+++ b/grub/grub.nm
@@ -5,9 +5,7 @@
 
 name       = grub
 version    = 2.00
-prerelease = beta5
-release    = 0.3.%{prerelease}
-thisapp    = %{name}-%{version}~%{prerelease}
+release    = 5
 sup_arches = x86_64 i686
 
 groups     = System/Boot
@@ -25,6 +23,9 @@ end
 source_dl  = http://ftp.gnu.org/gnu/grub/ ftp://alpha.gnu.org/gnu/grub/
 sources    = %{thisapp}.tar.xz
 
+# Unifont
+unifont = /usr/share/X11/fonts/misc/unifont.pcf.gz
+
 build
        requires
                autoconf
@@ -32,18 +33,20 @@ build
                automake
                bison
                bzip2-devel
+               dejavu-fonts-sans-fonts
                flex
                freetype-devel
                gettext
                libdevmapper-devel
                ncurses-devel
+               paxctl
                zlib-devel
+               %{unifont}
        end
 
        prepare_cmds
-               # Create a copy of the source tree to build
-               # an EFI enabled version of grub.
-               cp -pR . %{DIR_SRC}/%{thisapp}-efi
+               cp -vf %{unifont} unifont.pcf.gz
+               ./autogen.sh
        end
 
        # As the modules contain always 32 bit code, they
@@ -52,60 +55,51 @@ build
 
        configure_options += \
                --target="i386" \
-               --datadir=%{libdir} \
                --with-platform=pc \
                --program-transform-name=s,grub,grub, \
                --disable-werror \
                CFLAGS="$(echo %{CFLAGS} | sed \
+                       -e 's/-Wp,-D_FORTIFY_SOURCE=2//g' \
+                       -e 's/-fstack-protector-all//g' \
                        -e 's/-fstack-protector//g' \
+                       -e 's/-fPIC//g' \
                        -e 's/--param=ssp-buffer-size=4//g' \
                        -e 's/-mregparm=3/-mregparm=4/g' \
                        -e 's/-fexceptions//g' \
                        -e 's/-m64//g' \
                        -e 's/-fasynchronous-unwind-tables//g' )"
 
-       build_cmds
-               cd ../%{thisapp}-efi
-               ./configure \
-                       %{configure_options} \
-                       --with-platform=efi \
-                       CFLAGS="$(echo %{CFLAGS} | sed \
-                               -e 's/-O.//g' \
-                               -e 's/-fstack-protector//g' \
-                               -e 's/--param=ssp-buffer-size=4//g' \
-                               -e 's/-mregparm=3/-mregparm=4/g' \
-                               -e 's/-fexceptions//g' \
-                               -e 's/-m64//g' \
-                               -e 's/-fasynchronous-unwind-tables//g' )"
-
-               make %{PARALLELISMFLAGS}
-
-               ./grub-mkimage \
-                       -O i386-efi \
-                       -p /EFI/%{DISTRO_SNAME}/grub-efi \
-                       -o grub.efi \
-                       -d grub-core part_gpt hfsplus fat ext2 btrfs normal chain \
-                       boot configfile linux appleldr minicmd loadbios reboot halt \
-                       search font gfxterm echo video all_video
-       end
-
-       install
-               cd ../%{thisapp}-efi
-               make install DESTDIR=%{BUILDROOT}
-
-               install -m 755 -d %{BUILDROOT}/boot/efi/EFI/%{DISTRO_SNAME}/
-               install -d %{BUILDROOT}/boot/efi/EFI/%{DISTRO_SNAME}/grub-efi
-               touch %{BUILDROOT}/boot/efi/EFI/%{DISTRO_SNAME}/grub-efi/grub.cfg
-               ln -svf ../boot/efi/EFI/%{DISTRO_SNAME}/grub-efi/grub.cfg %{BUILDROOT}/etc/grub-efi.cfg
-               install -m 755 grub.efi %{BUILDROOT}/boot/efi/EFI/%{DISTRO_SNAME}/grub-efi/grub.efi
-
-               cd -
-               make install DESTDIR=%{BUILDROOT}
-
+       install_cmds
                # Install empty configuration file.
                mkdir -pv %{BUILDROOT}/boot/grub
                touch %{BUILDROOT}/boot/grub/grub.cfg
                ln -svf ../boot/grub/grub.cfg %{BUILDROOT}%{sysconfdir}/grub2.cfg
+
+               # Don't ship the default theme, replace it by our own one.
+               rm -rfv %{BUILDROOT}/boot/grub/themes/starfield \
+                       %{datadir}/grub/themes
+               mkdir -pv %{BUILDROOT}/boot/grub/themes/system
+               cp -rfv %{DIR_SOURCE}/theme/* \
+                       %{BUILDROOT}/boot/grub/themes/system/
+
+               # Prepare the fonts.
+               mkdir -pv %{BUILDROOT}/boot/grub/themes/system
+               pushd %{BUILDROOT}/boot/grub/themes/system/
+               %{BUILDROOT}%{bindir}/grub-mkfont -o DejaVuSans-10.pf2 -s 10 \
+                       %{datadir}/fonts/dejavu/DejaVuSans.ttf
+               %{BUILDROOT}%{bindir}/grub-mkfont -o DejaVuSans-12.pf2 -s 12 \
+                       %{datadir}/fonts/dejavu/DejaVuSans.ttf
+               %{BUILDROOT}%{bindir}/grub-mkfont -o DejaVuSans-Bold-14.pf2 \
+                       -s 14 %{datadir}/fonts/dejavu/DejaVuSans-Bold.ttf
+               popd
+
+               # Disable hardening.
+               paxctl -mpes \
+                       %{BUILDROOT}%{sbindir}/grub-bios-setup \
+                       %{BUILDROOT}%{sbindir}/grub-probe
+
+               paxctl -mpex \
+                       %{BUILDROOT}%{bindir}/grub-script-check
        end
 
        debuginfo_strict_build_id = false
@@ -113,7 +107,7 @@ end
 
 quality-agent
        whitelist_nx
-               /usr/bin/*|/usr/sbin/*
+               %{bindir}/*|%{sbindir}/*
        end
 end
 
@@ -122,40 +116,17 @@ packages
                requires
                        gettext
                        os-prober
-                       /usr/share/X11/fonts/misc/unifont.pcf.gz
-                       system-logos
-               end
-
-               configfiles
-                       /boot/grub/grub.cfg
-                       /etc/default/grub
+                       system-logos >= 2
                end
 
-               # Generate grub compatible font for graphical boot menu
-               # This only converts Latin-1, Latin Extended A+B, Arrows, Box and Block characters
-               script postin
-                       /usr/bin/grub-mkfont --output /boot/grub/unifont.pf2 \
-                               --range=0x0000-0x0241,0x2190-0x21FF,0x2500-0x259f \
-                               /usr/share/X11/fonts/misc/unifont.pcf.gz
-               end
-       end
-
-       package %{name}-efi
-               description
-                       EFI version of GRUB, the Grand Unified Boot Loader.
+               # An EFI version of grub does not exist any more.
+               obsoletes
+                       grub-efi <= 2.0.0-2
                end
-               summary = %{description}
-
-               requires += grub = %{thisver}
 
                configfiles
-                       /boot/efi/EFI/%{DISTRO_SNAME}/grub-efi/grub.cfg
-               end
-
-               files
-                       /boot/efi
-                       /etc/grub-efi.cfg
-                       /usr/lib/grub/i386-efi
+                       /boot/grub/grub.cfg
+                       /etc/default/grub
                end
        end