glibc: Disable multilib support on X86_64

This requires a 32bit glibc to link against, which we do not have.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

unbound: Create missing directory for root anchor

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

whois: Change download location

Debian moved to a recent version of which and dropped
the source tarball from their server.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

systemd: Enable sysusers subsystem

This allows dynamically user and group creation based on
sysusers config files.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

systemd: Update to 253

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

glibc: Fix runtime linker path chaos

Some architectures have a specific path for their runtime linker
hardcoded and in order to avoid installing them into /lib or /lib64
instead of /usr/lib or /usr/lib64, we are adding artificial provides.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Harden this package

This is a major rewrite of this package which should probably be broken
down into several commits, but since GCC takes many hours to build, this
has now been mushed into one to keep us moving forward.

This patch re-introduces a full bootstrap of GCC.

We also build GCC with our own compiler flags and make it pass our
hardening checks which includes patching the build system to build GCC
itself as PIE.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Fix RUNPATH in gconv libraries

Those libraries uses a special RUNPATH called $ORIGIN which we
do not support in IPFire. So changing this to the directory where
the are installed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

chrpath: Drop package

This package has seen no updates for a long time and has been
replaced by the similar and better supported patchelf.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

gettext: Switch to patchelf to remove the RPATH

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

libldb: Switch to patchelf to remove the RPATH

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

libdb: Switch to patchelf to remove the RPATH

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

net-snmp: Switch to patchelf to remove the RPATH

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

tcpdump: Switch to patchelf to remove the RPATH

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

patchelf: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

filesystem: Make filesystem structure FHS compliant

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Proper build the helper binaries with our C and LDFLAGS

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

liboping: Re-enable setting capabilities

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

iputils: Re-enable setting capabilities

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

util-linux: Re-enable setting capabilities

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

nfs-utils: mount.nfs - Use capabilities instead of suid bit

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

shadow-utils: Use capabilites and remove more unused binaries

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

unbound: Use /run instead of /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

screen: Make screen FHS compliant

* Explicit use pam.
* Change socket dir to /run and add tmpfiles file.
* Only ship a simple screen binary without version
  fragments
* Remove SUID bit from binary

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

sudo: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

network: Add patch to fix logdir

Add upstream patch to proper set the location
to the logdir.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

openssh: Change privsep directory to /var/lib/sshd

The old one /var/empty/sshd violated our FHS

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

samba: Drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

unbound: Do not create /var/run

This violates our FHS specs.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

tcl: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

sssd: Use /var/lib/sss and drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

squid: Drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

snort: Set correct permissions of helper script

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

spectre-meltdown-checker: Install binary with correct permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

python3-pygobject3: Fix header file permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

python3-cairo: Fix header permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ppp: Fix binary permissions and drop deprecated dirs in /var

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

plymouth: Drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-WWW-Curl: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-WWW-Curl: Enable testsuite

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-XML-Parser: Fix library permissions

* Also enable the testsuite
* Drop old fragment from QA

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-XML-Parser: Set correct perl dependencies

Do not longer use perl-core/perl-devel as build
dependencies.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-TermReadkey: Enable testsuite

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-TermReadkey: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-SGMLSpm: Drop unneccessary perl script

We do not need this and it violates our FHS specs.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Parse-Yapp: Fix library and binary permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Net-SSLeay: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-libintl-perl: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-IO-AIO: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-HTML-Tagset: Add proper perl build dependencies

Do not longer depend on perl-core or perl-devel.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-HTML-Parser: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-GSSAPI: Fix library permissions

* Also enable the testsuite

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-FCGI: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-DBI: Fix library and binary permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Digest-SHA1: Enable testsuite

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Digest-SHA1: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Crypt-OpenSSL-X509: Enable testsuite

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Crypt-OpenSSL-X509: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-Coro: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-BDB: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

libvirt: Fix binary permissions and drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

pciutils: Install header files with correct permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

bash: Set correct permissions for /root and binaries

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

openssh: Fix permissions for sshd-keygen

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

openldap: Do not ship /run/openldap anymore

This violetes our FHS specs

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

nettle: Fix library permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

net-snmp: Do not create /var/run anymore

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

netpbm: Drop unneeded pkgconfig_template file

Anyway it was located at an invalid place.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

mdadm: Use systemd tmpfile

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

lvm2: Do not ship /run and it's content

This violetes our FHS specs

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

lm-sensors: Proper use compiler and linker flags during build time

Those flags are required during build time and not during installation.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

lldpd: Do not create /run/lldpd

This violates our FHS specs.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

kea: Drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

krb5: Change /var/kerberos to /var/lib/kerberos

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

libdb: Fix binary and header file permissions

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

iptraf-ng: Proper use our compiler and linker flags

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

iptraf-ng: Do not longer create /var/lock

This folder violetes our FHS specs.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

intel-microcode: Set correct permissions for dirs and files

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

gettext: The config.rpath script needs to be executeable

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

dma: Update to 0.13

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

chrpath: Install documentation to the correct place

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

dhcpcd: Fix permissions of dhcpcd binary

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

cyrus-sasl: Use /run instead of /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

cups: Fix file permissions in /usr/include and drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

sudo: Use systemd tmpfiles mechanism

Use the tmpfiles mechanism from systemd to proper
recreate the /run/sudo directory.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

bird: Drop /var/run

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

git: Hook examples should not be executeable

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

gettext: Drop unneccessary stuff

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

sgml-common: Drop HTML documentation

We do not need this on our systems - anyway it
has been installed in a wrong directory.

Also replaced all hardcoded path values.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

docbook-xsl: Fix file and directory permissions

The violated our FHS standards.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

docbook-utils: Drop HTML documentation

We do not need this on our systems - Anyway it has been
installed to a wrong place by default.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

docbook-dtds: Install files not executeable

This is not required and vilates our FSH standards.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

qemu: Drop unused firmware files and /var/run

* Drop firmware files for platforms we do not support.
* Drop /var/run directory which violetes the FSH.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl: Fix library permissions

They did not fit the FSH and our own specs.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

util-linux: Do no create /run/uuidd

The folder will be created by systemd and violates the FSH.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

systemd: Do not create /run/log/journal

This will be done by the corresponding tmpfiles configuration
and violetes the FHS.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

setup: Do not create /run/motd.d folder

This folder will be created from systemd by the corresponding
tmpfiles script and fails our FHS checks.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

dwz: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xxhash: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Make this package confirm to FHS/Hardening

This patch changes many things about glibc in one go. Sorry.

We move glibc out of /lib so that we no longer install any files where
they should not be according to our FHS.

We also enable SSP-all and ensure that everything is properly hardened.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>