commit: e79e7791eb59e8afeb86e1ef75d5b955492c2e06 Author: Tomáš Mózes <hydrapolic <AT> gmail <DOT> com> AuthorDate: Fri Feb 19 13:33:20 2021 +0000 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> CommitDate: Sun Feb 21 16:07:56 2021 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e79e7791
app-emulation/xen: add security patches Fixes XSA-364. Bug: https://bugs.gentoo.org/742272 Bug: https://bugs.gentoo.org/771117 Signed-off-by: Tomáš Mózes <hydrapolic <AT> gmail.com> Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> app-emulation/xen/Manifest | 2 + app-emulation/xen/xen-4.13.2-r5.ebuild | 165 +++++++++++++++++++++++++++++++++ app-emulation/xen/xen-4.14.1-r1.ebuild | 165 +++++++++++++++++++++++++++++++++ 3 files changed, 332 insertions(+) diff --git a/app-emulation/xen/Manifest b/app-emulation/xen/Manifest index e33f7425bb5..6a5899a7596 100644 --- a/app-emulation/xen/Manifest +++ b/app-emulation/xen/Manifest @@ -1,3 +1,5 @@ DIST xen-4.13.2-upstream-patches-3.tar.xz 63660 BLAKE2B 80abc9529ff49e782b64d4b5032f724e7d95fd255c2a06b7065c693d5765e1db1df44ebd5ce00c5a1e1ff24e1e5d344b0c2e459c68282e58fa20963e208272d2 SHA512 35288a1feac1316c33586dad55685e2c6a30100795e31852f78455003ce3dd6906074bea023655ee545a97fe4a0a8ad9a05ab91fd83186e61e5b57d10aa6b155 +DIST xen-4.13.2-upstream-patches-4.tar.xz 65324 BLAKE2B 0e71e4600fffcf1341a52103a6318485c1da54101ec59dbdb9824be5a5ed1f977135a9c3e4ce48cf14922aa0a2e3ff5097dc870286e3b142d060c22d78079cb3 SHA512 3f0e41b685655c7753204862ea6b8e502ff4b4f76e4788ca07ab93a4bb3c636d24ad933c578f7c6e4c866cfb0d6b7b7234124da7c2fed0a4b34f2fbe401c56e1 DIST xen-4.13.2.tar.gz 39037826 BLAKE2B ad2b7c3003ca29e5e60a85c581f706ef87d99eadf939ed36ebe8f6698582f7a29dbdaf502039b60a0afe7ad4ae6ce89713e69dc8b8a7d5abe65063da7f1baa5b SHA512 cd3092281c97e9421e303aa288aac04dcccd5536ba7c0ff4d51fbf3d07b5ffacfe3456ba06f5cf63577dafbf8cf3a5d9825ceb5e9ef8ca1427900cc3e57b50a3 +DIST xen-4.14.1-upstream-patches-1.tar.xz 11676 BLAKE2B 0d593b34e3b1b95b57c54ccc96666eb5bf36d63ba742dd9d6e6f5facdf57be62e1f8375beb23926967e6ea23c1e4fa459bb5087652716d7e45b2309440f81b0d SHA512 e530883d17738b4821fa36fd39a7597bdb42810e40740c7a3363c22945d71af80312340f6d33b18f5999498e59036f22033b7babe217bac7700702d007d5d881 DIST xen-4.14.1.tar.gz 39970115 BLAKE2B 21e5838b2b4d78420dcaaae2b8fc98ac876230217e6a3764aa643920150b8cef96025663e6a2fc423ab15f7f470b62547e91ce1be0337fc78f00c148c7ff40ab SHA512 c75cbec82793435f5a7026626ffdb2e9a2166b42d2be4b2f1194240e0312458124f0ebd53eeb02ce7330c22afe402a28a96b32f8af66e41e9416fe94535724c9 diff --git a/app-emulation/xen/xen-4.13.2-r5.ebuild b/app-emulation/xen/xen-4.13.2-r5.ebuild new file mode 100644 index 00000000000..45a2cee2cf9 --- /dev/null +++ b/app-emulation/xen/xen-4.13.2-r5.ebuild @@ -0,0 +1,165 @@ +# Copyright 1999-2021 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +PYTHON_COMPAT=( python3_{6..9} ) + +inherit flag-o-matic mount-boot multilib python-any-r1 toolchain-funcs + +MY_PV=${PV/_/-} +MY_P=${PN}-${MY_PV} + +if [[ $PV == *9999 ]]; then + inherit git-r3 + EGIT_REPO_URI="git://xenbits.xen.org/xen.git" + SRC_URI="" +else + KEYWORDS="~amd64 ~arm -x86" + UPSTREAM_VER=4 + SECURITY_VER= + GENTOO_VER= + + [[ -n ${UPSTREAM_VER} ]] && \ + UPSTREAM_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${P}-upstream-patches-${UPSTREAM_VER}.tar.xz + https://github.com/hydrapolic/gentoo-dist/raw/master/xen/${P}-upstream-patches-${UPSTREAM_VER}.tar.xz"; + [[ -n ${SECURITY_VER} ]] && \ + SECURITY_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN}-security-patches-${SECURITY_VER}.tar.xz"; + [[ -n ${GENTOO_VER} ]] && \ + GENTOO_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN}-gentoo-patches-${GENTOO_VER}.tar.xz"; + SRC_URI="https://downloads.xenproject.org/release/xen/${MY_PV}/${MY_P}.tar.gz + ${UPSTREAM_PATCHSET_URI} + ${SECURITY_PATCHSET_URI} + ${GENTOO_PATCHSET_URI}" +fi + +DESCRIPTION="The Xen virtual machine monitor" +HOMEPAGE="https://www.xenproject.org"; +LICENSE="GPL-2" +SLOT="0" +IUSE="debug efi flask" + +DEPEND="${PYTHON_DEPS} + efi? ( >=sys-devel/binutils-2.22[multitarget] ) + !efi? ( >=sys-devel/binutils-2.22 )" +RDEPEND="" +PDEPEND="~app-emulation/xen-tools-${PV}" + +# no tests are available for the hypervisor +# prevent the silliness of /usr/lib/debug/usr/lib/debug files +# prevent stripping of the debug info from the /usr/lib/debug/xen-syms +RESTRICT="test splitdebug strip" + +# Approved by QA team in bug #144032 +QA_WX_LOAD="boot/xen-syms-${PV}" + +REQUIRED_USE="arm? ( debug )" + +S="${WORKDIR}/${MY_P}" + +pkg_setup() { + python-any-r1_pkg_setup + if [[ -z ${XEN_TARGET_ARCH} ]]; then + if use amd64; then + export XEN_TARGET_ARCH="x86_64" + elif use arm; then + export XEN_TARGET_ARCH="arm32" + elif use arm64; then + export XEN_TARGET_ARCH="arm64" + else + die "Unsupported architecture!" + fi + fi + + if use flask ; then + export "XSM_ENABLE=y" + export "FLASK_ENABLE=y" + fi +} + +src_prepare() { + # Upstream's patchset + [[ -n ${UPSTREAM_VER} ]] && eapply "${WORKDIR}"/patches-upstream + + # Security patchset + if [[ -n ${SECURITY_VER} ]]; then + einfo "Try to apply Xen Security patch set" + # apply main xen patches + # Two parallel systems, both work side by side + # Over time they may concdense into one. This will suffice for now + source "${WORKDIR}"/patches-security/${PV}.conf + + local i + for i in ${XEN_SECURITY_MAIN}; do + eapply "${WORKDIR}"/patches-security/xen/$i + done + fi + + # Gentoo's patchset + [[ -n ${GENTOO_VER} ]] && eapply "${WORKDIR}"/patches-gentoo + + eapply "${FILESDIR}"/${PN}-4.11-efi.patch + + # Drop .config + sed -e '/-include $(XEN_ROOT)\/.config/d' -i Config.mk || die "Couldn't drop" + + if use efi; then + export EFI_VENDOR="gentoo" + export EFI_MOUNTPOINT="/boot" + fi + + default +} + +src_configure() { + use arm && myopt="${myopt} CONFIG_EARLY_PRINTK=sun7i" + + use debug && myopt="${myopt} debug=y" + + # remove flags + unset CFLAGS + unset LDFLAGS + unset ASFLAGS + + tc-ld-disable-gold # Bug 700374 +} + +src_compile() { + # Send raw LDFLAGS so that --as-needed works + emake V=1 CC="$(tc-getCC)" LDFLAGS="$(raw-ldflags)" LD="$(tc-getLD)" -C xen ${myopt} +} + +src_install() { + local myopt + use debug && myopt="${myopt} debug=y" + + # The 'make install' doesn't 'mkdir -p' the subdirs + if use efi; then + mkdir -p "${D}"${EFI_MOUNTPOINT}/efi/${EFI_VENDOR} || die + fi + + emake LDFLAGS="$(raw-ldflags)" LD="$(tc-getLD)" DESTDIR="${D}" -C xen ${myopt} install + + # make install likes to throw in some extra EFI bits if it built + use efi || rm -rf "${D}/usr/$(get_libdir)/efi" +} + +pkg_postinst() { + elog "Official Xen Guide:" + elog " https://wiki.gentoo.org/wiki/Xen"; + + use efi && einfo "The efi executable is installed in /boot/efi/gentoo" + + elog "You can optionally block the installation of /boot/xen-syms by an entry" + elog "in folder /etc/portage/env using the portage's feature INSTALL_MASK" + elog "e.g. echo ${msg} > /etc/portage/env/xen.conf" + + ewarn + ewarn "Xen 4.12+ changed the default scheduler to credit2 which can cause" + ewarn "domU lockups on multi-cpu systems. The legacy credit scheduler seems" + ewarn "to work fine." + ewarn + ewarn "Add sched=credit to xen command line options to use the legacy scheduler." + ewarn + ewarn "https://wiki.gentoo.org/wiki/Xen#Xen_domU_hanging_with_Xen_4.12.2B"; +} diff --git a/app-emulation/xen/xen-4.14.1-r1.ebuild b/app-emulation/xen/xen-4.14.1-r1.ebuild new file mode 100644 index 00000000000..92af1429434 --- /dev/null +++ b/app-emulation/xen/xen-4.14.1-r1.ebuild @@ -0,0 +1,165 @@ +# Copyright 1999-2021 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +PYTHON_COMPAT=( python3_{6..9} ) + +inherit flag-o-matic mount-boot multilib python-any-r1 toolchain-funcs + +MY_PV=${PV/_/-} +MY_P=${PN}-${MY_PV} + +if [[ $PV == *9999 ]]; then + inherit git-r3 + EGIT_REPO_URI="git://xenbits.xen.org/xen.git" + SRC_URI="" +else + KEYWORDS="~amd64 ~arm -x86" + UPSTREAM_VER=1 + SECURITY_VER= + GENTOO_VER= + + [[ -n ${UPSTREAM_VER} ]] && \ + UPSTREAM_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${P}-upstream-patches-${UPSTREAM_VER}.tar.xz + https://github.com/hydrapolic/gentoo-dist/raw/master/xen/${P}-upstream-patches-${UPSTREAM_VER}.tar.xz"; + [[ -n ${SECURITY_VER} ]] && \ + SECURITY_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN}-security-patches-${SECURITY_VER}.tar.xz"; + [[ -n ${GENTOO_VER} ]] && \ + GENTOO_PATCHSET_URI="https://dev.gentoo.org/~dlan/distfiles/${PN}-gentoo-patches-${GENTOO_VER}.tar.xz"; + SRC_URI="https://downloads.xenproject.org/release/xen/${MY_PV}/${MY_P}.tar.gz + ${UPSTREAM_PATCHSET_URI} + ${SECURITY_PATCHSET_URI} + ${GENTOO_PATCHSET_URI}" +fi + +DESCRIPTION="The Xen virtual machine monitor" +HOMEPAGE="https://www.xenproject.org"; +LICENSE="GPL-2" +SLOT="0" +IUSE="debug efi flask" + +DEPEND="${PYTHON_DEPS} + efi? ( >=sys-devel/binutils-2.22[multitarget] ) + !efi? ( >=sys-devel/binutils-2.22 )" +RDEPEND="" +PDEPEND="~app-emulation/xen-tools-${PV}" + +# no tests are available for the hypervisor +# prevent the silliness of /usr/lib/debug/usr/lib/debug files +# prevent stripping of the debug info from the /usr/lib/debug/xen-syms +RESTRICT="test splitdebug strip" + +# Approved by QA team in bug #144032 +QA_WX_LOAD="boot/xen-syms-${PV}" + +REQUIRED_USE="arm? ( debug )" + +S="${WORKDIR}/${MY_P}" + +pkg_setup() { + python-any-r1_pkg_setup + if [[ -z ${XEN_TARGET_ARCH} ]]; then + if use amd64; then + export XEN_TARGET_ARCH="x86_64" + elif use arm; then + export XEN_TARGET_ARCH="arm32" + elif use arm64; then + export XEN_TARGET_ARCH="arm64" + else + die "Unsupported architecture!" + fi + fi + + if use flask ; then + export "XSM_ENABLE=y" + export "FLASK_ENABLE=y" + fi +} + +src_prepare() { + # Upstream's patchset + [[ -n ${UPSTREAM_VER} ]] && eapply "${WORKDIR}"/patches-upstream + + # Security patchset + if [[ -n ${SECURITY_VER} ]]; then + einfo "Try to apply Xen Security patch set" + # apply main xen patches + # Two parallel systems, both work side by side + # Over time they may concdense into one. This will suffice for now + source "${WORKDIR}"/patches-security/${PV}.conf + + local i + for i in ${XEN_SECURITY_MAIN}; do + eapply "${WORKDIR}"/patches-security/xen/$i + done + fi + + # Gentoo's patchset + [[ -n ${GENTOO_VER} ]] && eapply "${WORKDIR}"/patches-gentoo + + eapply "${FILESDIR}"/${PN}-4.14-efi.patch + + # Drop .config + sed -e '/-include $(XEN_ROOT)\/.config/d' -i Config.mk || die "Couldn't drop" + + if use efi; then + export EFI_VENDOR="gentoo" + export EFI_MOUNTPOINT="/boot" + fi + + default +} + +src_configure() { + use arm && myopt="${myopt} CONFIG_EARLY_PRINTK=sun7i" + + use debug && myopt="${myopt} debug=y" + + # remove flags + unset CFLAGS + unset LDFLAGS + unset ASFLAGS + + tc-ld-disable-gold # Bug 700374 +} + +src_compile() { + # Send raw LDFLAGS so that --as-needed works + emake V=1 CC="$(tc-getCC)" LDFLAGS="$(raw-ldflags)" LD="$(tc-getLD)" -C xen ${myopt} +} + +src_install() { + local myopt + use debug && myopt="${myopt} debug=y" + + # The 'make install' doesn't 'mkdir -p' the subdirs + if use efi; then + mkdir -p "${D}"${EFI_MOUNTPOINT}/efi/${EFI_VENDOR} || die + fi + + emake LDFLAGS="$(raw-ldflags)" LD="$(tc-getLD)" DESTDIR="${D}" -C xen ${myopt} install + + # make install likes to throw in some extra EFI bits if it built + use efi || rm -rf "${D}/usr/$(get_libdir)/efi" +} + +pkg_postinst() { + elog "Official Xen Guide:" + elog " https://wiki.gentoo.org/wiki/Xen"; + + use efi && einfo "The efi executable is installed in /boot/efi/gentoo" + + elog "You can optionally block the installation of /boot/xen-syms by an entry" + elog "in folder /etc/portage/env using the portage's feature INSTALL_MASK" + elog "e.g. echo ${msg} > /etc/portage/env/xen.conf" + + ewarn + ewarn "Xen 4.12+ changed the default scheduler to credit2 which can cause" + ewarn "domU lockups on multi-cpu systems. The legacy credit scheduler seems" + ewarn "to work fine." + ewarn + ewarn "Add sched=credit to xen command line options to use the legacy scheduler." + ewarn + ewarn "https://wiki.gentoo.org/wiki/Xen#Xen_domU_hanging_with_Xen_4.12.2B"; +}
