From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1497239-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 2C1BB15A7D9
for <garchives@archives.gentoo.org>; Fri, 17 Mar 2023 02:37:16 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 6999B2BC03A;
Fri, 17 Mar 2023 02:37:15 +0000 (UTC)
Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 3B78E2BC03A
for <gentoo-commits@lists.gentoo.org>; Fri, 17 Mar 2023 02:37:15 +0000 (UTC)
Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 6FC98340F5C
for <gentoo-commits@lists.gentoo.org>; Fri, 17 Mar 2023 02:37:14 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id BBF357F5
for <gentoo-commits@lists.gentoo.org>; Fri, 17 Mar 2023 02:37:12 +0000 (UTC)
From: "Sam James" <sam@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" <sam@gentoo.org>
Message-ID: <1679020553.0b7eace724b0035856311008c95cc7fe18b8231b.sam@gentoo>
Subject: [gentoo-commits] repo/gentoo:master commit in: sys-libs/glibc/
X-VCS-Repository: repo/gentoo
X-VCS-Files: sys-libs/glibc/glibc-2.36-r7.ebuild sys-libs/glibc/glibc-2.37-r1.ebuild sys-libs/glibc/glibc-9999.ebuild
X-VCS-Directories: sys-libs/glibc/
X-VCS-Committer: sam
X-VCS-Committer-Name: Sam James
X-VCS-Revision: 0b7eace724b0035856311008c95cc7fe18b8231b
X-VCS-Branch: master
Date: Fri, 17 Mar 2023 02:37:12 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: 270c0b8d-cc17-404b-90d8-5a1a56e701ab
X-Archives-Hash: e6dba50f747b29444892761b949a850d
commit: 0b7eace724b0035856311008c95cc7fe18b8231b
Author: Krzesimir Nowak <knowak <AT> microsoft <DOT> com>
AuthorDate: Fri Mar 17 02:34:21 2023 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Fri Mar 17 02:35:53 2023 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0b7eace7
sys-libs/glibc: disable CET explicitly if USE=-cet
When bootstrapping, we may have a situation where CET-enabled gcc from seed is
used to build CET-disabled glibc. As such, gcc implicitly enables CET if no
-fcf-protection flag is passed. For a typical package it should not be a problem,
but for glibc it matters as it is dealing with CET in ld.so. So if CET is supposed to be
disabled for glibc, be explicit about it.
[sam: cherry-picked from Flatcar at https://github.com/flatcar/coreos-overlay/commit/f4b92a6de9fcf506b30f1c6156b27c0e3d25438e]
Bug: https://bugs.gentoo.org/830454
Closes: https://bugs.gentoo.org/901363
Signed-off-by: Sam James <sam <AT> gentoo.org>
sys-libs/glibc/glibc-2.36-r7.ebuild | 13 ++++++++++++-
sys-libs/glibc/glibc-2.37-r1.ebuild | 13 ++++++++++++-
sys-libs/glibc/glibc-9999.ebuild | 13 ++++++++++++-
3 files changed, 36 insertions(+), 3 deletions(-)
diff --git a/sys-libs/glibc/glibc-2.36-r7.ebuild b/sys-libs/glibc/glibc-2.36-r7.ebuild
index 8bb3e20062b4..28002f738a95 100644
--- a/sys-libs/glibc/glibc-2.36-r7.ebuild
+++ b/sys-libs/glibc/glibc-2.36-r7.ebuild
@@ -472,7 +472,18 @@ setup_flags() {
filter-flags '-fsanitize=*'
# See end of bug #830454; we handle this via USE=cet
- filter-flags '-fcf-protection='
+ filter-flags '-fcf-protection=*'
+
+ # When bootstrapping, we may have a situation where
+ # CET-enabled gcc from seed is used to build CET-disabled
+ # glibc. As such, gcc implicitly enables CET if no
+ # -fcf-protection flag is passed. For a typical package it
+ # should not be a problem, but for glibc it matters as it is
+ # dealing with CET in ld.so. So if CET is supposed to be
+ # disabled for glibc, be explicit about it.
+ if (use amd64 || use x86) && ! use cet; then
+ append-flags '-fcf-protection=none'
+ fi
}
use_multiarch() {
diff --git a/sys-libs/glibc/glibc-2.37-r1.ebuild b/sys-libs/glibc/glibc-2.37-r1.ebuild
index 55b5a05c1ef8..4b041ecc1f7e 100644
--- a/sys-libs/glibc/glibc-2.37-r1.ebuild
+++ b/sys-libs/glibc/glibc-2.37-r1.ebuild
@@ -472,7 +472,18 @@ setup_flags() {
filter-flags '-fsanitize=*'
# See end of bug #830454; we handle this via USE=cet
- filter-flags '-fcf-protection='
+ filter-flags '-fcf-protection=*'
+
+ # When bootstrapping, we may have a situation where
+ # CET-enabled gcc from seed is used to build CET-disabled
+ # glibc. As such, gcc implicitly enables CET if no
+ # -fcf-protection flag is passed. For a typical package it
+ # should not be a problem, but for glibc it matters as it is
+ # dealing with CET in ld.so. So if CET is supposed to be
+ # disabled for glibc, be explicit about it.
+ if (use amd64 || use x86) && ! use cet; then
+ append-flags '-fcf-protection=none'
+ fi
}
use_multiarch() {
diff --git a/sys-libs/glibc/glibc-9999.ebuild b/sys-libs/glibc/glibc-9999.ebuild
index df348d783cb1..f5ec71d81a7b 100644
--- a/sys-libs/glibc/glibc-9999.ebuild
+++ b/sys-libs/glibc/glibc-9999.ebuild
@@ -472,7 +472,18 @@ setup_flags() {
filter-flags '-fsanitize=*'
# See end of bug #830454; we handle this via USE=cet
- filter-flags '-fcf-protection='
+ filter-flags '-fcf-protection=*'
+
+ # When bootstrapping, we may have a situation where
+ # CET-enabled gcc from seed is used to build CET-disabled
+ # glibc. As such, gcc implicitly enables CET if no
+ # -fcf-protection flag is passed. For a typical package it
+ # should not be a problem, but for glibc it matters as it is
+ # dealing with CET in ld.so. So if CET is supposed to be
+ # disabled for glibc, be explicit about it.
+ if (use amd64 || use x86) && ! use cet; then
+ append-flags '-fcf-protection=none'
+ fi
}
use_multiarch() {