diff options
Diffstat (limited to 'profiles/features')
53 files changed, 553 insertions, 0 deletions
diff --git a/profiles/features/eapi b/profiles/features/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/hardened/amd64/eapi b/profiles/features/hardened/amd64/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/hardened/amd64/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/hardened/amd64/make.defaults b/profiles/features/hardened/amd64/make.defaults new file mode 100644 index 000000000000..10d89c63ebf8 --- /dev/null +++ b/profiles/features/hardened/amd64/make.defaults @@ -0,0 +1,5 @@ +# Copyright 1999-2012 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 + +USE="justify -pic" + diff --git a/profiles/features/hardened/amd64/no-multilib/eapi b/profiles/features/hardened/amd64/no-multilib/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/hardened/amd64/no-multilib/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/hardened/amd64/no-multilib/make.defaults b/profiles/features/hardened/amd64/no-multilib/make.defaults new file mode 100644 index 000000000000..1dd0a2a0f7e0 --- /dev/null +++ b/profiles/features/hardened/amd64/no-multilib/make.defaults @@ -0,0 +1,6 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# We don't need to have pic on +USE="-pic" + diff --git a/profiles/features/hardened/amd64/no-multilib/parent b/profiles/features/hardened/amd64/no-multilib/parent new file mode 100644 index 000000000000..f3229c5b9876 --- /dev/null +++ b/profiles/features/hardened/amd64/no-multilib/parent @@ -0,0 +1 @@ +.. diff --git a/profiles/features/hardened/amd64/package.mask b/profiles/features/hardened/amd64/package.mask new file mode 100644 index 000000000000..76612099e7c4 --- /dev/null +++ b/profiles/features/hardened/amd64/package.mask @@ -0,0 +1,11 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Cernlib has address space issues on amd64 and package is no +# longer supported by upstream. Thus masking it and its reverse +# dependencies. +# See bug 426764. +sci-physics/cernlib +sci-physics/cernlib-montecarlo +sci-physics/geant:3 +sci-physics/paw diff --git a/profiles/features/hardened/amd64/package.use b/profiles/features/hardened/amd64/package.use new file mode 100644 index 000000000000..0cef7f8d1d92 --- /dev/null +++ b/profiles/features/hardened/amd64/package.use @@ -0,0 +1,12 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Magnus Granberg <zorry@gentoo.org> (14 Jan, 2015) +# We need to have the pic flag on. +# Bugs 490276, 513464, 523736 and 512208. +media-libs/x264 pic +media-video/ffmpeg pic +media-video/libav pic +>=media-libs/mesa-10.1.6 pic +media-libs/libpostproc pic +>=media-libs/xvid-1.3.3 pic diff --git a/profiles/features/hardened/amd64/package.use.force b/profiles/features/hardened/amd64/package.use.force new file mode 100644 index 000000000000..ef833f2d1b51 --- /dev/null +++ b/profiles/features/hardened/amd64/package.use.force @@ -0,0 +1,7 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Magnus Granberg <zorry@gentoo.org> (14 Jan, 2015) +# We need to have the pic flag on. +# Bugs 358929 +app-emulation/open-vm-tools pic diff --git a/profiles/features/hardened/amd64/package.use.mask b/profiles/features/hardened/amd64/package.use.mask new file mode 100644 index 000000000000..50e34f0e46d0 --- /dev/null +++ b/profiles/features/hardened/amd64/package.use.mask @@ -0,0 +1,8 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Cernlib has address space issues on amd64 and package is no +# longer supported by upstream. Thus masking it and its reverse +# dependencies. +# See bugs 426764, 556612. +=sci-physics/geant-4.9.4* geant3 diff --git a/profiles/features/hardened/amd64/parent b/profiles/features/hardened/amd64/parent new file mode 100644 index 000000000000..f3229c5b9876 --- /dev/null +++ b/profiles/features/hardened/amd64/parent @@ -0,0 +1 @@ +.. diff --git a/profiles/features/hardened/eapi b/profiles/features/hardened/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/hardened/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/hardened/make.defaults b/profiles/features/hardened/make.defaults new file mode 100644 index 000000000000..f753f571b723 --- /dev/null +++ b/profiles/features/hardened/make.defaults @@ -0,0 +1,15 @@ +# Copyright 1999-2014 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 + +# Jorge Manuel B. S. Vicetto <jmbsvicetto@gentoo.org> (16 Nov 2011) +# Rename STAGE1_USE to BOOTSTRAP_USE and stack it to the parent value +BOOTSTRAP_USE="${BOOTSTRAP_USE} hardened pax_kernel pic xtpax -jit -orc" + +USE="hardened pax_kernel pic urandom xtpax -fortran -jit -orc" + +# Ian Stakenvicius, 2014-09-03 +# Set a variable just to indicate that the current profile is a hardened one +# This variable can be leveraged in ebuilds for pkg_postinst messages that +# indicate said package is, say, configured in a way that defeats the purpose +# of running hardened. +PROFILE_IS_HARDENED=1 diff --git a/profiles/features/hardened/package.mask b/profiles/features/hardened/package.mask new file mode 100644 index 000000000000..af6a869977fc --- /dev/null +++ b/profiles/features/hardened/package.mask @@ -0,0 +1,15 @@ +# Copyright 1999-2017 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 + +# We need newer then glibc 2.24 +<sys-libs/glibc-2.25 + +# broken on hardened, use sys-apps/elfix to fix gnustack +sys-devel/prelink +# depends on prelink +app-crypt/hmaccalc + +# OpenAFS kernel module is not compatible with hardened kernels +# due to C99 struct init requirement by hardened kernels, +# see bug 540196 comment 9. +net-fs/openafs-kernel diff --git a/profiles/features/hardened/package.use.force b/profiles/features/hardened/package.use.force new file mode 100644 index 000000000000..697af381d682 --- /dev/null +++ b/profiles/features/hardened/package.use.force @@ -0,0 +1,7 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Needed for XATTR_PAX flags +app-arch/tar xattr +sys-apps/coreutils xattr +sys-apps/portage xattr diff --git a/profiles/features/hardened/package.use.mask b/profiles/features/hardened/package.use.mask new file mode 100644 index 000000000000..e3320e1e4d9d --- /dev/null +++ b/profiles/features/hardened/package.use.mask @@ -0,0 +1,11 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +sys-apps/hwloc gl + +sys-devel/gcc -hardened +sys-libs/glibc -hardened + +# net-fs/openafs-kernel module can't be used on hardened, +# see bug 540196. +net-fs/openafs modules diff --git a/profiles/features/hardened/packages b/profiles/features/hardened/packages new file mode 100644 index 000000000000..2524abdd0c4f --- /dev/null +++ b/profiles/features/hardened/packages @@ -0,0 +1,6 @@ +# Copyright 1999-2013 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 + +# This file extends the base packages file for all hardened profiles + +*sys-apps/elfix diff --git a/profiles/features/hardened/use.force b/profiles/features/hardened/use.force new file mode 100644 index 000000000000..35e56536ec64 --- /dev/null +++ b/profiles/features/hardened/use.force @@ -0,0 +1,6 @@ +# Copyright 1999-2015 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Make sure people don't accidentally turn of ssp/pie in important packages. +pie +ssp diff --git a/profiles/features/hardened/use.mask b/profiles/features/hardened/use.mask new file mode 100644 index 000000000000..e3999ad48706 --- /dev/null +++ b/profiles/features/hardened/use.mask @@ -0,0 +1,13 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +-hardened + +# precompiled headers are not compat with ASLR. +pch + +# prelink is masked for hardened +prelink + +# profile are incompatible when linking with pie +profile diff --git a/profiles/features/multilib/eapi b/profiles/features/multilib/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/multilib/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/multilib/make.defaults b/profiles/features/multilib/make.defaults new file mode 100644 index 000000000000..a844d754369e --- /dev/null +++ b/profiles/features/multilib/make.defaults @@ -0,0 +1,16 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Jorge Manuel B. S. Vicetto <jmbsvicetto@gentoo.org> (16 Nov 2011) +# Rename STAGE1_USE to BOOTSTRAP_USE and stack it to the parent value +# This is so we build with multilib from the start +BOOTSTRAP_USE="${BOOTSTRAP_USE} multilib" + +# Default USE=multilib to on. This rarely impact packages as they should be +# using the multilib eclass anyways. #435094 +USE="multilib" + +# FEATURES="multilib-strict" specific settings. +MULTILIB_STRICT_DIRS="/lib32 /lib /usr/lib32 /usr/lib /usr/kde/*/lib32 /usr/kde/*/lib /usr/qt/*/lib32 /usr/qt/*/lib /usr/X11R6/lib32 /usr/X11R6/lib" +MULTILIB_STRICT_DENY="64-bit.*shared object" +MULTILIB_STRICT_EXEMPT="(perl5|gcc|gcc-lib|binutils|eclipse-3|debug|portage|udev|systemd|clang|python-exec|llvm)" diff --git a/profiles/features/multilib/package.use b/profiles/features/multilib/package.use new file mode 100644 index 000000000000..b171f871ab08 --- /dev/null +++ b/profiles/features/multilib/package.use @@ -0,0 +1,6 @@ +# Copyright 1999-2016 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License, v2 + +# Enable all ABIs by default so we can protect any non-native binaries that +# might be executed. +sys-apps/sandbox abi_x86_32 abi_x86_64 abi_x86_x32 abi_mips_o32 abi_mips_n32 abi_mips_n64 abi_ppc_32 abi_ppc_64 abi_s390_32 abi_s390_64 diff --git a/profiles/features/multilib/package.use.force b/profiles/features/multilib/package.use.force new file mode 100644 index 000000000000..90f2389e51bd --- /dev/null +++ b/profiles/features/multilib/package.use.force @@ -0,0 +1,7 @@ +# Copyright 2004-2014 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License, v2 + +# These packages must have multilib turned on in order to work sanely. +sys-apps/sandbox multilib +sys-devel/gcc multilib +sys-libs/glibc multilib diff --git a/profiles/features/multilib/use.mask b/profiles/features/multilib/use.mask new file mode 100644 index 000000000000..7471c9f05442 --- /dev/null +++ b/profiles/features/multilib/use.mask @@ -0,0 +1,8 @@ +# Copyright 2004-2008 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License, v2 + +# SECTION: Unmask + +# 2008/02/13 - Chris Gianelloni <wolf31o2@gentoo.org> +# Unmask multilib, since we need to use it. +-multilib diff --git a/profiles/features/prefix/eapi b/profiles/features/prefix/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/prefix/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/prefix/make.defaults b/profiles/features/prefix/make.defaults new file mode 100644 index 000000000000..28ddc1270c94 --- /dev/null +++ b/profiles/features/prefix/make.defaults @@ -0,0 +1,27 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Michael Haubenwallner <haubi@gentoo.org> (19 Apr 2016) +# We can not use xattrs by default in Prefix. +USE="-xattr" + +# Jeremy Olexa <darkside@gentoo.org> (30 Jun 2009) +# As of now, there does not exist a reliable working sandbox implementation on +# any Gentoo Prefix platform. Lately, sandbox has caused *many* issues that +# the Gentoo Prefix team has no time to fix and/or troubleshoot. see: bug 271424 +# see: +# https://archives.gentoo.org/gentoo-alt/msg_3c355ca5e70e7975eae293823f1751f2.xml +# see: bug 274239 +# and other issues, etc etc. +# +# If in the future, there does exist a working sandbox implementation then it +# should be enabled on a per-profile basis only. +FEATURES="${FEATURES} -sandbox -usersandbox" + +# Prefix does not have user management and the security model does not apply. +# Disable user* features by default. +FEATURES="${FEATURES} -userpriv -userfetch -usersync" + +# this probably already is like this, but we assure that in prefix we +# have a GNU userland +USERLAND="GNU" diff --git a/profiles/features/prefix/package.mask b/profiles/features/prefix/package.mask new file mode 100644 index 000000000000..dfa6e719cf82 --- /dev/null +++ b/profiles/features/prefix/package.mask @@ -0,0 +1,22 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Jeremy Olexa <darkside@gentoo.org> (30 Jun 2009) +# The PAM auth system just will not work in Gentoo Prefix, instead the host auth +# system should be used. +sys-libs/pam +sys-auth/pambase + +# Jeremy Olexa <darkside@gentoo.org> (02 Jun 2009) +# If you have MacFuse or some other implementation of fuse installed, you can +# probably use this by placing sys-fs/fuse in package.provided, bug 272210 +net-fs/curlftpfs + +# Jeremy Olexa <darkside@gentoo.org> (02 Dec 2008) +# Reported to work. However, you will need to package.provide some deps. +# See bug 248809 for more details. +net-fs/openafs + +# Fabian Groffen <grobian@gentoo.org> (11 Jan 2008) +# Screws up things, see bug #204998 +<sys-devel/gcc-3.4.0 diff --git a/profiles/features/prefix/package.use.mask b/profiles/features/prefix/package.use.mask new file mode 100644 index 000000000000..f02bc5775fe9 --- /dev/null +++ b/profiles/features/prefix/package.use.mask @@ -0,0 +1,46 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Benda Xu <heroxbd@gentoo.org> (28 Jul 2016) +# Needs root privilege. +sys-fs/eudev hwdb kmod + +# Kacper Kowalik <xarthisius@gentoo.org> (14 Jan 2012) +# sci-libs/mkl don't have prefix keywords +dev-python/numexpr mkl + +# Fabian Groffen <grobian@gentoo.org> (08 Dec 2011) +# USE=vanilla produces a broken compiler for Prefix. Only use this flag +# when you're absolutely sure what you're doing. Do NOT report bugs +# about failing packages when using a vanilla compiler! +sys-devel/gcc vanilla + +# Rafael Goncalves Martins <rafaelmartins@gentoo.org> (29 Sep 2010) +# dev-libs/judy without prefix keywords +# (amd64-linux and x86-linux) +sci-electronics/gtkwave judy + +# Jonathan Callen <abcd@gentoo.org> (22 Feb 2010) +# ppp is not available in Prefix +kde-apps/kdenetwork-meta ppp + +# Christian Faulhammer <fauli@gentoo.org> (09 Jan 2010) +# hesiod and m17n-lib are not available in Prefix +app-editors/emacs-vcs hesiod m17n-lib +app-editors/emacs hesiod m17n-lib + +# Jeremy Olexa <darkside@gentoo.org> (30 Sep 2009) +# berkdb has hardcoded paths all over, breaks on linux at least. Use flag +# disappearing in next bump: prefix can be early and force it to be not used to +# save headaches. +# NOTE to prefix devs: if it needs to not be a global mask, talk to me because +# it currently causes failures on linux. It can be made a "less global" mask. +dev-lang/python berkdb + +# Elias Pipping <pipping@gentoo.org> (18 Nov 2007) +# feynmf fails to build documentation +dev-tex/feynmf doc + +# Elias Pipping <pipping@gentoo.org> (15 Nov 2007) +# pkg_postinst tries to create/delete a user, fails +dev-libs/cyrus-sasl berkdb gdbm diff --git a/profiles/features/prefix/packages b/profiles/features/prefix/packages new file mode 100644 index 000000000000..a4d727977333 --- /dev/null +++ b/profiles/features/prefix/packages @@ -0,0 +1,26 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Gentoo Base Prefix Profile + +# NOTE: THIS MODIFIES THE BASE PROFILE FOR *ANY* PREFIX BASED OPERATING SYSTEM. +# NO MODIFICATIONS MAY BE MADE TO THIS FILE WITHOUT PRIOR DISCUSSION. IF +# YOU ARE CREATING A NEW PROFILE, YOU SIMPLY NEED TO INHERIT THIS BASE +# PROFILE IN YOUR PROFILE DIRECTORY'S "parent" FILE. + +# Read the descriptions of ../../base/packages for some explanation + +# This file removes everything from the base profile which is not +# necessary/desired in a prefix environment. + +-*net-misc/iputils +-*sys-apps/iproute2 +-*sys-apps/kbd +-*sys-fs/e2fsprogs +-*virtual/dev-manager +-*virtual/modutils +-*virtual/shadow + +# we don't want this either (as baselayout-prefix provides the functions.sh +# file that this was added to ../base/packages for) +-*sys-apps/openrc diff --git a/profiles/features/prefix/rpath/eapi b/profiles/features/prefix/rpath/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/prefix/rpath/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/prefix/rpath/packages b/profiles/features/prefix/rpath/packages new file mode 100644 index 000000000000..ca559fb1847a --- /dev/null +++ b/profiles/features/prefix/rpath/packages @@ -0,0 +1,11 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# we don't ever will install these, so no need to depend on them +-*virtual/libc +-*virtual/os-headers + +-*>=sys-apps/baselayout-2 +# add back prefix baselayout +*sys-apps/baselayout-prefix + diff --git a/profiles/features/prefix/rpath/parent b/profiles/features/prefix/rpath/parent new file mode 100644 index 000000000000..f3229c5b9876 --- /dev/null +++ b/profiles/features/prefix/rpath/parent @@ -0,0 +1 @@ +.. diff --git a/profiles/features/prefix/rpath/profile.bashrc b/profiles/features/prefix/rpath/profile.bashrc new file mode 100644 index 000000000000..1964faf33266 --- /dev/null +++ b/profiles/features/prefix/rpath/profile.bashrc @@ -0,0 +1,22 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Hack to avoid every package that uses libiconv/gettext +# install a charset.alias that will collide with libiconv's one +# See bugs 169678, 195148 and 256129. +# Also the discussion on +# https://archives.gentoo.org/gentoo-dev/msg_8cb1805411f37b4eb168a3e680e531f3.xml +prefix-post_src_install() { + local f + if [[ ${PN} != "libiconv" && -n $(ls "${ED}"/usr/lib*/charset.alias 2>/dev/null) ]]; then + einfo "automatically removing charset.alias" + rm -f "${ED}"/usr/lib*/charset.alias + fi +} + +# These are because of +# https://archives.gentoo.org/gentoo-dev/msg_529a0806ed2cf841a467940a57e2d588.xml +# The profile-* ones are meant to be used in etc/portage/profile.bashrc by user +# until there is the registration mechanism. +profile-post_src_install() { prefix-post_src_install ; } + post_src_install() { prefix-post_src_install ; } diff --git a/profiles/features/prefix/rpath/use.force b/profiles/features/prefix/rpath/use.force new file mode 100644 index 000000000000..ee3ee2379455 --- /dev/null +++ b/profiles/features/prefix/rpath/use.force @@ -0,0 +1,6 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# prefix-guest USE flag should be set in prefix rpath profiles +prefix-guest + diff --git a/profiles/features/prefix/rpath/use.mask b/profiles/features/prefix/rpath/use.mask new file mode 100644 index 000000000000..294cb12c1d19 --- /dev/null +++ b/profiles/features/prefix/rpath/use.mask @@ -0,0 +1,9 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# prefix-guest USE flag should be set in prefix rpath profiles +-prefix-guest + +# multilib is never going to work as expected in Prefix rpath +multilib + diff --git a/profiles/features/prefix/standalone/eapi b/profiles/features/prefix/standalone/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/prefix/standalone/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/prefix/standalone/legacy/make.defaults b/profiles/features/prefix/standalone/legacy/make.defaults new file mode 100644 index 000000000000..254b730a79c4 --- /dev/null +++ b/profiles/features/prefix/standalone/legacy/make.defaults @@ -0,0 +1,17 @@ +# This profile is supporting >=linux-2.6.16[a] and <linux-2.6.32[b]. + +# a. https://sourceware.org/ml/libc-announce/2012/msg00001.html +# lowest version supported by glibc-2.17 to glibc-2.19. + +# b. https://sourceware.org/ml/libc-alpha/2014-09/msg00088.html +# lowest version supported by glibc-2.20 onwards. + + +# utimensat is missing or not reliable until linux-2.6.32. +# needed by python-3. +ac_cv_func_utimensat=no +# pipe2 requires >=linux-2.6.27. Needed by python-3. +ac_cv_func_pipe2=no + +# >=python-3 is masked. +PYTHON_TARGETS="-python3_4" diff --git a/profiles/features/prefix/standalone/legacy/package.mask b/profiles/features/prefix/standalone/legacy/package.mask new file mode 100644 index 000000000000..5125269d289d --- /dev/null +++ b/profiles/features/prefix/standalone/legacy/package.mask @@ -0,0 +1,7 @@ +# >=glibc-2.20 requires >=linux-2.6.32. +>=sys-libs/glibc-2.20 + +# >=python-3.4 assumes F_DUPFD_CLOEXEC of fcntl, +# which requires >=linux-2.6.24. +# python-3.3 seems to be unconditionally using utimensat. +>=dev-lang/python-3
\ No newline at end of file diff --git a/profiles/features/prefix/standalone/legacy/package.unmask b/profiles/features/prefix/standalone/legacy/package.unmask new file mode 100644 index 000000000000..0d7380b42738 --- /dev/null +++ b/profiles/features/prefix/standalone/legacy/package.unmask @@ -0,0 +1,2 @@ +# >=glibc-2.20 requires >=linux-2.6.32. +<sys-libs/glibc-2.20 diff --git a/profiles/features/prefix/standalone/legacy/profile.bashrc b/profiles/features/prefix/standalone/legacy/profile.bashrc new file mode 100644 index 000000000000..e537cc0fa319 --- /dev/null +++ b/profiles/features/prefix/standalone/legacy/profile.bashrc @@ -0,0 +1,6 @@ +# tricks to circumvent false positive checks of old kernel + +if [[ ${CATEGORY}/${PN} == dev-util/cmake && ${EBUILD_PHASE} == configure ]]; then + einfo "Removing utimensat outputs..." + sed -i '/UTIMENSAT=/d' ${S}/Source/kwsys/CMakeLists.txt +fi diff --git a/profiles/features/prefix/standalone/make.defaults b/profiles/features/prefix/standalone/make.defaults new file mode 100644 index 000000000000..0e1661e1014d --- /dev/null +++ b/profiles/features/prefix/standalone/make.defaults @@ -0,0 +1,7 @@ +# getentropy is available from linux-3.17 and glibc-2.25 +# disable it unconditionally for Python-3.4 and 2.7. +# http://bugs.python.org/issue31255 +# remove when python-3.4 goes end-of-life on 2019-03-16, +# and when python-2.7 goes end-of-life on 2020-01-01. +# https://docs.python.org/devguide/#status-of-python-branches +ac_cv_func_getentropy=no diff --git a/profiles/features/prefix/standalone/parent b/profiles/features/prefix/standalone/parent new file mode 100644 index 000000000000..f3229c5b9876 --- /dev/null +++ b/profiles/features/prefix/standalone/parent @@ -0,0 +1 @@ +.. diff --git a/profiles/features/prefix/use.force b/profiles/features/prefix/use.force new file mode 100644 index 000000000000..843b1c7ed890 --- /dev/null +++ b/profiles/features/prefix/use.force @@ -0,0 +1,8 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# force prefix flag to be set +prefix + +# force GNU userland (even though base profile sets this too) +userland_GNU diff --git a/profiles/features/prefix/use.mask b/profiles/features/prefix/use.mask new file mode 100644 index 000000000000..61f29a075894 --- /dev/null +++ b/profiles/features/prefix/use.mask @@ -0,0 +1,23 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# prefix USE flag should always be unmasked in prefix profiles +-prefix + +# re-add userland GNU +-userland_GNU + +# USE flags inherited by the base/use.defaults file that shouldn't be in Prefix +cups +gpm + +# USE=pam just does not make sense in Gentoo Prefix. Should be using the host +# auth system. +pam + +# USE=udev just does not make sense in Gentoo Prefix. bug 293480 +udev + +# suid requires root privilege, which is not support by prefix in general +# one example: bug 447340. +suid diff --git a/profiles/features/selinux/eapi b/profiles/features/selinux/eapi new file mode 100644 index 000000000000..7ed6ff82de6b --- /dev/null +++ b/profiles/features/selinux/eapi @@ -0,0 +1 @@ +5 diff --git a/profiles/features/selinux/make.defaults b/profiles/features/selinux/make.defaults new file mode 100644 index 000000000000..963412a92e4c --- /dev/null +++ b/profiles/features/selinux/make.defaults @@ -0,0 +1,15 @@ +# Copyright 1999-2014 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 +# + +# selinux - Enable SELinux support +# unconfined - Enable unconfined domains, needed due to 'targeted' policy type +# open_perms - Enable open permission in SELinux subsystem +USE="selinux unconfined open_perms" + +FEATURES="selinux sesandbox sfperms" + +POLICY_TYPES="strict targeted" +PORTAGE_T="portage_t" +PORTAGE_FETCH_T="portage_fetch_t" +PORTAGE_SANDBOX_T="portage_sandbox_t" diff --git a/profiles/features/selinux/package.mask b/profiles/features/selinux/package.mask new file mode 100644 index 000000000000..fdbb561d5371 --- /dev/null +++ b/profiles/features/selinux/package.mask @@ -0,0 +1,37 @@ + +# Göktürk Yüksek <gokturk@gentoo.org> (09 Nov 2016) +# On behalf of proxy-maint +# Mask due to the package requiring systemd +# and causing unresolvable dep issues +# See: https://github.com/gentoo/gentoo/pull/2262 +www-misc/profile-sync-daemon + +# Jason Zaman <perfinion@gentoo.org> (27 Jun 2015) +# SystemD has no support in the SELinux policy at the moment. +# Please see: https://wiki.gentoo.org/wiki/SELinux/FAQ#Can_I_use_SELinux_with_SystemD.3F +app-admin/systemdgenie +app-eselect/eselect-gnome-shell-extensions +sys-apps/systemd +app-admin/calamares +dev-python/python-systemd +gnome-base/gdm +gnome-base/gnome +gnome-base/gnome-extra-apps +gnome-base/gnome-light +gnome-base/gnome-shell +gnome-extra/chrome-gnome-shell +gnome-extra/gnome-logs +gnome-extra/gnome-shell-extensions +gnome-extra/gnome-shell-frippery +gnome-extra/gnome-shell-extensions-topicons +gnome-extra/gnome-shell-extensions-topicons-plus +gnome-extra/gnome-tweak-tool +x11-themes/zukitwo-shell +gnome-extra/office-runner +kde-misc/systemd-kcm +net-firewall/firewalld +net-misc/netctl +sys-apps/gentoo-systemd-integration +sys-apps/systemd-readahead +sys-process/systemd-cron +sys-apps/dbus-broker diff --git a/profiles/features/selinux/package.use.force b/profiles/features/selinux/package.use.force new file mode 100644 index 000000000000..c7e70425d6bb --- /dev/null +++ b/profiles/features/selinux/package.use.force @@ -0,0 +1,27 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Sven Vermeulen <swift@gentoo.org> (19 Apr 2013) +# sys-apps/policycoreutils (semanage command) uses sepolgen, which requires libselinux with USE="python". +# sys-apps/policycoreutils also requires libsemanage with USE="python" and +# setools with USE="python" +sys-libs/libselinux python +sys-libs/libsemanage python +app-admin/setools python + +# Sven Vermeulen <swift@gentoo.org> (21 May 2013) +# sys-apps/policycoreutils has PYTHON_USE_WITH="xml" set, so we force it +# here to allow stages to build with USE=xml on python +dev-lang/python xml + +# Jason Zaman <perfinion@gentoo.org> (03 Dec 2014) +# sys-apps/busybox has IUSE="+static", so force static-libs on its deps +# so stages can build with no interacton. Bug #527938 +sys-libs/libselinux static-libs +dev-libs/libpcre static-libs + +# Jason Zaman <perfinion@gentoo.org> (27 Jun 2015) +# SystemD has no support in the SELinux policy at the moment. +# Please see: https://wiki.gentoo.org/wiki/SELinux/FAQ#Can_I_use_SELinux_with_SystemD.3F +gnome-base/gnome-settings-daemon openrc-force +gnome-base/gnome-shell openrc-force diff --git a/profiles/features/selinux/package.use.mask b/profiles/features/selinux/package.use.mask new file mode 100644 index 000000000000..9af31771b185 --- /dev/null +++ b/profiles/features/selinux/package.use.mask @@ -0,0 +1,33 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# Brian Dolbec <dolsen@gentoo.org> (17 Sep 2014) +# mask pypy for several utilities due to incompatibility with libselinux +sys-apps/portage python_targets_pypy python_targets_pypy3 +app-portage/gentoolkit python_targets_pypy python_targets_pypy3 +app-portage/layman python_targets_pypy python_targets_pypy3 +app-admin/webapp-config python_targets_pypy python_targets_pypy3 +app-portage/diffmask python_targets_pypy python_targets_pypy3 +app-portage/flaggie python_targets_pypy python_targets_pypy3 + +# Jason Zaman <perfinion@gentoo.org> (27 Jun 2015) +# SystemD has no support in the SELinux policy at the moment. +# Please see: https://wiki.gentoo.org/wiki/SELinux/FAQ#Can_I_use_SELinux_with_SystemD.3F +app-emulation/libvirt firewalld +gnome-base/gdm wayland +net-firewall/fwknop firewalld +www-servers/uwsgi uwsgi_plugins_systemd_logger +x11-wm/mutter kms +>=x11-wm/mutter-3.22 wayland +x11-misc/xscreensaver gdm +xfce-extra/xfswitch-plugin gdm +app-misc/workrave gnome +net-misc/wicd gnome-shell +x11-misc/gpaste gnome +x11-terms/gnome-terminal gnome-shell +x11-themes/zukitwo gnome-shell +net-wireless/bluez user-session + +# Alex Brandt <alunduil@gentoo.org> (6 Sep 2015) +# app-emulation/rkt[rkt_stage1_src] requires systemd which isn't available with selinux. +app-emulation/rkt rkt_stage1_src diff --git a/profiles/features/selinux/packages b/profiles/features/selinux/packages new file mode 100644 index 000000000000..038ef191f71f --- /dev/null +++ b/profiles/features/selinux/packages @@ -0,0 +1,10 @@ +# Copyright 1999-2012 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 + +# Base SELinux packages +*sys-libs/libsepol +*sys-libs/libselinux +*sys-libs/libsemanage +*sys-apps/checkpolicy +*sys-apps/policycoreutils +*sec-policy/selinux-base-policy diff --git a/profiles/features/selinux/profile.bashrc b/profiles/features/selinux/profile.bashrc new file mode 100644 index 000000000000..d28d6c3dfae3 --- /dev/null +++ b/profiles/features/selinux/profile.bashrc @@ -0,0 +1,5 @@ +# SELinux-aware progams write to entries here +SANDBOX_WRITE="${SANDBOX_WRITE}:/selinux/:/sys/fs/selinux/" + +# for setfscreatecon +SANDBOX_WRITE="${SANDBOX_WRITE}:/proc/self/" diff --git a/profiles/features/selinux/use.force b/profiles/features/selinux/use.force new file mode 100644 index 000000000000..a651b206dcf2 --- /dev/null +++ b/profiles/features/selinux/use.force @@ -0,0 +1 @@ +selinux diff --git a/profiles/features/selinux/use.mask b/profiles/features/selinux/use.mask new file mode 100644 index 000000000000..5d0b3bf1e557 --- /dev/null +++ b/profiles/features/selinux/use.mask @@ -0,0 +1,14 @@ +# Copyright 1999-2017 Gentoo Foundation. +# Distributed under the terms of the GNU General Public License v2 + +# This file masks out USE flags that are simply NOT allowed in the default +# profile for any architecture. This works, for example, if a non-default +# profile (such as the selinux profiles) have a USE flag associated with +# them. + +-hardened +-selinux + +# no policy yet +systemd +-openrc-force |