- Arch-dev-public - lists.archlinux.org

[arch-dev-public] Adding hardening compiler/linker flags
by Allan McRae 05 May '11

05 May '11

There have been requests for some hardening of our default CFLAGS/LDFLAGS (e.g. FS#18864). I believe this was discussed on this list previously and there were no real objections. So actually doing this has been on the table for some time but has been delayed by a combination of lack of time on my behalf and inconvenient timing with toolchain updates. I think now would be a good time to look at doing this. The plan is to add "-fstack-protector-all -D_FORTIFY_SOURCE=2 --param=ssp-buffer-size=4" to our C{XX}FLAGS and "-Wl,-z,relro" to our LDFLAGS. We could also add "-Wl,-O1" and maybe "-Wl,--sort-common" to our LDFLAGS at the same time for some optimisation. I am taking the approach of adding C/CXX/LDFLAGS rather than the patching the default compiler options approach most other distros use as it is more consistent with our patching policy and will reduce my maintenance burden. It also make it easier to disable an option if necessary by just changing their values. The disadvantage being that we have to make sure software listens to our CFLAGS values... What I do not intend to add: -Wl,-z,now - has a performance hit (mainly for large programs?). -fPIE -pie - large performance hit (5-10%) on i686, almost none on x86_64 These should be enabled for individual programs as the maintainer sees fit. PIE stuff is also more difficult and would probably require patching of the gcc specs file to start dealing with properly and would still lead to a bunch of issues. So that is something that I may look at in the distant future for x86_64 only. So the plan is.... 1) Finalise the CFLAGS/LDFLAGS 2) I get the toolchain built and working with these 3) I upload a pacman package with the changed makepkg.conf 4) Consider a [core] rebuild ??? Starting with #1. Are there any comments on the proposed CFLAGS/LDFLAGS or any further additions that people think might be of use at the same time. Allan

4 5

[arch-dev-public] [signoff] lzo2-2.05-1
by Tobias Powalowski 05 May '11

05 May '11

Changes in 2.05 (23 Apr 2011) * Converted the configure system to non-recursive Automake. * Applied some overdue speed optimizations for modern x86/x64 architectures and current compilers like gcc 4.6 and MSVC 2010. Please signoff both arches, greetings tpowa -- Tobias Powalowski Archlinux Developer & Package Maintainer (tpowa) http://www.archlinux.org tpowa(a)archlinux.org

2 1

[arch-dev-public] [signoff] iproute2 2.6.38-1
by Ronald van Haren 05 May '11

05 May '11

Please signoff for both architectures. Ronald Upstream changelog: Gerrit Renker (3): utils: get_jiffies always uses base=0 iproute: fix unit conversion of rtt/rttvar/rto_min iproute: rename 'get_jiffies' since it uses msecs Joy Latten (3): xfrm security context support xfrm security context support xfrm security context support Nicolas Dichtel (1): iproute2: allow to specify truncation bits on auth algo Sridhar Samudrala (1): macvlan/macvtap: support 'passthru' mode Stephen Hemminger (2): Update to lasest kernel headers v2.6.38.1 Vlad Dogaru (1): iproute2: fix man page whitespace

2 2

[arch-dev-public] Cleaning out [testing]
by Allan McRae 04 May '11

04 May '11

Now seems a good time to take a quick look at the packages in [testing] and see what we can clear out. It looks like we have libgl, haskell and texlive rebuilds sitting there at the moment as well as the usual packages awaiting signoffs. There are also a few packages that I am not too sure why they are in [testing] at the moment. If people could look at the "unknown" section below and move anything that does not really need to be in [testing] any longer. I have a suspicion some of those have been missed with other big package moves. Also, is there anything stopping the haskell and texlive builds moving to [extra]? [core] packages for signoff: ca-certificates, ca-certificates-java, run-parts cronie dcron libcap lzo2 make openssh pciutils rp-pppoe sudo syslinux usbutils vi unknown: archboot aufs2 blender bluez opencv php-apc python2-cairo python2-distribute python-distribute python-gdata libgl: ati-dri intel-dri libegl libgl libgles mach64-dri mesa mga-dri nouveau-dri r128-dri savage-dri sis-dri tdfx-dri unichrome-dri haskell: ghc haddock haskell-cgi haskell-deepseq haskell-fgl haskell-ghc-paths haskell-glut haskell-haskell-src haskell-html haskell-http haskell-hunit haskell-mtl haskell-network haskell-opengl haskell-parallel haskell-parsec haskell-platform haskell-quickcheck haskell-regex-base haskell-regex-compat haskell-regex-posix haskell-stm haskell-syb haskell-text haskell-transformers haskell-xhtml haskell-zlib texlive: texlive-bibtexextra texlive-bin texlive-core texlive-fontsextra texlive-formatsextra texlive-genericextra texlive-htmlxml texlive-humanities texlive-langcjk texlive-langcyrillic texlive-langextra texlive-langgreek texlive-latexextra texlive-music texlive-pictures texlive-plainextra texlive-pstricks texlive-publishers texlive-science

9 10

[arch-dev-public] [signoff] ca-certificates 20110421-1 and friends
by Pierre Schmitz 04 May '11

04 May '11

Hi all, there are new packages for ca-certificates, run-parts and ca-certificates-java in testing. The certificates were updated to be in sync with mozilla. The ca-certificates-java package has been rewritten to fix some file encoding bugs and speed up the keystore creation a lot. The update process is a little bumpy though as there is a nice circular dependency between ca-certificates, ca-certificates-java and openjdk6. The ca-certificates update will trigger a java keystore rebuild that will be slow and throw a bunch of errors. These can be ignored because later in the transaction this will be fixed by the then updated ca-certificates-java. There is no user interaction needed though and new installs should be fine. So, please sign off. :-) Greetings, Pierre -- Pierre Schmitz, https://users.archlinux.de/~pierre

5 5

[arch-dev-public] [signoff] syslinux 4.04-1
by Ionut Biru 04 May '11

04 May '11

Hi, please signoff Changes in 4.04 PXELINUX: Fix handling of unqualified DNS names. PXELINUX: Fix timer bug when PXELINUX might be unloaded (Gene Cumm). core/writedec.inc: Fix duplicate declaration and overflow (Gene Cumm). GCC 4.5 fixes. sample directory: Fix Makefile include (Gene Cumm). ver.com: New universal DOS/COMBOOT application to display version information (includes DRMK) (Gene Cumm). rosh.c32: updated; Using getopt() for internal commands to aid parsing options; Fix bugs in ls; add warm reboot and echo (Gene Cumm). com32: fix a file descriptor leak. gfxboot.c32: handle TEXT..ENDTEXT; error out on no LABELs found (Sebastian Herbszt). Fix booting on non-partitioned devices. MBR, isohybrid: Workaround for a BIOS issue on Acer Travelmate and possibly other machines. COM32: Adding ACPI parsing libary HDT: Release 0.4.1 to support ACPI parsing, improved mutli-core/cpu reporting LUA: Updating to 5.1.4-2 SYSLINUX: core/diskstart.inc: Reset DS after checksum in case it isn't 0 (Gene Cumm). win64: Script update for additional mingw compiler names (Gene Cumm). diag: New directory for diagnostic-related tools. Add a handoff MBR/VBR and geometry display images (Gene Cumm). MEMDISK: use "mem=" parameter to mark available memory above this point as reserved (core already does alignment) (Gene Cumm). MEMDISK: Additional disk probe checks and debug output (Shao Miller, Gene Cumm). gpxe: add gpxelinuxk.0, based off of undionly.kpxe + new script (Gene Cumm). isohybrid: install the isohdpfx*.bin/isohdppx*.bin files to make isohybrid images in one step with GNU xorriso. PXELINUX: disable a hack that would make localboot work on some machines, but break just about as many. Some machines which worked with "localboot 0" in previous versions may need "localboot -1" in this one. If you have a machine which requires "localboot -1", a copy of the dmidecode or sysdump output would be appreciated. Include a set of diagnostics by Gene Cumm. Fixes for gcc 4.6 and binutils 2.21.51. chain.c32: Allow "uuid" as a synonym to "guid". Handle directory names starting with .. for vfat and iso9660. New MENU HIDDENKEY command to provide a one-keystroke way to activate a boot option from a hidden menu intro screen. -- Ionuț

4 3

[arch-dev-public] [signoff] sudo-1.8.1.p1-1
by Allan McRae 04 May '11

04 May '11

Upstream bug fix release. Not much of interest: Major changes between sudo 1.8.1p1 and 1.8.1: * Fixed a problem on AIX where sudo was unable to set the final uid if the PAM module modified the effective uid. * A non-existent includedir is now treated the same as an empty directory and not reported as an error. * Removed extraneous parens in LDAP filter when sudoers_search_filter is enabled that can cause an LDAP search error. * Fixed a "make -j" problem for "make install". Signoff both, Allan

3 4

[arch-dev-public] [signoff] udev 167-2
by Andrea Scarpino 04 May '11

04 May '11

I removed the hid2hci utility from the udev package because this has been removed in udev 169[1] and I already bumped our bluez version in [extra] which provides it. Please signoff both ASAP. Thanks. [1] http://git.kernel.org/?p=linux/hotplug/udev.git;a=blobdiff;f=NEWS;h=184ab5e… -- Andrea

4 4

[arch-dev-public] [signoff] openssh-5.8p2-1
by Gaetan Bisson 04 May '11

04 May '11

Dear all, An upstream update to openssh is in [testing]; from the Changelog: * Fix local private host key compromise on platforms without host- level randomness support (e.g. /dev/random) reported by Tomas Mraz On hosts that did not have a randomness source configured in OpenSSL and were not configured to use EGD/PRNGd (using the --with-prngd-socket configure option), the ssh-rand-helper command was being implicitly executed by ssh-keysign with open file descriptors to the host private keys. An attacker could use ptrace(2) to attach to ssh-rand-helper and exfiltrate the keys. Most modern operating systems are not vulnerable. In particular, *BSD, Linux, OS X and Cygwin do not use ssh-rand-helper. A full advisory for this issue is available at: http://www.openssh.com/txt/portable-keysign-rand-helper.adv There are other minor changes but they don't concern Arch. Please test and signoff. -- Gaetan

5 4

[arch-dev-public] [signoff] pciutils 3.1.7-4
by Jan de Groot 04 May '11

04 May '11

Please signoff for both architectures. This update cleans up the PKGBUILD in a way that uses all possibilities that are present in the Makefile: - PREFIX="$pkgdir/usr" is replaced by using DESTDIR - install-lib target is used instead of copying files around This release contains both shared and static libraries. As I don't have any overview of what still needs this static library (default is to ship only static), I decided to keep it in for a while. As we're using the install-lib target, a .pc file is also shipped now.

4 3