July 2014 - Arch-projects - lists.archlinux.org

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository annotated tag v18 created. v18
by dreisner＠archlinux.org 25 Jul '14

25 Jul '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The annotated tag, v18 has been created at 7aebab3ab3c38e731c7c310c693501ad35a75fb7 (tag) tagging a35c698c16759c3c05c692fd10f140d186053177 (commit) replaces v17 tagged by Dave Reisner on Fri Jul 25 13:48:18 2014 -0400 - Log ----------------------------------------------------------------- tag as v18 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABAgAGBQJT0phkAAoJEB6yY4/1bAxTPcwH/j9QKg8EjwoRghjTjRiqnII1 H+Kc3Gry3JFKxX+7ly3U5MOGtQfzEAXeoZI+ydcqrHKG7ZEmbRJu/iJQcw63QtQ4 UDuaPDGjh+aPMGyQSnm4xphjOhuUHLu7cNL8Y12seCBq5Ru3/l+KznOhGoITCmWq nT5fcEc99ci5Ka3S6ANBvF481xsPUL3SE/di/1zrDDBMVN7EFNnTUSE9CuyqBZ/f mbjV2SDm8SrSYKdmOOXSXvVdm0h3FTzq6EGwi0+8ooVzp7/Aplxe3QxiUjACVYIa gdvKmeb1nv6p68rw/PBPtLObvI0S+I/gdLvRk9LbUmFilTW0k0bMhskde35hqfE= =gGKY -----END PGP SIGNATURE----- Dave Reisner (5): Add binary library deps directly, without symlink zoo make missing compression binaries a non-fatal warning add quirk for vfat nls module add second param to add_full_dir to allow filtering files block: include all of drivers/storage/usb ----------------------------------------------------------------------- hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [devtools] [PATCH] enforce hardening flags and use PIE on x86_64
by Daniel Micay 23 Jul '14

23 Jul '14

PIE is required for full address space layout optimization (ASLR) and there is little to no benefit from ASLR without it since global ELF tables (GOT/PLT) and application code are at known locations. A wrapper script is required in order to pass the correct flags for executables without changing the flags for libraries. It adds `-pie` when linking (no `-c` switch) if `-static` or `-shared` are not passed, and `-fPIE` whenever `-fPIC` is not already there. This technique comes from the Debian hardening wrappers. Position independent code is expensive on i686, so it's only enabled by default on x86_64 where the cost is negligible. It can be enabled on a package-by-package basis on i686. The same cost already exists for any code in a dynamic library. The hardening-wrapper package also enforces the chosen hardening flags even when build systems aren't using CFLAGS / CXXFLAGS / LDFLAGS from the environment. It would need to be moved from [community] to [core]. --- archbuild.in | 5 +++-- makechrootpkg.in | 12 +++++++++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/archbuild.in b/archbuild.in index ae2f511..419ae5b 100644 --- a/archbuild.in +++ b/archbuild.in @@ -2,7 +2,7 @@ m4_include(lib/common.sh) -base_packages=(base-devel) +base_packages=(base-devel hardening-wrapper) makechrootpkg_args=(-c -n) cmd="${0##*/}" @@ -67,11 +67,12 @@ if ${clean_first} || [[ ! -d "${chroots}/${repo}-${arch}" ]]; then "${base_packages[@]}" || abort else lock 9 "${chroots}/${repo}-${arch}/root.lock" "Locking clean chroot" + # upgrade and install any new packages from base_packages arch-nspawn \ -C "@pkgdatadir@/pacman-${repo}.conf" \ -M "@pkgdatadir@/makepkg-${arch}.conf" \ "${chroots}/${repo}-${arch}/root" \ - pacman -Syu --noconfirm || abort + pacman -Syu --noconfirm --needed "${base_packages[@]}" || abort fi msg "Building in chroot for [${repo}] (${arch})..." diff --git a/makechrootpkg.in b/makechrootpkg.in index 97c7780..ad804fc 100644 --- a/makechrootpkg.in +++ b/makechrootpkg.in @@ -320,7 +320,17 @@ _chrootbuild() { exit 1 fi - sudo -u nobody makepkg $makepkg_args || exit 1 + # enforced compiler hardening flags (can be overriden in a PKGBUILD) + export HARDENING_BINDNOW=0 HARDENING_FORTIFY=2 HARDENING_RELRO=1 + export HARDENING_STACK_CHECK=0 HARDENING_STACK_PROTECTOR=2 + . /etc/makepkg.conf + if [[ $CARCH = i686 ]]; then + export HARDENING_PIE=0 + else + export HARDENING_PIE=1 + fi + + sudo -E -u nobody makepkg $makepkg_args || exit 1 if $run_namcap; then pacman -S --needed --noconfirm namcap -- 2.0.2

2 3

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. v17-5-ga35c698
by dreisner＠archlinux.org 23 Jul '14

23 Jul '14

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via a35c698c16759c3c05c692fd10f140d186053177 (commit) from 02d387b2370215d51d1aa8958fce42cd099bee29 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a35c698c16759c3c05c692fd10f140d186053177 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Wed Jul 23 18:45:17 2014 -0400 block: include all of drivers/storage/usb Fixes FS#41273. ----------------------------------------------------------------------- Summary of changes: install/block | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [netctl][PATCH] Disable IPv6 on IP6=no
by Jouke Witteveen 05 Jul '14

05 Jul '14

--- It was proposed to disable IPv6 entirely in case of "IP6=no". Currently we only disable processing of router advertisements. This looks OK to me, but I would really like to get some feedback on this one, as I cannot extensively test the consequences. src/lib/ip | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/lib/ip b/src/lib/ip index 66aab56..9600504 100644 --- a/src/lib/ip +++ b/src/lib/ip @@ -47,11 +47,12 @@ ip_set() { case "$IP6" in dhcp*|stateless|static) [[ -d "/proc/sys/net/ipv6" ]] || modprobe ipv6 + sysctl -q -w "net.ipv6.conf.$interface_sysctl.disable_ipv6=0" [[ $IP6 == "static" ]] sysctl -q -w "net.ipv6.conf.$interface_sysctl.accept_ra=$?" ;; no) - [[ -d "/proc/sys/net/ipv6" ]] && sysctl -q -w "net.ipv6.conf.$interface_sysctl.accept_ra=0" + [[ -d "/proc/sys/net/ipv6" ]] && sysctl -q -w "net.ipv6.conf.$interface_sysctl.disable_ipv6=0" ;; "") # undefined IP6 does not prevent RA's from being received -> nop ;; -- 2.0.1

1 1