From bb189b08be8e84e1f7cccb1b47371b5ca5acb94c Mon Sep 17 00:00:00 2001 From: Bruce Dubbs Date: Fri, 24 Apr 2015 03:19:38 +0000 Subject: Added a fix for security issue in Glibc (CVE-2015-1781). Thanks to Ken Moffat for identifying the proplem and the fix. Fixed Ncurses and Perl build with GCC 5. Thanks to Ken Moffat and Douglas R. Reno for providing the patches. Updated to GCC-5.1.0. Imported changes from systemd version. git-svn-id: http://svn.linuxfromscratch.org/LFS/trunk/BOOK@10903 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689 --- chapter01/changelog.xml | 20 ++++++++++++++++++++ chapter01/whatsnew.xml | 12 ++++++++++-- chapter03/patches.xml | 18 +++++++++++++----- chapter05/glibc.xml | 13 ++++++++++++- chapter05/libstdc++.xml | 3 +-- chapter05/ncurses.xml | 5 +++++ chapter06/glibc.xml | 24 ++++++++++-------------- chapter06/ncurses.xml | 5 +++++ chapter06/perl.xml | 9 +++++---- general.ent | 6 +++--- packages.ent | 24 ++++++++++++------------ patches.ent | 12 +++++++----- 12 files changed, 103 insertions(+), 48 deletions(-) diff --git a/chapter01/changelog.xml b/chapter01/changelog.xml index 54f1e5d60..357f16f01 100644 --- a/chapter01/changelog.xml +++ b/chapter01/changelog.xml @@ -36,6 +36,26 @@ --> + + 2015-04-24 + + + [krejzi] - Added a fix for security issue + in Glibc (CVE-2015-1781). Thanks to Ken Moffat + for identifying the proplem and the fix. + + + [krejzi] - Fixed Ncurses and Perl build + with GCC 5. Thanks to Ken Moffat and Douglas + R. Reno for providing the patches. + + + [krejzi] - Updated to GCC-5.1.0. Fixes + #3779. + + + + 2015-04-21 diff --git a/chapter01/whatsnew.xml b/chapter01/whatsnew.xml index 6ad7c639b..a5770c97a 100644 --- a/chapter01/whatsnew.xml +++ b/chapter01/whatsnew.xml @@ -85,9 +85,9 @@ - + @@ -248,6 +248,14 @@ Tcl-core-&tcl-version; + + &ncurses-gcc5-buildfixes-patch; + + + + &perl-gcc5-fixes-patch; + + diff --git a/chapter03/patches.xml b/chapter03/patches.xml index 6cc70cfcb..d55746f46 100644 --- a/chapter03/patches.xml +++ b/chapter03/patches.xml @@ -123,15 +123,23 @@ MD5 sum: &mpfr-fixes-patch-md5; - + + + Perl GCC 5 Fixes Patch - &perl-gcc5-fixes-patch-size;: + + Download: + MD5 sum: &perl-gcc5-fixes-patch-md5; + + + Readline Upstream Fixes Patch - &readline-fixes-patch-size;: diff --git a/chapter05/glibc.xml b/chapter05/glibc.xml index 974a7292f..9916b4fb2 100644 --- a/chapter05/glibc.xml +++ b/chapter05/glibc.xml @@ -43,6 +43,7 @@ Installation of Glibc + Fix a regression in the package that affects 32-bit architectures: sed -e '/ia32/s/^/1:/' \ @@ -87,6 +88,7 @@ esac --build=$(../glibc-&glibc-version;/scripts/config.guess) \ --disable-profile \ --enable-kernel=&min-kernel; \ + --enable-obsolete-rpc \ --with-headers=/tools/include \ libc_cv_forced_unwind=yes \ libc_cv_ctors_header=yes \ @@ -121,6 +123,15 @@ esac + + --enable-obsolete-rpc + + This installs NIS and RPC related headers that are not + installed by default. They are required to build GCC and by + several BLFS packages. + + + --with-headers=/tools/include diff --git a/chapter05/libstdc++.xml b/chapter05/libstdc++.xml index 9af130f4b..29d7f2739 100644 --- a/chapter05/libstdc++.xml +++ b/chapter05/libstdc++.xml @@ -50,7 +50,7 @@ Create a directory for Libstdc++ and enter it: -mkdir -pv ../gcc-build +mkdir -v ../gcc-build cd ../gcc-build Prepare Libstdc++ for compilation: @@ -59,7 +59,6 @@ cd ../gcc-build --host=$LFS_TGT \ --prefix=/tools \ --disable-multilib \ - --disable-shared \ --disable-nls \ --disable-libstdcxx-threads \ --disable-libstdcxx-pch \ diff --git a/chapter05/ncurses.xml b/chapter05/ncurses.xml index a18a9c819..336172b59 100644 --- a/chapter05/ncurses.xml +++ b/chapter05/ncurses.xml @@ -43,6 +43,11 @@ Installation of Ncurses + First, apply a patch to prevent a build failure + when building with GCC 5: + +patch -Np1 -i ../&ncurses-gcc5-buildfixes-patch; + Prepare Ncurses for compilation: ./configure --prefix=/tools \ diff --git a/chapter06/glibc.xml b/chapter06/glibc.xml index c9cfa5aaf..9c53628f9 100644 --- a/chapter06/glibc.xml +++ b/chapter06/glibc.xml @@ -74,6 +74,16 @@ -e '/SSE2/s/^1://' \ -i sysdeps/i386/i686/multiarch/mempcpy_chk.S + Fix a potential security issue identified upstream: + +sed -i '/glibc.*pad/{i\ buflen = buflen > pad ? buflen - pad : 0; + s/ + pad//}' resolv/nss_dns/dns-host.c + + Fix a test case that fails when built using GCC 5: + +sed -e '/tst-audit2-ENV/i CFLAGS-tst-audit2.c += -fno-builtin' \ + -i elf/Makefile + The Glibc documentation recommends building Glibc outside of the source directory in a dedicated build directory: @@ -88,20 +98,6 @@ cd ../glibc-build --enable-kernel=&min-kernel; \ --enable-obsolete-rpc - - The meaning of the new configure options: - - - --enable-obsolete-rpc - - Installs NIS and RPC related headers that are not installed by - default; these are required to rebuild Glibc and by several BLFS - packages. - - - - - Compile the package: make diff --git a/chapter06/ncurses.xml b/chapter06/ncurses.xml index 70aca29fe..c82bfa5e0 100644 --- a/chapter06/ncurses.xml +++ b/chapter06/ncurses.xml @@ -41,6 +41,11 @@ Installation of Ncurses + First, apply a patch to prevent a build failure + when building with GCC 5: + +patch -Np1 -i ../&ncurses-gcc5-buildfixes-patch; + Don't install a static library that is not handled by configure: sed -i '/LIBTOOL_INSTALL/d' c++/Makefile.in diff --git a/chapter06/perl.xml b/chapter06/perl.xml index 35de645ba..6ace9d861 100644 --- a/chapter06/perl.xml +++ b/chapter06/perl.xml @@ -55,11 +55,12 @@ export BUILD_ZLIB=False export BUILD_BZIP2=0 - + Apply a patch to allow the Errno.pm module and the h2ph + program to build correctly when building with GCC 5: + +patch -Np1 -i ../&perl-gcc5-fixes-patch; + To have full control over the way Perl is set up, you can remove the -des options from the following command and hand-pick the way this package is built. Alternatively, use the command exactly as below to diff --git a/general.ent b/general.ent index 89a397b01..974638b94 100644 --- a/general.ent +++ b/general.ent @@ -1,14 +1,14 @@ - + - + - + diff --git a/packages.ent b/packages.ent index 4837299ce..875d256e2 100644 --- a/packages.ent +++ b/packages.ent @@ -196,20 +196,20 @@ - - + + - + - - - - - - - - - + + + + + + + + + diff --git a/patches.ent b/patches.ent index 3b81bc0d6..405ebc879 100644 --- a/patches.ent +++ b/patches.ent @@ -30,11 +30,13 @@ - + + + + + + + -- cgit v1.2.3-54-g00ecf