1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
|
require glibc.inc
require glibc-version.inc
CVE_CHECK_WHITELIST += "CVE-2020-10029 CVE-2021-27645"
# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010022
# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010023
# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010024
# Upstream glibc maintainers dispute there is any issue and have no plans to address it further.
# "this is being treated as a non-security bug and no real threat."
CVE_CHECK_WHITELIST += "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024"
# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010025
# Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow
# easier access for another. "ASLR bypass itself is not a vulnerability."
# Potential patch at https://sourceware.org/bugzilla/show_bug.cgi?id=22853
CVE_CHECK_WHITELIST += "CVE-2019-1010025"
DEPENDS += "gperf-native bison-native make-native"
NATIVESDKFIXES ?= ""
NATIVESDKFIXES:class-nativesdk = "\
file://0003-nativesdk-glibc-Look-for-host-system-ld.so.cache-as-.patch \
file://0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-.patch \
file://0005-nativesdk-glibc-Raise-the-size-of-arrays-containing-.patch \
file://0006-nativesdk-glibc-Allow-64-bit-atomics-for-x86.patch \
file://0007-nativesdk-glibc-Make-relocatable-install-for-locales.patch \
file://0008-nativesdk-glibc-Fall-back-to-faccessat-on-faccess2-r.patch \
"
SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://etc/ld.so.conf \
file://generate-supported.mk \
file://makedbs.sh \
\
${NATIVESDKFIXES} \
file://0015-sysdeps-gnu-configure.ac-handle-correctly-libc_cv_ro.patch \
file://0016-yes-within-the-path-sets-wrong-config-variables.patch \
file://0018-Remove-bash-dependency-for-nscd-init-script.patch \
file://0019-eglibc-Cross-building-and-testing-instructions.patch \
file://0020-eglibc-Help-bootstrap-cross-toolchain.patch \
file://0021-eglibc-Resolve-__fpscr_values-on-SH4.patch \
file://0022-eglibc-Forward-port-cross-locale-generation-support.patch \
file://0024-localedef-add-to-archive-uses-a-hard-coded-locale-pa.patch \
file://0025-elf-dl-deps.c-Make-_dl_build_local_scope-breadth-fir.patch \
file://0026-intl-Emit-no-lines-in-bison-generated-files.patch \
file://0027-locale-prevent-maybe-uninitialized-errors-with-Os-BZ.patch \
file://0028-readlib-Add-OECORE_KNOWN_INTERPRETER_NAMES-to-known-.patch \
file://0029-wordsize.h-Unify-the-header-between-arm-and-aarch64.patch \
file://0030-powerpc-Do-not-ask-compiler-for-finding-arch.patch \
file://0001-CVE-2021-38604.patch \
file://0002-CVE-2021-38604.patch \
file://0001-fix-create-thread-failed-in-unprivileged-process-BZ-.patch \
file://CVE-2021-43396.patch \
file://0001-Make-shell-interpreter-overridable-in-tzselect.ksh.patch \
file://0001-CVE-2022-23218.patch \
file://0002-CVE-2022-23218.patch \
file://0001-CVE-2022-23219.patch \
file://0002-CVE-2022-23219.patch \
file://0001-CVE-2021-3998.patch \
file://0002-CVE-2021-3998.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
PACKAGES_DYNAMIC = ""
# the -isystem in bitbake.conf screws up glibc do_stage
BUILD_CPPFLAGS = "-I${STAGING_INCDIR_NATIVE}"
TARGET_CPPFLAGS = "-I${STAGING_DIR_TARGET}${includedir}"
GLIBC_BROKEN_LOCALES = ""
GLIBCPIE ??= ""
EXTRA_OECONF = "--enable-kernel=${OLDEST_KERNEL} \
--disable-profile \
--disable-debug --without-gd \
--enable-clocale=gnu \
--with-headers=${STAGING_INCDIR} \
--without-selinux \
--enable-tunables \
--enable-bind-now \
--enable-stack-protector=strong \
--disable-crypt \
--with-default-link \
${@bb.utils.contains_any('SELECTED_OPTIMIZATION', '-O0 -Og', '--disable-werror', '', d)} \
${GLIBCPIE} \
${GLIBC_EXTRA_OECONF}"
EXTRA_OECONF += "${@get_libc_fpu_setting(bb, d)}"
EXTRA_OECONF:append:x86 = " ${@bb.utils.contains_any('TUNE_FEATURES', 'i586 c3', '--disable-cet', '--enable-cet', d)}"
EXTRA_OECONF:append:x86-64 = " --enable-cet"
PACKAGECONFIG ??= "nscd memory-tagging"
PACKAGECONFIG[nscd] = "--enable-nscd,--disable-nscd"
PACKAGECONFIG[memory-tagging] = "--enable-memory-tagging,--disable-memory-tagging"
do_patch:append() {
bb.build.exec_func('do_fix_readlib_c', d)
}
do_fix_readlib_c () {
sed -i -e 's#OECORE_KNOWN_INTERPRETER_NAMES#${EGLIBC_KNOWN_INTERPRETER_NAMES}#' ${S}/elf/readlib.c
}
do_configure () {
# override this function to avoid the autoconf/automake/aclocal/autoheader
# calls for now
# don't pass CPPFLAGS into configure, since it upsets the kernel-headers
# version check and doesn't really help with anything
(cd ${S} && gnu-configize) || die "failure in running gnu-configize"
find ${S} -name "configure" | xargs touch
CPPFLAGS="" oe_runconf
}
LDFLAGS += "-fuse-ld=bfd"
do_compile () {
base_do_compile
echo "Adjust ldd script"
if [ -n "${RTLDLIST}" ]
then
prevrtld=`cat ${B}/elf/ldd | grep "^RTLDLIST=" | sed 's#^RTLDLIST="\?\([^"]*\)"\?$#\1#'`
# remove duplicate entries
newrtld=`echo $(printf '%s\n' ${prevrtld} ${RTLDLIST} | LC_ALL=C sort -u)`
echo "ldd \"${prevrtld} ${RTLDLIST}\" -> \"${newrtld}\""
sed -i ${B}/elf/ldd -e "s#^RTLDLIST=.*\$#RTLDLIST=\"${newrtld}\"#"
fi
}
require glibc-package.inc
BBCLASSEXTEND = "nativesdk"
|
