[PATCH V2 0/7] Fixes about unsafe-references QA warnings

[PATCH V2 0/7] Fixes about unsafe-references QA warnings

[Qi.Chen]

From: Chen Qi <Qi.Chen@windriver.com>

Changes since V1:
1. The two principles have been slightly adjusted as follows.
   *) With /usr on a seperate partition, system should still boot without any error. 
   *) Without /usr, system should be able to boot into single user mode. We do not
      need a clean build, we allow for error messages at boot, but the basic utilities
      should work. These should include mount, fsck and maybe udev.
2. Take into consideration the situation where exec_prefix and prefix are set to "".

The following changes since commit 4fdc3d77d4a875b7236536bf78849a4d1f6a7449:

  kbd: Fix stdarg related errors on uclibc (2013-11-08 17:31:36 +0000)

are available in the git repository at:

  git://git.pokylinux.org/poky-contrib ChenQi/unsafe-reference
  http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=ChenQi/unsafe-reference

Chen Qi (7):
  udev: fix dependency and location of udevadm
  zlib: install into base_libdir
  kmod: install libkmod into base_libdir
  udev: fix unsafe reference by installing libgudev in libdir
  insane.bbclass: make the checking stricter for unsafe references in
    scripts
  iputils: fix program location and QA warning
  busybox: install ping6 into bindir by default

 meta/classes/insane.bbclass                        |    2 +-
 .../busybox-install-ping6-to-usr-bin.patch         |   25 +++++++++++++++++
 meta/recipes-core/busybox/busybox_1.21.1.bb        |    1 +
 meta/recipes-core/udev/udev.inc                    |   20 +++++++++++---
 meta/recipes-core/zlib/zlib_1.2.8.bb               |    2 +-
 meta/recipes-extended/iputils/iputils_s20121221.bb |   29 ++++++++++++--------
 meta/recipes-kernel/kmod/kmod_git.bb               |    9 ++++--
 7 files changed, 68 insertions(+), 20 deletions(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch

-- 
1.7.9.5

[PATCH V2 1/7] udev: fix dependency and location of udevadm

[Qi.Chen]

From: Chen Qi <qi.chen@windriver.com>

As udev's init script needs udevadm, we should make udev RDEPEND on
udev-utils instead of just recommends it.

Also, move udevadm from /usr/bin to /bin. The purpose is to make udev
start correctly even if /usr is missing.

This patch also takes into consideration the situation of ${bindir}
and ${base_bindir} being the same.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/recipes-core/udev/udev.inc |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-core/udev/udev.inc b/meta/recipes-core/udev/udev.inc
index 02cab3b..7667a79 100644
--- a/meta/recipes-core/udev/udev.inc
+++ b/meta/recipes-core/udev/udev.inc
@@ -55,7 +55,8 @@ INITSCRIPT_NAME_udev-cache = "udev-cache"
 INITSCRIPT_PARAMS_udev-cache = "start 36 S ."
 
 FILES_${PN} += "${libexecdir} ${libdir}/ConsoleKit ${nonarch_base_libdir}/udev"
-RRECOMMENDS_${PN} += "udev-utils udev-cache"
+RRECOMMENDS_${PN} += "udev-cache"
+RDEPENDS_${PN} += "udev-utils"
 
 FILES_${PN}-dbg += "${libexecdir}/.debug"
 FILES_${PN}-dbg += "${base_libdir}/udev/.debug/"
@@ -72,7 +73,7 @@ FILES_libgudev-dev = "${includedir}/gudev* ${libdir}/libgudev*.so ${libdir}/libg
                      ${libdir}/libgudev*.a ${libdir}/pkgconfig/gudev*.pc"
 FILES_udev-cache = "${sysconfdir}/init.d/udev-cache ${sysconfdir}/default/udev-cache"
 
-FILES_udev-utils = "${bindir}/udevadm"
+FILES_udev-utils = "${base_bindir}/udevadm"
 
 do_install_append () {
 	install -d ${D}${sysconfdir}/init.d
@@ -87,9 +88,14 @@ do_install_append () {
 	touch ${D}${sysconfdir}/udev/cache.data
 
 	install -d ${D}${sysconfdir}/udev/rules.d/
-
 	install -m 0644 ${WORKDIR}/local.rules         ${D}${sysconfdir}/udev/rules.d/local.rules
 
+	if [ "${bindir}" != "${base_bindir}" ]; then
+	    install -d ${D}${base_bindir}
+	    mv ${D}${bindir}/udevadm ${D}${base_bindir}/udevadm
+	    rmdir ${D}${bindir}
+	fi
+
 	# hid2hci has moved to bluez4. removed in udev as of version 169
 	rm -f ${D}${base_libdir}/udev/hid2hci
 
-- 
1.7.9.5

[PATCH V2 2/7] zlib: install into base_libdir

[Qi.Chen]

From: Chen Qi <qi.chen@windriver.com>

Install zlib into base_libdir as kmod needs it. The purpose is to
make system boot into single user mode even if /usr is missing.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/recipes-core/zlib/zlib_1.2.8.bb |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-core/zlib/zlib_1.2.8.bb b/meta/recipes-core/zlib/zlib_1.2.8.bb
index 5cdf685..3504e59 100644
--- a/meta/recipes-core/zlib/zlib_1.2.8.bb
+++ b/meta/recipes-core/zlib/zlib_1.2.8.bb
@@ -15,7 +15,7 @@ SRC_URI[md5sum] = "28f1205d8dd2001f26fec1e8c2cebe37"
 SRC_URI[sha256sum] = "831df043236df8e9a7667b9e3bb37e1fcb1220a0f163b6de2626774b9590d057"
 
 do_configure (){
-	./configure --prefix=${prefix} --shared --libdir=${libdir}
+	./configure --prefix=${base_prefix} --shared --libdir=${base_libdir}
 }
 
 do_compile (){
-- 
1.7.9.5

[PATCH V2 3/7] kmod: install libkmod into base_libdir

[Qi.Chen]

From: Chen Qi <qi.chen@windriver.com>

Install libkmod into base_libdir because udevd requires it. The purpose
is to make system boot into single user mode even if /usr is missing.

This patch fixes the following QA issue about unsafe references in
binaries.

/lib/udevd requires libkmod.so.2 (=> /usr/lib/libkmod.so.2)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/recipes-kernel/kmod/kmod_git.bb |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-kernel/kmod/kmod_git.bb b/meta/recipes-kernel/kmod/kmod_git.bb
index f90b9aa..77d4c70 100644
--- a/meta/recipes-kernel/kmod/kmod_git.bb
+++ b/meta/recipes-kernel/kmod/kmod_git.bb
@@ -12,9 +12,7 @@ RREPLACES_${PN} += "module-init-tools-insmod-static module-init-tools-depmod mod
 RCONFLICTS_libkmod2 += "module-init-tools-insmod-static module-init-tools-depmod module-init-tools"
 
 # autotools set prefix to /usr, however we want them in /bin and /sbin
-bindir = "${base_bindir}"
-sbindir = "${base_sbindir}"
-# libdir = "${base_libdir}"
+EXTRA_OECONF += "--bindir=${base_bindir} --sbindir=${base_sbindir} --libdir=${base_libdir}"
 
 do_install_append () {
         install -dm755 ${D}${base_bindir}
@@ -33,6 +31,11 @@ do_install_append () {
         # install depmod.d file for search/ dir
         install -Dm644 "${WORKDIR}/depmod-search.conf" "${D}${base_libdir}/depmod.d/search.conf"
 
+        if [ "${libdir}" != "${base_libdir}" ]; then
+            # mv the .pc file to ${libdir}
+            install -d ${D}${libdir}
+            mv ${D}${base_libdir}/pkgconfig ${D}${libdir}
+        fi
 }
 
 do_compile_prepend() {
-- 
1.7.9.5

[PATCH V2 4/7] udev: fix unsafe reference by installing libgudev in libdir

[Qi.Chen]

From: Chen Qi <qi.chen@windriver.com>

This patch fixes the following QA issue about unsafe reference in
binaries.

/lib/libgudev-1.0.so.0.1.1 requires /usr/lib/libgobject-2.0.so.0.

As libgudev is a GObject wrapper for libudev, and the purpose of
it is to make the development of GObject based applications easier,
there's no reason why it should remain in /lib. So this patches moves
the libgudev to /usr/lib.

This patch also removes a duplicate line in the EXTRA_OECONF.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/recipes-core/udev/udev.inc |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-core/udev/udev.inc b/meta/recipes-core/udev/udev.inc
index 7667a79..1d18cbc 100644
--- a/meta/recipes-core/udev/udev.inc
+++ b/meta/recipes-core/udev/udev.inc
@@ -39,7 +39,6 @@ EXTRA_OECONF = "--disable-introspection \
                 ac_cv_file__usr_share_misc_pci_ids=yes \
                 --sbindir=${base_sbindir} \
                 --libexecdir=${nonarch_base_libdir} \
-                --with-rootlibdir=${base_libdir} \
                 --with-rootprefix= \
                 --without-systemdsystemunitdir \
                "
@@ -99,6 +98,13 @@ do_install_append () {
 	# hid2hci has moved to bluez4. removed in udev as of version 169
 	rm -f ${D}${base_libdir}/udev/hid2hci
 
+	if [ "${libdir}" != "${base_libdir}" ]; then
+	    # install libgudev.so.* into libdir.
+	    so_img_name=`basename $(readlink ${D}${libdir}/libgudev-1.0.so)`
+	    mv ${D}${base_libdir}/libgudev-1.0.so.* ${D}${libdir}
+	    ln -sf $so_img_name ${D}${libdir}/libgudev-1.0.so
+	fi
+
 	echo 'udev_run="/var/run/udev"' >> ${D}${sysconfdir}/udev/udev.conf
 }
 
-- 
1.7.9.5

[PATCH V2 5/7] insane.bbclass: make the checking stricter for unsafe references in scripts

[Qi.Chen]

From: Chen Qi <qi.chen@windriver.com>

Previously, the checking for unsafe references is not strict enough. It
only checks whether '/usr/' is in the script. As a result, any script
containing statements like below will match this check.

	   PATH="/bin:/sbin:/usr/bin:/usr/sbin"

However, as we can see, this is actually not an unsafe reference. What
we really want to check is something like '/usr/bin/tail', so we should
make the checking stricter.

This patch solves the QA warning in gzip and nfs-utils.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/classes/insane.bbclass |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes/insane.bbclass b/meta/classes/insane.bbclass
index eb440c2..281af95 100644
--- a/meta/classes/insane.bbclass
+++ b/meta/classes/insane.bbclass
@@ -367,7 +367,7 @@ def package_qa_check_unsafe_references_in_scripts(path, name, d, elf, messages):
 		if bool(statinfo.st_mode & stat.S_IXUSR):
 			# grep shell scripts for possible references to /exec_prefix/
 			exec_prefix = d.getVar('exec_prefix', True)
-			statement = "grep -e '%s/' %s > /dev/null" % (exec_prefix, path)
+			statement = "grep -e '%s/[^ :]\{1,\}/[^ :]\{1,\}' %s > /dev/null" % (exec_prefix, path)
 			if subprocess.call(statement, shell=True) == 0:
 				error_msg = pn + ": Found a reference to %s/ in %s" % (exec_prefix, path)
 				package_qa_handle_error("unsafe-references-in-scripts", error_msg, d)
-- 
1.7.9.5

[PATCH V2 6/7] iputils: fix program location and QA warning

[Qi.Chen]

From: Chen Qi <qi.chen@windriver.com>

According to FHS, only `ping' is required to be under /bin.
So this patch move other commands like `ping6' and 'traceroute6' to
/usr/bin.

Doing so will fix QA warnings of unsafe reference of binaries in ping6.

/bin/ping6.iputils requires /usr/lib/libgnutls.so.26
/bin/ping6.iputils requires /usr/lib/libgcrypt.so.11
/bin/ping6.iputils requires /usr/lib/libgpg-error.so.0
/bin/ping6.iputils requires /usr/lib/libtasn1.so.6

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 meta/recipes-extended/iputils/iputils_s20121221.bb |   29 ++++++++++++--------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/meta/recipes-extended/iputils/iputils_s20121221.bb b/meta/recipes-extended/iputils/iputils_s20121221.bb
index 46f8903..5849f0d 100644
--- a/meta/recipes-extended/iputils/iputils_s20121221.bb
+++ b/meta/recipes-extended/iputils/iputils_s20121221.bb
@@ -29,15 +29,16 @@ do_compile () {
 }
 
 do_install () {
-	install -m 0755 -d ${D}${base_bindir} ${D}${mandir}/man8
+	install -m 0755 -d ${D}${base_bindir} ${D}${mandir}/man8 ${D}${bindir} ${D}${sbindir}
 	# SUID root programs
 	install -m 4555 ping ${D}${base_bindir}/ping
-	install -m 4555 ping6 ${D}${base_bindir}/ping6
-	install -m 4555 traceroute6 ${D}${base_bindir}/
+	install -m 4555 ping6 ${D}${bindir}/ping6
+	install -m 4555 traceroute6 ${D}${bindir}/
 	# Other programgs
-	for i in arping tracepath tracepath6; do
-	  install -m 0755 $i ${D}${base_bindir}/
+	for i in tracepath tracepath6; do
+	  install -m 0755 $i ${D}${bindir}/
 	done
+	install -m 0755 arping ${D}${sbindir}/
 	# Manual pages for things we build packages for
 	for i in tracepath.8 traceroute6.8 ping.8 arping.8; do
 	  install -m 0644 doc/$i ${D}${mandir}/man8/ || true
@@ -52,7 +53,13 @@ ALTERNATIVE_${PN}-ping = "ping"
 ALTERNATIVE_LINK_NAME[ping] = "${base_bindir}/ping"
 
 ALTERNATIVE_${PN}-ping6 = "ping6"
-ALTERNATIVE_LINK_NAME[ping6] = "${base_bindir}/ping6"
+ALTERNATIVE_LINK_NAME[ping6] = "${bindir}/ping6"
+
+ALTERNATIVE_${PN}-traceroute6 = "traceroute6"
+ALTERNATIVE_LINK_NAME[traceroute6] = "${bindir}/traceroute6"
+
+ALTERNATIVE_${PN}-arping = "arping"
+ALTERNATIVE_LINK_NAME[arping] = "${sbindir}/arping"
 
 PACKAGES += "${PN}-ping ${PN}-ping6 ${PN}-arping ${PN}-tracepath ${PN}-tracepath6 ${PN}-traceroute6"
 
@@ -61,9 +68,9 @@ RDEPENDS_${PN} += "${PN}-ping ${PN}-ping6 ${PN}-arping ${PN}-tracepath ${PN}-tra
 
 FILES_${PN}	= ""
 FILES_${PN}-ping = "${base_bindir}/ping.${BPN}"
-FILES_${PN}-ping6 = "${base_bindir}/ping6.${BPN}"
-FILES_${PN}-arping = "${base_bindir}/arping"
-FILES_${PN}-tracepath = "${base_bindir}/tracepath"
-FILES_${PN}-tracepath6 = "${base_bindir}/tracepath6"
-FILES_${PN}-traceroute6	= "${base_bindir}/traceroute6"
+FILES_${PN}-ping6 = "${bindir}/ping6.${BPN}"
+FILES_${PN}-arping = "${sbindir}/arping.${BPN}"
+FILES_${PN}-tracepath = "${bindir}/tracepath"
+FILES_${PN}-tracepath6 = "${bindir}/tracepath6"
+FILES_${PN}-traceroute6	= "${bindir}/traceroute6.${BPN}"
 FILES_${PN}-doc	= "${mandir}/man8"
-- 
1.7.9.5

[PATCH V2 7/7] busybox: install ping6 into bindir by default

[Qi.Chen]

From: Chen Qi <Qi.Chen@windriver.com>

Install `ping6' provided by busybox into /usr/bin to sync with the
iputils package.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
 .../busybox-install-ping6-to-usr-bin.patch         |   25 ++++++++++++++++++++
 meta/recipes-core/busybox/busybox_1.21.1.bb        |    1 +
 2 files changed, 26 insertions(+)
 create mode 100644 meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch

diff --git a/meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch b/meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch
new file mode 100644
index 0000000..b99f47f
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch
@@ -0,0 +1,25 @@
+Subject: [PATCH] busybox: install ping6 to /usr/bin by default
+
+Upstream-Status: Pending
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ networking/ping.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/networking/ping.c b/networking/ping.c
+index 5e4771f..471c347 100644
+--- a/networking/ping.c
++++ b/networking/ping.c
+@@ -70,7 +70,7 @@
+ 
+ /* Needs socket(AF_INET, SOCK_RAW, IPPROTO_ICMP), therefore BB_SUID_MAYBE: */
+ //applet:IF_PING(APPLET(ping, BB_DIR_BIN, BB_SUID_MAYBE))
+-//applet:IF_PING6(APPLET(ping6, BB_DIR_BIN, BB_SUID_MAYBE))
++//applet:IF_PING6(APPLET(ping6, BB_DIR_USR_BIN, BB_SUID_MAYBE))
+ 
+ //kbuild:lib-$(CONFIG_PING)  += ping.o
+ //kbuild:lib-$(CONFIG_PING6) += ping.o
+-- 
+1.7.9.5
+
diff --git a/meta/recipes-core/busybox/busybox_1.21.1.bb b/meta/recipes-core/busybox/busybox_1.21.1.bb
index 8b91e63..35e2b69 100644
--- a/meta/recipes-core/busybox/busybox_1.21.1.bb
+++ b/meta/recipes-core/busybox/busybox_1.21.1.bb
@@ -34,6 +34,7 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://login-utilities.cfg \
            file://busybox-list-suid-and-non-suid-app-configs.patch \
            file://busybox-sed-fix-sed-clusternewline-testcase.patch \
+           file://busybox-install-ping6-to-usr-bin.patch \
 "
 
 SRC_URI[tarball.md5sum] = "795394f83903b5eec6567d51eebb417e"
-- 
1.7.9.5