[PATCH 0/6] Fixes about unsafe references

[PATCH 0/6] Fixes about unsafe references

[Chen Qi]

The following changes since commit e72aac2ae9e5fce1715fa04b7e94034fd06892d9:

  alsa-lib: libasound should runtime depends on alsa-conf (2014-09-03 11:30:11 +0100)

are available in the git repository at:

  git://git.openembedded.org/openembedded-core-contrib ChenQi/unsafe-reference
  http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=ChenQi/unsafe-reference

Chen Qi (6):
  zlib: install into base_libdir
  udev: fix unsafe reference by installing libgudev in libdir
  insane.bbclass: make the checking stricter for unsafe references in
    scripts
  iputils: fix program location and QA warning
  kmod: install libkmod into base_libdir
  busybox: install ping6 into bindir by default

 meta/classes/insane.bbclass                        |  2 +-
 .../busybox-install-ping6-to-usr-bin.patch         | 25 +++++++++++++++++++
 meta/recipes-core/udev/udev.inc                    |  8 +++++-
 meta/recipes-core/zlib/zlib_1.2.8.bb               |  2 +-
 meta/recipes-extended/iputils/iputils_s20121221.bb | 29 ++++++++++++++--------
 meta/recipes-kernel/kmod/kmod_git.bb               |  9 ++++---
 6 files changed, 58 insertions(+), 17 deletions(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch

-- 
1.9.1

[PATCH 1/6] zlib: install into base_libdir

[Chen Qi]

From: Chen Qi <qi.chen@windriver.com>

[CQID: WIND00444742]

Install zlib into base_libdir as kmod needs it. The purpose is to
make system boot into single user mode even if /usr is missing.

(LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
---
 meta/recipes-core/zlib/zlib_1.2.8.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-core/zlib/zlib_1.2.8.bb b/meta/recipes-core/zlib/zlib_1.2.8.bb
index bdfa045..5b5e2e1 100644
--- a/meta/recipes-core/zlib/zlib_1.2.8.bb
+++ b/meta/recipes-core/zlib/zlib_1.2.8.bb
@@ -21,7 +21,7 @@ RDEPENDS_${PN}-ptest += "make"
 inherit ptest
 
 do_configure (){
-	./configure --prefix=${prefix} --shared --libdir=${libdir}
+	./configure --prefix=${base_prefix} --shared --libdir=${base_libdir}
 }
 
 do_compile (){
-- 
1.9.1

[PATCH 2/6] udev: fix unsafe reference by installing libgudev in libdir

[Chen Qi]

From: Chen Qi <qi.chen@windriver.com>

[CQID: WIND00444742]

This patch fixes the following QA issue about unsafe reference in
binaries.

/lib/libgudev-1.0.so.0.1.1 requires /usr/lib/libgobject-2.0.so.0.

As libgudev is a GObject wrapper for libudev, and the purpose of
it is to make the development of GObject based applications easier,
there's no reason why it should remain in /lib. So this patches moves
the libgudev to /usr/lib.

This patch also removes a duplicate line in the EXTRA_OECONF.

(LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
---
 meta/recipes-core/udev/udev.inc | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/meta/recipes-core/udev/udev.inc b/meta/recipes-core/udev/udev.inc
index 280da10..cb6279f 100644
--- a/meta/recipes-core/udev/udev.inc
+++ b/meta/recipes-core/udev/udev.inc
@@ -42,7 +42,6 @@ EXTRA_OECONF = "--disable-introspection \
                 ac_cv_file__usr_share_misc_pci_ids=yes \
                 --sbindir=${base_sbindir} \
                 --libexecdir=${nonarch_base_libdir} \
-                --with-rootlibdir=${base_libdir} \
                 --with-rootprefix= \
                 --without-systemdsystemunitdir \
                "
@@ -92,6 +91,13 @@ do_install_append () {
 	# hid2hci has moved to bluez4. removed in udev as of version 169
 	rm -f ${D}${base_libdir}/udev/hid2hci
 
+	if [ "${libdir}" != "${base_libdir}" ]; then
+	    # install libgudev.so.* into libdir.
+	    so_img_name=`basename $(readlink ${D}${libdir}/libgudev-1.0.so)`
+	    mv ${D}${base_libdir}/libgudev-1.0.so.* ${D}${libdir}
+	    ln -sf $so_img_name ${D}${libdir}/libgudev-1.0.so
+	fi
+
 	echo 'udev_run="/var/run/udev"' >> ${D}${sysconfdir}/udev/udev.conf
 }
 
-- 
1.9.1

[PATCH 3/6] insane.bbclass: make the checking stricter for unsafe references in scripts

[Chen Qi]

From: Chen Qi <qi.chen@windriver.com>

[CQID: WIND00444742]

Previously, the checking for unsafe references is not strict enough. It
only checks whether '/usr/' is in the script. As a result, any script
containing statements like below will match this check.

	   PATH="/bin:/sbin:/usr/bin:/usr/sbin"

However, as we can see, this is actually not an unsafe reference. What
we really want to check is something like '/usr/bin/tail', so we should
make the checking stricter.

This patch solves the QA warning in gzip and nfs-utils.

(LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
---
 meta/classes/insane.bbclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/classes/insane.bbclass b/meta/classes/insane.bbclass
index 3dd2e7f..4dc0220 100644
--- a/meta/classes/insane.bbclass
+++ b/meta/classes/insane.bbclass
@@ -385,7 +385,7 @@ def package_qa_check_unsafe_references_in_scripts(path, name, d, elf, messages):
         if bool(statinfo.st_mode & stat.S_IXUSR):
             # grep shell scripts for possible references to /exec_prefix/
             exec_prefix = d.getVar('exec_prefix', True)
-            statement = "grep -e '%s/' %s > /dev/null" % (exec_prefix, path)
+            statement = "grep -e '%s/[^ :]\{1,\}/[^ :]\{1,\}' %s > /dev/null" % (exec_prefix, path)
             if subprocess.call(statement, shell=True) == 0:
                 error_msg = pn + ": Found a reference to %s/ in %s" % (exec_prefix, path)
                 package_qa_handle_error("unsafe-references-in-scripts", error_msg, d)
-- 
1.9.1

[PATCH 4/6] iputils: fix program location and QA warning

[Chen Qi]

From: Chen Qi <qi.chen@windriver.com>

[CQID: WIND00444742]

According to FHS, only `ping' is required to be under /bin.
So this patch move other commands like `ping6' and 'traceroute6' to
/usr/bin.

Doing so will fix QA warnings of unsafe reference of binaries in ping6.

/bin/ping6.iputils requires /usr/lib/libgnutls.so.26
/bin/ping6.iputils requires /usr/lib/libgcrypt.so.11
/bin/ping6.iputils requires /usr/lib/libgpg-error.so.0
/bin/ping6.iputils requires /usr/lib/libtasn1.so.6

(LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
---
 meta/recipes-extended/iputils/iputils_s20121221.bb | 29 ++++++++++++++--------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/meta/recipes-extended/iputils/iputils_s20121221.bb b/meta/recipes-extended/iputils/iputils_s20121221.bb
index 46f8903..5849f0d 100644
--- a/meta/recipes-extended/iputils/iputils_s20121221.bb
+++ b/meta/recipes-extended/iputils/iputils_s20121221.bb
@@ -29,15 +29,16 @@ do_compile () {
 }
 
 do_install () {
-	install -m 0755 -d ${D}${base_bindir} ${D}${mandir}/man8
+	install -m 0755 -d ${D}${base_bindir} ${D}${mandir}/man8 ${D}${bindir} ${D}${sbindir}
 	# SUID root programs
 	install -m 4555 ping ${D}${base_bindir}/ping
-	install -m 4555 ping6 ${D}${base_bindir}/ping6
-	install -m 4555 traceroute6 ${D}${base_bindir}/
+	install -m 4555 ping6 ${D}${bindir}/ping6
+	install -m 4555 traceroute6 ${D}${bindir}/
 	# Other programgs
-	for i in arping tracepath tracepath6; do
-	  install -m 0755 $i ${D}${base_bindir}/
+	for i in tracepath tracepath6; do
+	  install -m 0755 $i ${D}${bindir}/
 	done
+	install -m 0755 arping ${D}${sbindir}/
 	# Manual pages for things we build packages for
 	for i in tracepath.8 traceroute6.8 ping.8 arping.8; do
 	  install -m 0644 doc/$i ${D}${mandir}/man8/ || true
@@ -52,7 +53,13 @@ ALTERNATIVE_${PN}-ping = "ping"
 ALTERNATIVE_LINK_NAME[ping] = "${base_bindir}/ping"
 
 ALTERNATIVE_${PN}-ping6 = "ping6"
-ALTERNATIVE_LINK_NAME[ping6] = "${base_bindir}/ping6"
+ALTERNATIVE_LINK_NAME[ping6] = "${bindir}/ping6"
+
+ALTERNATIVE_${PN}-traceroute6 = "traceroute6"
+ALTERNATIVE_LINK_NAME[traceroute6] = "${bindir}/traceroute6"
+
+ALTERNATIVE_${PN}-arping = "arping"
+ALTERNATIVE_LINK_NAME[arping] = "${sbindir}/arping"
 
 PACKAGES += "${PN}-ping ${PN}-ping6 ${PN}-arping ${PN}-tracepath ${PN}-tracepath6 ${PN}-traceroute6"
 
@@ -61,9 +68,9 @@ RDEPENDS_${PN} += "${PN}-ping ${PN}-ping6 ${PN}-arping ${PN}-tracepath ${PN}-tra
 
 FILES_${PN}	= ""
 FILES_${PN}-ping = "${base_bindir}/ping.${BPN}"
-FILES_${PN}-ping6 = "${base_bindir}/ping6.${BPN}"
-FILES_${PN}-arping = "${base_bindir}/arping"
-FILES_${PN}-tracepath = "${base_bindir}/tracepath"
-FILES_${PN}-tracepath6 = "${base_bindir}/tracepath6"
-FILES_${PN}-traceroute6	= "${base_bindir}/traceroute6"
+FILES_${PN}-ping6 = "${bindir}/ping6.${BPN}"
+FILES_${PN}-arping = "${sbindir}/arping.${BPN}"
+FILES_${PN}-tracepath = "${bindir}/tracepath"
+FILES_${PN}-tracepath6 = "${bindir}/tracepath6"
+FILES_${PN}-traceroute6	= "${bindir}/traceroute6.${BPN}"
 FILES_${PN}-doc	= "${mandir}/man8"
-- 
1.9.1

[PATCH 5/6] kmod: install libkmod into base_libdir

[Chen Qi]

From: Chen Qi <qi.chen@windriver.com>

[CQID: WIND00444742]

Install libkmod into base_libdir because udevd requires it. The purpose
is to make system boot into single user mode even if /usr is missing.

This patch fixes the following QA issue about unsafe references in
binaries.

/lib/udevd requires libkmod.so.2 (=> /usr/lib/libkmod.so.2)

(LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
Signed-off-by: Jeff Polk <jeff.polk@windriver.com>
---
 meta/recipes-kernel/kmod/kmod_git.bb | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/meta/recipes-kernel/kmod/kmod_git.bb b/meta/recipes-kernel/kmod/kmod_git.bb
index d4c21a4..090f5fb 100644
--- a/meta/recipes-kernel/kmod/kmod_git.bb
+++ b/meta/recipes-kernel/kmod/kmod_git.bb
@@ -13,9 +13,7 @@ RREPLACES_${PN} += "module-init-tools-insmod-static module-init-tools-depmod mod
 RCONFLICTS_libkmod2 += "module-init-tools-insmod-static module-init-tools-depmod module-init-tools"
 
 # autotools set prefix to /usr, however we want them in /bin and /sbin
-bindir = "${base_bindir}"
-sbindir = "${base_sbindir}"
-# libdir = "${base_libdir}"
+EXTRA_OECONF += "--bindir=${base_bindir} --sbindir=${base_sbindir} --libdir=${base_libdir}"
 
 do_install_append () {
         install -dm755 ${D}${base_bindir}
@@ -34,6 +32,11 @@ do_install_append () {
         # install depmod.d file for search/ dir
         install -Dm644 "${WORKDIR}/depmod-search.conf" "${D}${base_libdir}/depmod.d/search.conf"
 
+        if [ "${libdir}" != "${base_libdir}" ]; then
+            # mv the .pc file to ${libdir}
+            install -d ${D}${libdir}
+            mv ${D}${base_libdir}/pkgconfig ${D}${libdir}
+        fi
 }
 
 do_compile_prepend() {
-- 
1.9.1

[PATCH 6/6] busybox: install ping6 into bindir by default

[Chen Qi]

[CQID: WIND00444742]

Install `ping6' provided by busybox into /usr/bin to sync with the
iputils package.

(LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Joe MacDonald <joe.macdonald@windriver.com>
Signed-off-by: Jeff Polk <jeff.polk@windriver.com>
---
 .../busybox-install-ping6-to-usr-bin.patch         | 25 ++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch

diff --git a/meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch b/meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch
new file mode 100644
index 0000000..b99f47f
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox-1.21.1/busybox-install-ping6-to-usr-bin.patch
@@ -0,0 +1,25 @@
+Subject: [PATCH] busybox: install ping6 to /usr/bin by default
+
+Upstream-Status: Pending
+
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
+---
+ networking/ping.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/networking/ping.c b/networking/ping.c
+index 5e4771f..471c347 100644
+--- a/networking/ping.c
++++ b/networking/ping.c
+@@ -70,7 +70,7 @@
+ 
+ /* Needs socket(AF_INET, SOCK_RAW, IPPROTO_ICMP), therefore BB_SUID_MAYBE: */
+ //applet:IF_PING(APPLET(ping, BB_DIR_BIN, BB_SUID_MAYBE))
+-//applet:IF_PING6(APPLET(ping6, BB_DIR_BIN, BB_SUID_MAYBE))
++//applet:IF_PING6(APPLET(ping6, BB_DIR_USR_BIN, BB_SUID_MAYBE))
+ 
+ //kbuild:lib-$(CONFIG_PING)  += ping.o
+ //kbuild:lib-$(CONFIG_PING6) += ping.o
+-- 
+1.7.9.5
+
-- 
1.9.1

Re: [PATCH 6/6] busybox: install ping6 into bindir by default

[Burton, Ross]

On 9 September 2014 07:35, Chen Qi <Qi.Chen@windriver.com> wrote:
> [CQID: WIND00444742]
>
> Install `ping6' provided by busybox into /usr/bin to sync with the
> iputils package.
>
> (LOCAL REV: NOT UPSTREAM) -- Sent to oe-core on 20131113

I know there was consensus on the list that some vendor tags are fine
in commit messages, I think the LOCAL REV NOT UPSTREAM lines should be
stripped.

Ross