Bugzilla Bug 157576

The summary has it all. ufed doesn't list the "hardened" USE flag anymore and
doesn't write it into make.conf. Putting it into make.conf manually doesn't
change this.


Portage 2.1.2_rc2-r5 (default-linux/x86/2006.1, gcc-4.1.1, glibc-2.5-r0, 2.6.19
i686)
=================================================================
System uname: 2.6.19 i686 Intel(R) Pentium(R) M processor 1500MHz
Gentoo Base System version 1.12.6
Last Sync: Fri, 08 Dec 2006 17:30:01 +0000
distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632)
[disabled]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python:     2.4.4
dev-python/pycrypto: 2.0.1-r5
dev-util/confcache:  0.4.2-r1
sys-apps/sandbox:    1.2.18.1
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="x86 ~x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O3 -march=pentium4 -fomit-frame-pointer -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c"
CXXFLAGS="-O3 -march=pentium4 -fomit-frame-pointer -pipe"
DISTDIR="/gentoo/distfiles"
FEATURES="autoconfig distlocks metadata-transfer parallel-fetch sandbox sfperms
strict"
GENTOO_MIRRORS="ftp://ftp.tu-clausthal.de/pub/linux/gentoo/
http://ftp.gentoo.or.kr/ http://gentoo.inode.at/"
LINGUAS="de"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/gentoo/build"
PORTDIR="/gentoo/portage"
PORTDIR_OVERLAY="/gentoo/build/overlay"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X Xaw3d a52 aac aalib acl acpi activefilter ada afs alsa aotuv arts
asf async audiofile automount avahi bacula-clientonly bacula-split-init
bash-completion berkdb bitmap-fonts bluetooth browserplugin bzip2 cairo caps
cdda cddb cdio cdparanoia chipcard cli client-only cpudetection cracklib crypt
cups dbus dlloader doc dri dtaus dv dvd dvdread dynamic elibc_glibc emacs
encode exif fam fbcon ffmpeg flac font-server foomaticdb fuse gcj gd-external
gdbm geldkarte gif glibc-omitfp glut gmp gnustep gnutls gpg2-experimental
gphoto2 gpm gstreamer hal hardened hbci httpd iconv icq idn imagemagick imap
imlib input_devices_keyboard input_devices_mouse ipppd irmc isdnlog jpeg jpeg2k
kcal kde kdehiddenvisibility kerberos kernel_linux latex layout-from-conf-file
lcms ldap libedit libg++ libwww linguas_de lm_sensors logrotate lzo mad madwifi
maildir mbox mime mmxext mng motif moznopango mozsvg mp3 mpeg mule musicbrainz
nas ncurses nls no-old-linux noantlr nobcel nobeanutils nobsh nocommonslogging
nocommonsnet nojdepend nojsch nojython nolog4j nooro noregexp norhino noxalan
noxerces nptl nptlonly nsplugin objc objc++ objc-gc ofx ogg on-the-fly-crypt
openexr opengl pam pam_console pcre pdf perl perlsuid pg-intdatetime pic png
postgres ppds pppd pwdb python qt3 qt3support qt4 quicktime rdesktop readline
real reflection rtc samba savedconfig session slang slp sms socks5 speedo speex
spell spl sql sqlite sqlite3 sse ssl stream subversion svg svga swat symlink
sysfs syslog tcltk tcpd tetex theora threads tiff toolbar truetype
truetype-fonts type1-fonts udev unicode usb userland_GNU userlocales vcd
video_cards_radeon vim-pager vim-with-x vlm vorbis wifi win32codecs wmf
wxwindows xine xml xorg xprint xscreensaver xv xvid xvmc zeroconf zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS,
MAKEOPTS, PORTAGE_RSYNC_EXTRA_OPTS

No a side note: don't stick hardened use flag into make.conf; use a proper
hardened profile.

This is the expected behaviour. The flag is masked on your profile, so even if
you do set it, it won't affect anything.

(In reply to comment #2)
> This is the expected behaviour. The flag is masked on your profile, so even

I don't see where:

# pwd
/gentoo/portage/profiles/default-linux
# grep -R hardened *
alpha/no-nptl/2.4/package.mask:>=sys-kernel/hardened-sources-2.5
alpha/use.mask:hardened
arm/use.mask:hardened
ia64/2005.0/packages:>=sys-kernel/hardened-sources-2.5
ia64/use.mask:hardened
ia64/2006.0/packages:>=sys-kernel/hardened-sources-2.5
m68k/use.mask:hardened
package.use.mask:sys-devel/gcc hardened
s390/use.mask:hardened
sh/use.mask:hardened
sparc/sparc32/2006.0/2.4/package.mask:>=sys-kernel/hardened-sources-2.6.0
sparc/sparc32/2006.1/2.4/package.mask:>=sys-kernel/hardened-sources-2.6.0
sparc/sparc64/2006.0/2.4/package.mask:>=sys-kernel/hardened-sources-2.6.0
sparc/sparc64/2006.1/2.4/package.mask:>=sys-kernel/hardened-sources-2.6.0
sparc/use.mask:# Masking hardened, it isn't really supported, see bugs #144126
#78951
sparc/use.mask:hardened
x86/dev/2007.0/server/profile.bashrc:           ewarn "profile, please check
the Hardened project (http://hardened.gentoo.org)."
x86/dev/2007.0/server/profile.bashrc:           ewarn "minimal profile, yet are
unable to use hardened due to restrictions in"
x86/no-nptl/2.4/package.mask:>=sys-kernel/hardened-sources-2.5
x86/2006.1/server/profile.bashrc:               ewarn "profile, please check
the Hardened project (http://hardened.gentoo.org)."
x86/2006.1/server/profile.bashrc:               ewarn "minimal profile, yet are
unable to use hardened due to restrictions in"
x86/ChangeLog:  supported, and recommends server users to use the hardened
profiles.

../base also doesn't have any sign of "hardened".

(In reply to comment #2)
> This is the expected behaviour. The flag is masked on your profile, so even if
> you do set it, it won't affect anything.

Nope, ufed misunderstands package.use.mask; move that file away from
default-linux profile and it works correctly.

I'm very sorry about that. I had verified with `emerge -pv gcc`, but did not
consider package.use.mask.

Fixed in 0.40-r6, and until the update shows up in the tree for you, you should
be able to work around it in 0.40-r5 with `echo -hardened
>>/gentoo/portage/profile/base/use.mask (which will be reverted after emerge
--sync).