Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 566520 - kernel-2.eclass / multiple kernel packages call use* in global scope
Summary: kernel-2.eclass / multiple kernel packages call use* in global scope
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: The Gentoo Linux Hardened Kernel Team (OBSOLETE)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: global-scope-use
  Show dependency tree
 
Reported: 2015-11-22 22:21 UTC by Michał Górny
Modified: 2015-12-20 15:07 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
kernel-2.eclass patch (kernel-2.eclass.patch,4.02 KB, patch)
2015-11-23 22:51 UTC, Mike Pagano
Details | Diff
test ebuild (gentoo-sources-4.2.4.ebuild,848 bytes, text/plain)
2015-11-23 22:52 UTC, Mike Pagano
Details
kernel-2.eclass patch V2 (kernel-2.eclass.patch,7.52 KB, patch)
2015-11-25 00:37 UTC, Mike Pagano
Details | Diff
Test ebuild (gentoo-sources-4.2.4.ebuild,845 bytes, text/plain)
2015-11-25 00:39 UTC, Mike Pagano
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-11-22 22:21:42 UTC
I have confirmed evidence for:

  sys-kernel/aufs-sources
  sys-kernel/ck-sources
  sys-kernel/gentoo-sources
  sys-kernel/tuxonice-sources

All those packages call use* at least one in global scope. This is forbidden, unpredictable and is fatal error in Portage starting with EAPI 6.

if I understand the creepy code correctly, this happens via detect_version call, which in turn calls handle_genpatches, which has 'use experimental'. There may be more uses.

Please fix it urgently.
Comment 1 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2015-11-22 23:58:20 UTC
Fixed, but needs more testing.
handle_genpatches affects both the URI and the GENPATCHES list of patch tarballs to apply...
Comment 2 Patrick Lauer gentoo-dev 2015-11-23 08:58:22 UTC
The 'fix' broke installing kernel-sources and should be reverted. See https://bugs.gentoo.org/show_bug.cgi?id=566600
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-11-23 16:11:03 UTC
(In reply to Patrick Lauer from comment #2)
> The 'fix' broke installing kernel-sources and should be reverted. See
> https://bugs.gentoo.org/show_bug.cgi?id=566600

Reverted now.
Comment 4 Mike Pagano gentoo-dev 2015-11-23 22:51:22 UTC
Created attachment 417716 [details, diff]
kernel-2.eclass patch

Ok, so here is my shot.  Please test if you have the time.
After this I will tackle 'use kdbus'.

I added this to an ebuild:

K_EXP_GENPATCHES_NOUSE=`use experimental  && echo "1"`

I need someone to tell me if that's OK, or if I'm breaking bash in ways no man has ever done before, and I should be committed. 

I'll attach the test ebuild also.
Comment 5 Mike Pagano gentoo-dev 2015-11-23 22:52:50 UTC
Created attachment 417718 [details]
test ebuild

USE=experimental ebuild gentoo-sources-4.2.4.ebuild manifest clean unpack
should install experimental patchset

and

ebuild gentoo-sources-4.2.4.ebuild manifest clean unpack
should not install experimental patchset
Comment 6 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-11-24 04:00:14 UTC
That's still global scope 'use' call, just moved to another place, you know.
Comment 7 Mike Pagano gentoo-dev 2015-11-24 09:52:40 UTC
(In reply to Michał Górny from comment #6)
> That's still global scope 'use' call, just moved to another place, you know.

Help me understand, please.  I took out 'use experimental' and the code now looks for a variable set from the ebuild.

Is that still invalid?
Comment 8 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-11-24 15:20:06 UTC
It is because the ebuild now calls use in global scope. I don't really know the code but I suspect you want to use 'experimental?' in metadata.
Comment 9 Mike Pagano gentoo-dev 2015-11-24 17:53:12 UTC
Ok, I understand.  What would be cool is if I could call a function defined in the ebuild and then call super().
Comment 10 Mike Pagano gentoo-dev 2015-11-25 00:37:55 UTC
Created attachment 417800 [details, diff]
kernel-2.eclass patch V2

Some changes for the eclass.

1. Removed the export of pkg_setup so the use checks can happen in the function in the ebuild. Deleted unused code and move the rest to other parts of the eclass.

2. Removed any sign of  'use experimental'

3 Added a new variable that can be set in pkg_setup in the ebuilds to pull in experimental patch set or not pull it in.
Comment 11 Mike Pagano gentoo-dev 2015-11-25 00:39:26 UTC
Created attachment 417802 [details]
Test ebuild

Check for 'use experimental' in pkg_setup and set eclass variable accordingly.
Comment 12 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-11-25 08:05:56 UTC
Did you merge some irrelevant changes in that patch, or am I incorrect?

setup_headers doesn't really belong in global scope either. You're doing arch conditionals there. You are going to cause cache regen fail for all headers which are not for arch used by machine generating the cache.

Now experimental are in GENPATCHES_URI without 'experimental? ( )' condition. I don't think that's desired.

I still barely understand all the creepy code in there but I believe what you'd really want there is splitting handle_genpatches in two parts -- one to be called in global scope to set up the URIs (without 'use' call, but generating 'experimental? ( ... )'), and the other to be called in phase scope to set UNIPATCH_LIST_GENPATCHES.
Comment 13 Mike Pagano gentoo-dev 2015-11-25 10:22:57 UTC
(In reply to Michał Górny from comment #12)
> Did you merge some irrelevant changes in that patch, or am I incorrect?
> 
> setup_headers doesn't really belong in global scope either. You're doing
> arch conditionals there. You are going to cause cache regen fail for all
> headers which are not for arch used by machine generating the cache.
> 
> Now experimental are in GENPATCHES_URI without 'experimental? ( )'
> condition. I don't think that's desired.
> 
> I still barely understand all the creepy code in there but I believe what
> you'd really want there is splitting handle_genpatches in two parts -- one
> to be called in global scope to set up the URIs (without 'use' call, but
> generating 'experimental? ( ... )'), and the other to be called in phase
> scope to set UNIPATCH_LIST_GENPATCHES.

Well, clearly this 'creepy' code needs a better eclass developer than I am.
You mention a lot of baggage that's been around longer than me.

setup_headers has been around forever. Right or wrong.

I appreciate your bits of direction here, but without any more concrete suggestions that aren't going to result in a real solution I don't think I going to be able to create something that satisfies.
Comment 14 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-11-25 11:18:38 UTC
No, i mean your patch removes pkg_setup which seemed irrelevant. Anyway, I'll try to tackle it today and hopefully find a simple solution. Though the eclass pretty much requires solid rewrite.
Comment 15 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-12-06 18:31:50 UTC
My suggested solution:

https://github.com/gentoo/gentoo/pull/442

Tested it with gentoo-sources, should work with others too.
Comment 16 Mike Pagano gentoo-dev 2015-12-06 23:26:10 UTC
(In reply to Michał Górny from comment #15)
> My suggested solution:
> 
> https://github.com/gentoo/gentoo/pull/442
> 
> Tested it with gentoo-sources, should work with others too.

Passed through my testing fine.
Comment 17 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-12-11 07:32:51 UTC
Should I merge it then?
Comment 18 Mike Pagano gentoo-dev 2015-12-12 01:50:22 UTC
(In reply to Michał Górny from comment #17)
> Should I merge it then?

+1 from me.

Hardened team, please bless.
Comment 19 Mike Pagano gentoo-dev 2015-12-19 21:24:43 UTC
I hope it's ok to reassign to hardened to get it on your guys radar. Looking for an 'OK' here, please.  Or a 'not OK'.
Comment 20 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-12-20 15:07:49 UTC
Merged given prometheanfire approval on the PR.