summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Gilbert <floppym@gentoo.org>2017-06-28 13:01:09 -0400
committerMike Gilbert <floppym@gentoo.org>2017-06-28 13:01:44 -0400
commit6d6384e102e34db05c2897b20d63587173f141c5 (patch)
tree86216cb1cdc093e3143d5fc17b87eb6007b3c855
parentapp-arch/rar: Bump to v5.5.0 beta 4 from 2017-06-28 (bug #622382) (diff)
downloadgentoo-6d6384e102e34db05c2897b20d63587173f141c5.tar.gz
gentoo-6d6384e102e34db05c2897b20d63587173f141c5.tar.bz2
gentoo-6d6384e102e34db05c2897b20d63587173f141c5.zip
sys-apps/systemd: backport fix for CVE-2017-9445
Bug: https://bugs.gentoo.org/622874 Package-Manager: Portage-2.3.6_p9, Repoman-2.3.2_p77
-rw-r--r--sys-apps/systemd/files/233-CVE-2017-9445.patch178
-rw-r--r--sys-apps/systemd/systemd-233-r2.ebuild460
2 files changed, 638 insertions, 0 deletions
diff --git a/sys-apps/systemd/files/233-CVE-2017-9445.patch b/sys-apps/systemd/files/233-CVE-2017-9445.patch
new file mode 100644
index 00000000000..a05c41f47b6
--- /dev/null
+++ b/sys-apps/systemd/files/233-CVE-2017-9445.patch
@@ -0,0 +1,178 @@
+From 29bb43cc46412366fc939c66331a916de07bfac4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Sun, 18 Jun 2017 16:07:57 -0400
+Subject: [PATCH 1/4] resolved: simplify alloc size calculation
+
+The allocation size was calculated in a complicated way, and for values
+close to the page size we would actually allocate less than requested.
+
+Reported by Chris Coulson <chris.coulson@canonical.com>.
+
+CVE-2017-9445
+---
+ src/resolve/resolved-dns-packet.c | 8 +-------
+ src/resolve/resolved-dns-packet.h | 2 --
+ 2 files changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
+index 652970284..2034e3c8c 100644
+--- a/src/resolve/resolved-dns-packet.c
++++ b/src/resolve/resolved-dns-packet.c
+@@ -47,13 +47,7 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
+
+ assert(ret);
+
+- if (mtu <= UDP_PACKET_HEADER_SIZE)
+- a = DNS_PACKET_SIZE_START;
+- else
+- a = mtu - UDP_PACKET_HEADER_SIZE;
+-
+- if (a < DNS_PACKET_HEADER_SIZE)
+- a = DNS_PACKET_HEADER_SIZE;
++ a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
+
+ /* round up to next page size */
+ a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
+diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
+index 2c92392e4..3abcaf8cf 100644
+--- a/src/resolve/resolved-dns-packet.h
++++ b/src/resolve/resolved-dns-packet.h
+@@ -66,8 +66,6 @@ struct DnsPacketHeader {
+ /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */
+ #define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096
+
+-#define DNS_PACKET_SIZE_START 512
+-
+ struct DnsPacket {
+ int n_ref;
+ DnsProtocol protocol;
+--
+2.13.1
+
+
+From cd3d8a7ebc01cd6913eaa9a591f7d606038a7588 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Tue, 27 Jun 2017 14:20:00 -0400
+Subject: [PATCH 2/4] resolved: do not allocate packets with minimum size
+
+dns_packet_new() is sometimes called with mtu == 0, and in that case we should
+allocate more than the absolute minimum (which is the dns packet header size),
+otherwise we have to resize immediately again after appending the first data to
+the packet.
+
+This partially reverts the previous commit.
+---
+ src/resolve/resolved-dns-packet.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
+index 2034e3c8c..9d806ab33 100644
+--- a/src/resolve/resolved-dns-packet.c
++++ b/src/resolve/resolved-dns-packet.c
+@@ -28,6 +28,9 @@
+
+ #define EDNS0_OPT_DO (1<<15)
+
++#define DNS_PACKET_SIZE_START 512
++assert_cc(DNS_PACKET_SIZE_START > UDP_PACKET_HEADER_SIZE)
++
+ typedef struct DnsPacketRewinder {
+ DnsPacket *packet;
+ size_t saved_rindex;
+@@ -47,7 +50,14 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
+
+ assert(ret);
+
+- a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
++ /* When dns_packet_new() is called with mtu == 0, allocate more than the
++ * absolute minimum (which is the dns packet header size), to avoid
++ * resizing immediately again after appending the first data to the packet.
++ */
++ if (mtu < UDP_PACKET_HEADER_SIZE)
++ a = DNS_PACKET_SIZE_START;
++ else
++ a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
+
+ /* round up to next page size */
+ a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
+--
+2.13.1
+
+
+From a03fc1acd66d23e239f2545e9a6887c7d0aad7c5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Tue, 27 Jun 2017 16:59:06 -0400
+Subject: [PATCH 3/4] resolved: define various packet sizes as unsigned
+
+This seems like the right thing to do, and apparently at least some compilers
+warn about signed/unsigned comparisons with DNS_PACKET_SIZE_MAX.
+---
+ src/resolve/resolved-dns-packet.c | 2 +-
+ src/resolve/resolved-dns-packet.h | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
+index 9d806ab33..e2285b440 100644
+--- a/src/resolve/resolved-dns-packet.c
++++ b/src/resolve/resolved-dns-packet.c
+@@ -28,7 +28,7 @@
+
+ #define EDNS0_OPT_DO (1<<15)
+
+-#define DNS_PACKET_SIZE_START 512
++#define DNS_PACKET_SIZE_START 512u
+ assert_cc(DNS_PACKET_SIZE_START > UDP_PACKET_HEADER_SIZE)
+
+ typedef struct DnsPacketRewinder {
+diff --git a/src/resolve/resolved-dns-packet.h b/src/resolve/resolved-dns-packet.h
+index 3abcaf8cf..5dff272fd 100644
+--- a/src/resolve/resolved-dns-packet.h
++++ b/src/resolve/resolved-dns-packet.h
+@@ -58,13 +58,13 @@ struct DnsPacketHeader {
+ /* The various DNS protocols deviate in how large a packet can grow,
+ but the TCP transport has a 16bit size field, hence that appears to
+ be the absolute maximum. */
+-#define DNS_PACKET_SIZE_MAX 0xFFFF
++#define DNS_PACKET_SIZE_MAX 0xFFFFu
+
+ /* RFC 1035 say 512 is the maximum, for classic unicast DNS */
+-#define DNS_PACKET_UNICAST_SIZE_MAX 512
++#define DNS_PACKET_UNICAST_SIZE_MAX 512u
+
+ /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */
+-#define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096
++#define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096u
+
+ struct DnsPacket {
+ int n_ref;
+--
+2.13.1
+
+
+From 415871d88e0c44acf8b90dc07245809087a65d2c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Wed, 28 Jun 2017 12:24:37 -0400
+Subject: [PATCH 4/4] resolved: drop unnecessary comparison (#6220)
+
+mtu is always greater than UDP_PACKET_HEADER_SIZE at this point.
+Pointed out by Benjamin Robin.
+---
+ src/resolve/resolved-dns-packet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
+index e2285b440..738d4cc8f 100644
+--- a/src/resolve/resolved-dns-packet.c
++++ b/src/resolve/resolved-dns-packet.c
+@@ -57,7 +57,7 @@ int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
+ if (mtu < UDP_PACKET_HEADER_SIZE)
+ a = DNS_PACKET_SIZE_START;
+ else
+- a = MAX(mtu, DNS_PACKET_HEADER_SIZE);
++ a = mtu;
+
+ /* round up to next page size */
+ a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
+--
+2.13.1
+
diff --git a/sys-apps/systemd/systemd-233-r2.ebuild b/sys-apps/systemd/systemd-233-r2.ebuild
new file mode 100644
index 00000000000..b529b98afb8
--- /dev/null
+++ b/sys-apps/systemd/systemd-233-r2.ebuild
@@ -0,0 +1,460 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+if [[ ${PV} == 9999 ]]; then
+ EGIT_REPO_URI="https://github.com/systemd/systemd.git"
+ inherit git-r3
+else
+ SRC_URI="https://github.com/systemd/systemd/archive/v${PV}.tar.gz -> ${P}.tar.gz
+ !doc? ( https://dev.gentoo.org/~floppym/dist/${P}-man.tar.gz )"
+ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+fi
+
+PYTHON_COMPAT=( python{3_4,3_5,3_6} )
+
+inherit autotools bash-completion-r1 linux-info multilib-minimal pam python-any-r1 systemd toolchain-funcs udev user
+
+DESCRIPTION="System and service manager for Linux"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/systemd"
+
+LICENSE="GPL-2 LGPL-2.1 MIT public-domain"
+SLOT="0/2"
+IUSE="acl apparmor audit build cryptsetup curl doc elfutils +gcrypt gnuefi http
+ idn importd +kmod +lz4 lzma nat pam policykit
+ qrcode +seccomp selinux ssl sysv-utils test vanilla xkb"
+
+REQUIRED_USE="importd? ( curl gcrypt lzma )"
+
+MINKV="3.11"
+
+COMMON_DEPEND=">=sys-apps/util-linux-2.27.1:0=[${MULTILIB_USEDEP}]
+ sys-libs/libcap:0=[${MULTILIB_USEDEP}]
+ !<sys-libs/glibc-2.16
+ acl? ( sys-apps/acl:0= )
+ apparmor? ( sys-libs/libapparmor:0= )
+ audit? ( >=sys-process/audit-2:0= )
+ cryptsetup? ( >=sys-fs/cryptsetup-1.6:0= )
+ curl? ( net-misc/curl:0= )
+ elfutils? ( >=dev-libs/elfutils-0.158:0= )
+ gcrypt? ( >=dev-libs/libgcrypt-1.4.5:0=[${MULTILIB_USEDEP}] )
+ http? (
+ >=net-libs/libmicrohttpd-0.9.33:0=
+ ssl? ( >=net-libs/gnutls-3.1.4:0= )
+ )
+ idn? ( net-dns/libidn:0= )
+ importd? (
+ app-arch/bzip2:0=
+ sys-libs/zlib:0=
+ )
+ kmod? ( >=sys-apps/kmod-15:0= )
+ lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
+ lzma? ( >=app-arch/xz-utils-5.0.5-r1:0=[${MULTILIB_USEDEP}] )
+ nat? ( net-firewall/iptables:0= )
+ pam? ( virtual/pam:=[${MULTILIB_USEDEP}] )
+ qrcode? ( media-gfx/qrencode:0= )
+ seccomp? ( >=sys-libs/libseccomp-2.3.1:0= )
+ selinux? ( sys-libs/libselinux:0= )
+ sysv-utils? (
+ !sys-apps/systemd-sysv-utils
+ !sys-apps/sysvinit )
+ xkb? ( >=x11-libs/libxkbcommon-0.4.1:0= )
+ abi_x86_32? ( !<=app-emulation/emul-linux-x86-baselibs-20130224-r9
+ !app-emulation/emul-linux-x86-baselibs[-abi_x86_32(-)] )"
+
+# baselayout-2.2 has /run
+RDEPEND="${COMMON_DEPEND}
+ >=sys-apps/baselayout-2.2
+ selinux? ( sec-policy/selinux-base-policy[systemd] )
+ !build? ( || (
+ sys-apps/util-linux[kill(-)]
+ sys-process/procps[kill(+)]
+ sys-apps/coreutils[kill(-)]
+ ) )
+ !sys-auth/nss-myhostname
+ !<sys-kernel/dracut-044
+ !sys-fs/eudev
+ !sys-fs/udev"
+
+# sys-apps/dbus: the daemon only (+ build-time lib dep for tests)
+PDEPEND=">=sys-apps/dbus-1.9.8[systemd]
+ >=sys-apps/hwids-20150417[udev]
+ >=sys-fs/udev-init-scripts-25
+ policykit? ( sys-auth/polkit )
+ !vanilla? ( sys-apps/gentoo-systemd-integration )"
+
+# Newer linux-headers needed by ia64, bug #480218
+DEPEND="${COMMON_DEPEND}
+ app-arch/xz-utils:0
+ dev-util/gperf
+ >=dev-util/intltool-0.50
+ >=sys-apps/coreutils-8.16
+ >=sys-kernel/linux-headers-${MINKV}
+ virtual/pkgconfig
+ gnuefi? ( >=sys-boot/gnu-efi-3.0.2 )
+ test? ( sys-apps/dbus )
+ app-text/docbook-xml-dtd:4.2
+ app-text/docbook-xml-dtd:4.5
+ app-text/docbook-xsl-stylesheets
+ dev-libs/libxslt:0
+ doc? ( $(python_gen_any_dep 'dev-python/lxml[${PYTHON_USEDEP}]') )
+"
+
+python_check_deps() {
+ has_version --host-root "dev-python/lxml[${PYTHON_USEDEP}]"
+}
+
+pkg_pretend() {
+ if [[ ${MERGE_TYPE} != buildonly ]]; then
+ local CONFIG_CHECK="~AUTOFS4_FS ~BLK_DEV_BSG ~CGROUPS
+ ~CHECKPOINT_RESTORE ~DEVTMPFS ~EPOLL ~FANOTIFY ~FHANDLE
+ ~INOTIFY_USER ~IPV6 ~NET ~NET_NS ~PROC_FS ~SIGNALFD ~SYSFS
+ ~TIMERFD ~TMPFS_XATTR ~UNIX
+ ~CRYPTO_HMAC ~CRYPTO_SHA256 ~CRYPTO_USER_API_HASH
+ ~!FW_LOADER_USER_HELPER ~!GRKERNSEC_PROC ~!IDE ~!SYSFS_DEPRECATED
+ ~!SYSFS_DEPRECATED_V2"
+
+ use acl && CONFIG_CHECK+=" ~TMPFS_POSIX_ACL"
+ use seccomp && CONFIG_CHECK+=" ~SECCOMP ~SECCOMP_FILTER"
+ kernel_is -lt 3 7 && CONFIG_CHECK+=" ~HOTPLUG"
+ kernel_is -lt 4 7 && CONFIG_CHECK+=" ~DEVPTS_MULTIPLE_INSTANCES"
+
+ if linux_config_exists; then
+ local uevent_helper_path=$(linux_chkconfig_string UEVENT_HELPER_PATH)
+ if [[ -n ${uevent_helper_path} ]] && [[ ${uevent_helper_path} != '""' ]]; then
+ ewarn "It's recommended to set an empty value to the following kernel config option:"
+ ewarn "CONFIG_UEVENT_HELPER_PATH=${uevent_helper_path}"
+ fi
+ if linux_chkconfig_present X86; then
+ CONFIG_CHECK+=" ~DMIID"
+ fi
+ fi
+
+ if kernel_is -lt ${MINKV//./ }; then
+ ewarn "Kernel version at least ${MINKV} required"
+ fi
+
+ check_extra_config
+ fi
+}
+
+pkg_setup() {
+ :
+}
+
+src_unpack() {
+ default
+ [[ ${PV} != 9999 ]] || git-r3_src_unpack
+}
+
+src_prepare() {
+ # Bug 463376
+ sed -i -e 's/GROUP="dialout"/GROUP="uucp"/' rules/*.rules || die
+
+ local PATCHES=(
+ "${FILESDIR}/233-0001-Avoid-strict-DM-interface-version-dependencies-5519.patch"
+ "${FILESDIR}/233-CVE-2017-9445.patch"
+ )
+
+ if ! use vanilla; then
+ PATCHES+=(
+ "${FILESDIR}/218-Dont-enable-audit-by-default.patch"
+ "${FILESDIR}/228-noclean-tmp.patch"
+ "${FILESDIR}/233-systemd-user-pam.patch"
+ )
+ fi
+
+ [[ -d "${WORKDIR}"/patches ]] && PATCHES+=( "${WORKDIR}"/patches )
+
+ default
+
+ eautoreconf
+}
+
+src_configure() {
+ # Keep using the one where the rules were installed.
+ MY_UDEVDIR=$(get_udevdir)
+ # Fix systems broken by bug #509454.
+ [[ ${MY_UDEVDIR} ]] || MY_UDEVDIR=/lib/udev
+
+ # Prevent conflicts with i686 cross toolchain, bug 559726
+ tc-export AR CC NM OBJCOPY RANLIB
+
+ use doc && python_setup
+
+ multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+ local myeconfargs=(
+ # disable -flto since it is an optimization flag
+ # and makes distcc less effective
+ cc_cv_CFLAGS__flto=no
+ # disable -fuse-ld=gold since Gentoo supports explicit linker
+ # choice and forcing gold is undesired, #539998
+ # ld.gold may collide with user's LDFLAGS, #545168
+ # ld.gold breaks sparc, #573874
+ cc_cv_LDFLAGS__Wl__fuse_ld_gold=no
+
+ # Workaround for gcc-4.7, bug 554454.
+ cc_cv_CFLAGS__Werror_shadow=no
+
+ # Workaround for bug 516346
+ --enable-dependency-tracking
+
+ --disable-maintainer-mode
+ --localstatedir=/var
+ --with-pamlibdir=$(getpam_mod_dir)
+ # avoid bash-completion dep
+ --with-bashcompletiondir="$(get_bashcompdir)"
+ # make sure we get /bin:/sbin in $PATH
+ --enable-split-usr
+ # For testing.
+ --with-rootprefix="${ROOTPREFIX-/usr}"
+ --with-rootlibdir="${ROOTPREFIX-/usr}/$(get_libdir)"
+ # disable sysv compatibility
+ --with-sysvinit-path=
+ --with-sysvrcnd-path=
+ # no deps
+ --enable-efi
+ --enable-ima
+
+ # Optional components/dependencies
+ $(multilib_native_use_enable acl)
+ $(multilib_native_use_enable apparmor)
+ $(multilib_native_use_enable audit)
+ $(multilib_native_use_enable cryptsetup libcryptsetup)
+ $(multilib_native_use_enable curl libcurl)
+ $(multilib_native_use_enable elfutils)
+ $(use_enable gcrypt)
+ $(multilib_native_use_enable gnuefi)
+ --with-efi-libdir="/usr/$(get_libdir)"
+ $(multilib_native_use_enable http microhttpd)
+ $(usex http $(multilib_native_use_enable ssl gnutls) --disable-gnutls)
+ $(multilib_native_use_enable idn libidn)
+ $(multilib_native_use_enable importd)
+ $(multilib_native_use_enable importd bzip2)
+ $(multilib_native_use_enable importd zlib)
+ $(multilib_native_use_enable kmod)
+ $(use_enable lz4)
+ $(use_enable lzma xz)
+ $(multilib_native_use_enable nat libiptc)
+ $(use_enable pam)
+ $(multilib_native_use_enable policykit polkit)
+ $(multilib_native_use_enable qrcode qrencode)
+ $(multilib_native_use_enable seccomp)
+ $(multilib_native_use_enable selinux)
+ $(multilib_native_use_enable test tests)
+ $(multilib_native_use_enable test dbus)
+ $(multilib_native_use_enable xkb xkbcommon)
+ $(multilib_native_use_with doc python)
+
+ # hardcode a few paths to spare some deps
+ KILL=/bin/kill
+ QUOTAON=/usr/sbin/quotaon
+ QUOTACHECK=/usr/sbin/quotacheck
+
+ # TODO: we may need to restrict this to gcc
+ EFI_CC="$(tc-getCC)"
+
+ # dbus paths
+ --with-dbuspolicydir="${EPREFIX}/etc/dbus-1/system.d"
+ --with-dbussessionservicedir="${EPREFIX}/usr/share/dbus-1/services"
+ --with-dbussystemservicedir="${EPREFIX}/usr/share/dbus-1/system-services"
+
+ --with-ntp-servers="0.gentoo.pool.ntp.org 1.gentoo.pool.ntp.org 2.gentoo.pool.ntp.org 3.gentoo.pool.ntp.org"
+
+ # Breaks screen, tmux, etc.
+ --without-kill-user-processes
+ )
+
+ # Work around bug 463846.
+ tc-export CC
+
+ ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+ local mymakeopts=(
+ udevlibexecdir="${MY_UDEVDIR}"
+ )
+
+ if multilib_is_native_abi; then
+ emake "${mymakeopts[@]}"
+ else
+ emake built-sources
+ local targets=(
+ '$(rootlib_LTLIBRARIES)'
+ '$(lib_LTLIBRARIES)'
+ '$(pamlib_LTLIBRARIES)'
+ '$(pkgconfiglib_DATA)'
+ )
+ echo "gentoo: ${targets[*]}" | emake "${mymakeopts[@]}" -f Makefile -f - gentoo
+ fi
+}
+
+multilib_src_test() {
+ multilib_is_native_abi || return 0
+ default
+}
+
+multilib_src_install() {
+ local mymakeopts=(
+ # automake fails with parallel libtool relinking
+ # https://bugs.gentoo.org/show_bug.cgi?id=491398
+ -j1
+
+ udevlibexecdir="${MY_UDEVDIR}"
+ dist_udevhwdb_DATA=
+ DESTDIR="${D}"
+ )
+
+ if multilib_is_native_abi; then
+ emake "${mymakeopts[@]}" install
+ else
+ mymakeopts+=(
+ install-rootlibLTLIBRARIES
+ install-libLTLIBRARIES
+ install-pamlibLTLIBRARIES
+ install-pkgconfiglibDATA
+ install-includeHEADERS
+ install-pkgincludeHEADERS
+ )
+
+ emake "${mymakeopts[@]}"
+ fi
+}
+
+multilib_src_install_all() {
+ prune_libtool_files --modules
+ einstalldocs
+ dodoc "${FILESDIR}"/nsswitch.conf
+
+ if [[ ${PV} != 9999 ]]; then
+ use doc || doman "${WORKDIR}"/man/systemd.{directives,index}.7
+ fi
+
+ if use sysv-utils; then
+ for app in halt poweroff reboot runlevel shutdown telinit; do
+ dosym "..${ROOTPREFIX-/usr}/bin/systemctl" /sbin/${app}
+ done
+ dosym "..${ROOTPREFIX-/usr}/lib/systemd/systemd" /sbin/init
+ else
+ # we just keep sysvinit tools, so no need for the mans
+ rm "${D}"/usr/share/man/man8/{halt,poweroff,reboot,runlevel,shutdown,telinit}.8 \
+ || die
+ rm "${D}"/usr/share/man/man1/init.1 || die
+ fi
+
+ # Preserve empty dirs in /etc & /var, bug #437008
+ keepdir /etc/binfmt.d /etc/modules-load.d /etc/tmpfiles.d \
+ /etc/systemd/ntp-units.d /etc/systemd/user /var/lib/systemd \
+ /var/log/journal/remote
+
+ # Symlink /etc/sysctl.conf for easy migration.
+ dosym ../sysctl.conf /etc/sysctl.d/99-sysctl.conf
+
+ # If we install these symlinks, there is no way for the sysadmin to remove them
+ # permanently.
+ rm "${D}"/etc/systemd/system/multi-user.target.wants/systemd-networkd.service || die
+ rm -f "${D}"/etc/systemd/system/multi-user.target.wants/systemd-resolved.service || die
+ rm -r "${D}"/etc/systemd/system/network-online.target.wants || die
+ rm -r "${D}"/etc/systemd/system/sockets.target.wants || die
+ rm -r "${D}"/etc/systemd/system/sysinit.target.wants || die
+}
+
+migrate_locale() {
+ local envd_locale_def="${EROOT%/}/etc/env.d/02locale"
+ local envd_locale=( "${EROOT%/}"/etc/env.d/??locale )
+ local locale_conf="${EROOT%/}/etc/locale.conf"
+
+ if [[ ! -L ${locale_conf} && ! -e ${locale_conf} ]]; then
+ # If locale.conf does not exist...
+ if [[ -e ${envd_locale} ]]; then
+ # ...either copy env.d/??locale if there's one
+ ebegin "Moving ${envd_locale} to ${locale_conf}"
+ mv "${envd_locale}" "${locale_conf}"
+ eend ${?} || FAIL=1
+ else
+ # ...or create a dummy default
+ ebegin "Creating ${locale_conf}"
+ cat > "${locale_conf}" <<-EOF
+ # This file has been created by the sys-apps/systemd ebuild.
+ # See locale.conf(5) and localectl(1).
+
+ # LANG=${LANG}
+ EOF
+ eend ${?} || FAIL=1
+ fi
+ fi
+
+ if [[ ! -L ${envd_locale} ]]; then
+ # now, if env.d/??locale is not a symlink (to locale.conf)...
+ if [[ -e ${envd_locale} ]]; then
+ # ...warn the user that he has duplicate locale settings
+ ewarn
+ ewarn "To ensure consistent behavior, you should replace ${envd_locale}"
+ ewarn "with a symlink to ${locale_conf}. Please migrate your settings"
+ ewarn "and create the symlink with the following command:"
+ ewarn "ln -s -n -f ../locale.conf ${envd_locale}"
+ ewarn
+ else
+ # ...or just create the symlink if there's nothing here
+ ebegin "Creating ${envd_locale_def} -> ../locale.conf symlink"
+ ln -n -s ../locale.conf "${envd_locale_def}"
+ eend ${?} || FAIL=1
+ fi
+ fi
+}
+
+pkg_postinst() {
+ newusergroup() {
+ enewgroup "$1"
+ enewuser "$1" -1 -1 -1 "$1"
+ }
+
+ enewgroup input
+ enewgroup systemd-journal
+ newusergroup systemd-bus-proxy
+ newusergroup systemd-coredump
+ newusergroup systemd-journal-gateway
+ newusergroup systemd-journal-remote
+ newusergroup systemd-journal-upload
+ newusergroup systemd-network
+ newusergroup systemd-resolve
+ newusergroup systemd-timesync
+
+ systemd_update_catalog
+
+ # Keep this here in case the database format changes so it gets updated
+ # when required. Despite that this file is owned by sys-apps/hwids.
+ if has_version "sys-apps/hwids[udev]"; then
+ udevadm hwdb --update --root="${ROOT%/}"
+ fi
+
+ udev_reload || FAIL=1
+
+ # Bug 465468, make sure locales are respect, and ensure consistency
+ # between OpenRC & systemd
+ migrate_locale
+
+ if [[ ${FAIL} ]]; then
+ eerror "One of the postinst commands failed. Please check the postinst output"
+ eerror "for errors. You may need to clean up your system and/or try installing"
+ eerror "systemd again."
+ eerror
+ fi
+
+ if [[ $(readlink "${ROOT}"etc/resolv.conf) == */run/systemd/* ]]; then
+ ewarn "You should replace the resolv.conf symlink:"
+ ewarn "ln -snf ${ROOTPREFIX-/usr}/lib/systemd/resolv.conf ${ROOT}etc/resolv.conf"
+ fi
+}
+
+pkg_prerm() {
+ # If removing systemd completely, remove the catalog database.
+ if [[ ! ${REPLACED_BY_VERSION} ]]; then
+ rm -f -v "${EROOT}"/var/lib/systemd/catalog/database
+ fi
+}