On 03/17/2011 11:45 PM, Mike Frysinger wrote:
> On Thursday, March 17, 2011 19:40:31 Zac Medico wrote:
>> On 03/17/2011 03:18 PM, Mike Frysinger wrote:
>>> On Thursday, March 17, 2011 17:59:44 Kevin F. Quinn wrote:
>>>> I'd suggest doing something like:
>>>>
>>>> use hardened && elog ...
>>>>
>>>> There's an argument that it's better to make decisions according to
>>>> make.conf settings rather than the host system configuration, not
>>>> least to cater for people doing cross-builds. Assuming cross builds
>>>> work at all; I've not tried that for a long time.
>>>
>>> in general, yes. but this would have the unpleasant side effect of
>>> having IUSE=hardened show up for all packages that inherit the eclass.
>>>
>>> also, this code is run at the pkg_* stage, so it's not the normal src
>>> host feature detection. and we're talking about minor output behavior.
>>
>> I don't know the specifics of what PMS says about this, if you put
>> hardened in use.force then portage will allow you to use that flag
>> without it being in IUSE.
>
> that would require listing every package that inherits pax-utils in use.force
> too right ? doesnt sound scalable.

No, because use.force applies to all packages. I guess you were thinking
of package.use.force.

> my proposal, while certainly not perfect, attempts to take a middle ground
> without incurring too much cruft. i think i achieved that while appeasing
> most people in practice.
> -mike

Shrug, I just thought I'd mention it.
--
Thanks,
Zac

On 3/17/11 11:18 PM, Mike Frysinger wrote:
> also, this code is run at the pkg_* stage, so it's not the normal src host
> feature detection. and we're talking about minor output behavior.

Is calling pax-mark in src_compile a misuse then? At least one ebuild I
maintain does that (and at least in one case it'd have to be either in
src_compile or src_test because the test binary has to be pax-mark-ed).

By the way, what do you think about using the "hardened" USE flag to
control the elog behavior, and forcing it on the hardened profile? In my
opinion it's a bit hacky.

Would it make more sense to scan all installed files in pkg_postinst for
pax-mark-ed files, and then elog something?

Paweł Hajdan, Jr.

On Mon, Mar 21, 2011 at 8:26 AM, "Paweł Hajdan, Jr." wrote:
> On 3/17/11 11:18 PM, Mike Frysinger wrote:
>> also, this code is run at the pkg_* stage, so it's not the normal src host
>> feature detection. Â*and we're talking about minor output behavior.
>
> Is calling pax-mark in src_compile a misuse then? At least one ebuild I
> maintain does that (and at least in one case it'd have to be either in
> src_compile or src_test because the test binary has to be pax-mark-ed).

because the PaX markings live in the ELF itself, calling in src_* is
valid. i might even propose that this should be done only in src_*
steps and not the pkg_* steps. the less crap needed to execute at
pkg_* time the better.

> By the way, what do you think about using the "hardened" USE flag to
> control the elog behavior, and forcing it on the hardened profile? In my
> opinion it's a bit hacky.

not worth the time

> Would it make more sense to scan all installed files in pkg_postinst for
> pax-mark-ed files, and then elog something?

that'd work for me, and would make the output much more concise
-mike