linux-kernel - [PATCH v2 1/2] kbuild: deb-pkg: use Debian compliant shebang for debian/rules

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230801121926.1677205-1-masahiroy@kernel.org>
Date:   Tue,  1 Aug 2023 21:19:25 +0900
From:   Masahiro Yamada <masahiroy@...nel.org>
To:     linux-kbuild@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Ben Hutchings <ben@...adent.org.uk>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Nicolas Schier <nicolas@...sle.eu>
Subject: [PATCH v2 1/2] kbuild: deb-pkg: use Debian compliant shebang for debian/rules

Debian Policy "4.9. Main building script: debian/rules" requires
"debian/rules must start with the line #!/usr/bin/make -f". [1]

Currently, Kbuild does not follow this policy.

When Kbuild generates debian/rules, "#!$(command -v $MAKE) -f" is
expanded by shell. The resuling string may not be "#!/usr/bin/make -f".

There was a reason to opt out the Debian policy.

If you run '/path/to/my/custom/make deb-pkg', debian/rules must also be
invoked by the same Make program. If #!/usr/bin/make were hard-coded in
debian/rules, the sub-make would be executed by a possibly different
Make version.

This is problematic due to the MAKEFLAGS incompatibility, especially the
job server flag. Old Make versions used --jobserver-fds to propagate job
server file descriptors, but Make >= 4.2 uses --jobserver-auth. The flag
disagreement between the parent/child Makes would result in a process
fork explosion.

However, having a non-standard path in the shebang causes another issue;
the generated source package is not portable as such a path does not
exist in other build environments.

This commit solves those conflicting demands.

Hard-code '#!/usr/bin/make -f' in debian/rules to create a portable and
Debian-compliant source package.

Pass '--rules-file=$(MAKE) -f debian/rules' when dpkg-buildpackage is
invoked from Makefile so that debian/rules is executed by the same Make
program as used to start Kbuild.

[1] https://www.debian.org/doc/debian-policy/ch-source.html#main-building-script-debian-rules

Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>
---

(no changes since v1)

 scripts/Makefile.package | 2 +-
 scripts/package/mkdebian | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Makefile.package b/scripts/Makefile.package
index 85beab0363d7..f8a948ec2c6b 100644
--- a/scripts/Makefile.package
+++ b/scripts/Makefile.package
@@ -148,7 +148,7 @@ deb-pkg srcdeb-pkg bindeb-pkg:
 	$(if $(findstring source, $(build-type)), \
 		--unsigned-source --compression=$(KDEB_SOURCE_COMPRESS)) \
 	$(if $(findstring binary, $(build-type)), \
-		-r$(KBUILD_PKG_ROOTCMD) -a$$(cat debian/arch), \
+		--rules-file='$(MAKE) -f debian/rules' -r$(KBUILD_PKG_ROOTCMD) -a$$(cat debian/arch), \
 		--no-check-builddeps) \
 	$(DPKG_FLAGS))

diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
index 9105abab9728..2829f5b8aea6 100755
--- a/scripts/package/mkdebian
+++ b/scripts/package/mkdebian
@@ -264,7 +264,7 @@ EOF
 fi

 cat <<EOF > debian/rules
-#!$(command -v $MAKE) -f
+#!/usr/bin/make -f

 srctree ?= .
 KERNELRELEASE = ${KERNELRELEASE}
-- 
2.39.2