[rpms/criu] f44: Fix rseq build failure with latest glibc in rawhide

[Adrian Reber <adrian@lisas.de>]

            A new commit has been pushed.

            Repo   : rpms/criu
            Branch : f44
            Commit : 12ddfeab47d329eb37e8d7f31f97cde574930c00
            Author : Adrian Reber <adrian@lisas.de>
            Date   : 2026-03-03T10:43:06+01:00
            Stats  : +97/-16 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/criu/c/12ddfeab47d329eb37e8d7f31f97cde574930c00?branch=f44

            Log:
            Fix rseq build failure with latest glibc in rawhide

Add patch to use kernel rseq.h when glibc detects it.
Recent glibc conditionally includes linux/rseq.h when
__GLIBC_HAVE_KERNEL_RSEQ is defined, conflicting with
CRIU's own copy. The patch checks for this define and
includes the kernel header directly when available.

Also re-enable binary hardening flags for the main criu
binary via an ld wrapper that strips gcc-only -specs=
options for direct ld calls, based on:
https://gitlab.com/redhat/centos-stream/rpms/criu/-/commit/4c6f4911a0497400a170c371614963dc80001689

Generated with Claude Code (https://claude.ai/code)

Signed-off-by: Adrian Reber <adrian@lisas.de>

---
diff --git a/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch b/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch
new file mode 100644
index 0000000..0bed5af
--- /dev/null
+++ b/0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch
@@ -0,0 +1,56 @@
+From 95531dcc36c2453b9242e0de17b8fedb20ce48ca Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Tue, 3 Mar 2026 06:29:53 +0000
+Subject: [PATCH] rseq: use kernel rseq.h when glibc detects it
+
+Compilation fails with the latest glibc-devel in Fedora rawhide.
+Recent glibc conditionally includes the kernel's linux/rseq.h
+when __GLIBC_HAVE_KERNEL_RSEQ is defined, but CRIU's own copy
+of the rseq definitions does not account for this and conflicts
+with the kernel header which has additional information.
+
+Check if __GLIBC_HAVE_KERNEL_RSEQ is defined and if so include
+the kernel header directly using angle brackets (which bypasses
+-iquote and finds the real kernel header instead of CRIU's
+copy).  Otherwise fall back to CRIU's own definitions.
+
+Generated with Claude Code (https://claude.ai/code)
+
+Signed-off-by: Adrian Reber <areber@redhat.com>
+---
+ criu/include/linux/rseq.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/criu/include/linux/rseq.h b/criu/include/linux/rseq.h
+index 5ceefbf8e..d7f81e9a2 100644
+--- a/criu/include/linux/rseq.h
++++ b/criu/include/linux/rseq.h
+@@ -14,6 +14,16 @@
+ 
+ #include "common/config.h"
+ 
++/*
++ * If glibc detected that the kernel rseq.h header exists, include
++ * it directly using angle brackets (which bypasses -iquote and finds
++ * the real kernel header).  Otherwise fall back to our own copy of
++ * the definitions.
++ */
++#ifdef __GLIBC_HAVE_KERNEL_RSEQ
++#include <linux/rseq.h>
++#else /* !__GLIBC_HAVE_KERNEL_RSEQ */
++
+ #ifdef CONFIG_HAS_NO_LIBC_RSEQ_DEFS
+ /*
+  * linux/rseq.h
+@@ -45,6 +55,8 @@ enum rseq_cs_flags {
+ };
+ #endif /* CONFIG_HAS_NO_LIBC_RSEQ_DEFS */
+ 
++#endif /* !__GLIBC_HAVE_KERNEL_RSEQ */
++
+ /*
+  * Let's use our own definition of struct rseq_cs because some distros
+  * (for example Mariner GNU/Linux) declares this structure their-own way.
+-- 
+2.51.1
+

diff --git a/criu.spec b/criu.spec
index 7ca32e5..e37ceb3 100644
--- a/criu.spec
+++ b/criu.spec
@@ -1,22 +1,24 @@
 %global py_prefix python3
 %global py_binary %{py_prefix}
 
-# With annobin enabled, CRIU does not work anymore. It seems CRIU's
-# parasite code breaks if annobin is enabled.
+# CRIU's parasite/restorer code (criu/pie/) is compiled with its own CFLAGS
+# that already disable hardening (-fno-stack-protector, -U_FORTIFY_SOURCE,
+# -D_FORTIFY_SOURCE=0, -nostdlib). Standard RHEL hardening flags (PIE, RELRO,
+# FORTIFY_SOURCE, stack protector) only affect the main criu binary and libs.
+#
+# Annobin remains disabled because its instrumentation gets injected into
+# every compilation unit including parasite code, and there is no per-target
+# way to exclude it through the Makefile.
 %undefine _annotated_build
 
-# Disable automatic call to the set_build_flags macro
-# at the beginning of the build, check, and install.
-# This change was introduced in Fedora 36.
-%undefine _auto_set_build_flags
-
 Name: criu
 Version: 4.2
-Release: 13%{?dist}
+Release: 15%{?dist}
 Summary: Tool for Checkpoint/Restore in User-space
 License: GPL-2.0-only AND LGPL-2.1-only AND MIT
 URL: http://criu.org/
 Source0: https://github.com/checkpoint-restore/criu/archive/v%{version}/criu-%{version}.tar.gz
+Patch0: 0001-rseq-use-kernel-rseq.h-when-glibc-detects-it.patch
 
 # Add protobuf-c as a dependency.
 # We use this patch because the protobuf-c package name
@@ -113,6 +115,7 @@ This script can help to workaround the so called "PID mismatch" problem.
 
 %prep
 %setup -q
+%patch -P 0 -p1
 %patch -P 99 -p1
 
 %build
@@ -120,21 +123,37 @@ This script can help to workaround the so called "PID mismatch" problem.
 # that is fixed, disable LTO.
 %define _lto_cflags %{nil}
 
+# CRIU's nmk build system calls ld directly for intermediate partial linking
+# (ld -r). RHEL LDFLAGS contain -specs= options that only gcc understands;
+# raw ld rejects them. Create a wrapper that strips -specs= for direct ld
+# calls. The final criu binary link uses gcc (CC), not ld, so it still gets
+# full hardening (-pie, -z relro, -z now) from the spec files.
+mkdir -p %{_builddir}/bin
+cat > %{_builddir}/bin/ld << 'LDWRAPPER'
+#!/bin/sh
+for arg do
+  shift
+  case "$arg" in -specs=*) continue ;; esac
+  set -- "$@" "$arg"
+done
+exec /usr/bin/ld "$@"
+LDWRAPPER
+chmod +x %{_builddir}/bin/ld
+
 # %{?_smp_mflags} does not work
-# -fstack-protector breaks build
-CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES
+CFLAGS+="%{optflags}" make V=1 WERROR=0 LD=%{_builddir}/bin/ld PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES
 make V=1 WERROR=0 PREFIX=%{_prefix} PLUGINDIR=%{_libdir}/criu amdgpu_plugin
 make docs V=1
 
 
 %install
 sed -e "s,--upgrade --ignore-installed,--no-index --no-deps -v --no-build-isolation,g" -i lib/Makefile -i crit/Makefile
-make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir}
-make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
-make install-amdgpu_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
-make install-cuda_plugin DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
-make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}  BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
-make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+make install-criu LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir}
+make install-lib LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
+make install-amdgpu_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
+make install-cuda_plugin LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PLUGINDIR=%{_libdir}/criu
+make install-crit LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}  BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
+make install-man LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
 rm -f $RPM_BUILD_ROOT%{_mandir}/man1/compel.1
 
 mkdir -p %{buildroot}%{_tmpfilesdir}
@@ -185,6 +204,12 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a
 %tmpfiles_create %{name}.conf
 
 %changelog
+* Tue Mar 03 2026 Adrian Reber <areber@redhat.com> - 4.2-15
+- Fix rseq build failure with latest glibc in rawhide
+
+* Mon Mar 02 2026 Christopher Lusk <clusk@redhat.com> - 4.2-14
+- Re-enable binary hardening flags for main binary
+
 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.2-13
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild