|
|
@@ -15,6 +15,12 @@ ARG USER_NAME=coder
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
|
# Outils de base et compilation C/PDI
|
|
|
build-essential cmake git pkg-config \
|
|
|
+ gfortran \
|
|
|
+ which \
|
|
|
+ perl \
|
|
|
+ gawk \
|
|
|
+ m4 \
|
|
|
+ libatomic1 \
|
|
|
nano sudo lsof gawk emacs jq neowofetch curl wget \
|
|
|
gdb valgrind clang-format \
|
|
|
ca-certificates iputils-ping \
|
|
|
@@ -55,16 +61,15 @@ WORKDIR /tmp/julia-build
|
|
|
RUN git clone --depth 1 --branch ${JULIA_VERSION} https://github.com/JuliaLang/julia.git .
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
RUN echo "prefix=/usr/local/julia" > Make.user && \
|
|
|
echo "MARCH=x86-64" >> Make.user && \
|
|
|
- # Dit au Linker de ne pas demander de pile exécutable
|
|
|
+ echo "USE_SYSTEM_LIBUNWIND=0" >> Make.user && \
|
|
|
+# echo "USE_BINARYBUILDER=0" >> Make.user && \
|
|
|
echo "LDFLAGS=-Wl,-z,noexecstack" >> Make.user && \
|
|
|
- # Dit à l'Assembleur (GCC) de marquer le code comme safe (C'est ce qui manquait)
|
|
|
- echo "CFLAGS=-Wa,--noexecstack" >> Make.user && \
|
|
|
- echo "CXXFLAGS=-Wa,--noexecstack" >> Make.user
|
|
|
-
|
|
|
-
|
|
|
-
|
|
|
+ echo "CFLAGS=-Wa,--noexecstack -gdwarf-4" >> Make.user && \
|
|
|
+ echo "CXXFLAGS=-Wa,--noexecstack -gdwarf-4" >> Make.user
|
|
|
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
|
@@ -119,36 +124,40 @@ RUN git clone --depth 1 https://github.com/pdidev/pdi.git . && \
|
|
|
# -----------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
-RUN echo "Application du patch 'clear-execstack' sur les librairies Julia..." && \
|
|
|
- find / -name "libopenlibm.so" -exec patchelf --clear-execstack {} \; && \
|
|
|
- # On applique aussi sur libjulia-internal par sécurité
|
|
|
- find / -name "libjulia-internal.so*" -exec patchelf --clear-execstack {} \;
|
|
|
-
|
|
|
+#RUN echo "Application du patch 'clear-execstack' sur les librairies Julia..." && \
|
|
|
+# find $JULIA_PATH -name "libopenlibm.so" -exec patchelf --clear-execstack {} \; && \
|
|
|
+# # On applique aussi sur libjulia-internal par sécurité
|
|
|
+# find $JULIA_PATH -name "libjulia-internal.so*" -exec patchelf --clear-execstack {} \; && \
|
|
|
+# find $JULIA_PATH -type f -name "*.so*" -exec patchelf --clear-execstack {} \;
|
|
|
|
|
|
ENV GKSwstype=100
|
|
|
-
|
|
|
-RUN julia -e 'import Pkg; \
|
|
|
- Pkg.add([ \
|
|
|
- "HDF5", \
|
|
|
- "Plots", \
|
|
|
- "DataFrames", \
|
|
|
- "Gtk4", \
|
|
|
- "Gtk", \
|
|
|
- "ProfileView", \
|
|
|
- "PProf", \
|
|
|
- "Reexport" \
|
|
|
- ])'
|
|
|
+ENV JULIA_PKG_PRECOMPILE_AUTO=0
|
|
|
+ENV JULIA_PKG_USE_CLI_GIT=true
|
|
|
+# RUN julia -e 'import Pkg; \
|
|
|
+# Pkg.add([ \
|
|
|
+# "HDF5"])'
|
|
|
+# RUN xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24 -nolisten tcp" \
|
|
|
+# julia -e 'import Pkg; \
|
|
|
+# Pkg.add([ \
|
|
|
+# "Plots", \
|
|
|
+# "DataFrames", \
|
|
|
+# "Gtk4", \
|
|
|
+# "Gtk", \
|
|
|
+# "ProfileView", \
|
|
|
+# "PProf", \
|
|
|
+# "Reexport" \
|
|
|
+# ])'
|
|
|
|
|
|
# ÉTAPE B : ACTION CORRECTIVE CRITIQUE
|
|
|
# Pkg.add a téléchargé des artifacts (.so) qui violent la sécurité execstack.
|
|
|
# On doit les patcher AVANT que Julia ne tente de les charger pour la précompilation.
|
|
|
-RUN echo "Patching des artifacts téléchargés dans .julia..." && \
|
|
|
- find /root/.julia -name "*.so*" -exec patchelf --clear-execstack {} \;
|
|
|
+#RUN echo "Patching des artifacts téléchargés dans .julia..." && \
|
|
|
+# find /root/.julia -name "*.so*" -exec patchelf --clear-execstack {} \;
|
|
|
|
|
|
# ÉTAPE C : Précompilation (Maintenant c'est sûr)
|
|
|
# On utilise xvfb-run car Gtk/ProfileView ont besoin d'un serveur X, même virtuel.
|
|
|
-RUN xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24 -nolisten tcp" \
|
|
|
- julia -e 'import Pkg; Pkg.precompile()'
|
|
|
+#RUN xvfb-run --auto-servernum --server-args="-screen 0 1920x1080x24 -nolisten tcp" \
|
|
|
+# julia -e 'import Pkg; Pkg.precompile()'
|
|
|
# -----------------------------------------------------------------------------
|
|
|
# 5. Création de l'utilisateur (Structure décomposée conservée)
|
|
|
# -----------------------------------------------------------------------------
|