summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* cve-check: ensure all known CVEs are in the reportRoss Burton2019-11-131-2/+7
| | | | | | | | | | | | CVEs that are whitelisted or were not vulnerable when there are version comparisons were not included in the report, so alter the logic to ensure that all relevant CVEs are in the report for completeness. (From OE-Core rev: 29d926802e7f8b4614a2dafa0af4c923912e1811) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ltp: Fix overcommit_memory failureHe Zhe2019-11-132-0/+58
| | | | | | | | | | | | | | Backport a patch from upstream to fix the following runtime failure. mem.c:814: INFO: set overcommit_memory to 0 overcommit_memory.c:213: FAIL: alloc passed, expected to fail (From OE-Core rev: 869f46863e218c2d18ae7b4c0b28775fa07ba8b8) Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mdadm: fix do_package failed when changed local.conf but not cleanedChangqing Li2019-11-131-3/+2
| | | | | | | | | | | | | | | | | | | reproduce steps: 1. add DISTRO_FEATURE_append = 'usrmerge' in local.conf 2. bitbake mdadm --success 3. remove DISTRO_FEATURE_append = 'usrmerge' from local.conf 4. bitbake mdadm -- failed when do_package it is not proper to change source Makefile during do_install by sed, fix by pass correct config to EXTRA_OEMAKE [YOCTO #13493] (From OE-Core rev: d0f285bd7d066e752b93e57b7f5468819016586f) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sudo: Fix fetching sourcesFerry Toth2019-11-131-1/+1
| | | | | | | | | | | | It looks like https://www.sudo.ws/download.html changed certificate and directory structure. This breaks fetching sources. (From OE-Core rev: f02e9f46ce54fed3c7ddfad7d1003a2fb7ba3a67) Signed-off-by: Ferry Toth <ftoth@exalondelft.nl> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* file: run test suite when building nativelyRoss Burton2019-11-131-0/+4
| | | | | | | | | | | | | As we apply the same patches to native and target builds of file, we can verify that the patches are not breaking by executing the test suite during the build of file-native. (From OE-Core rev: 4668ac8c2600fe5698f030ed1e8cba69c0989a2c) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* file: fix CVE-2019-18218Ross Burton2019-11-132-1/+57
| | | | | | | | | (From OE-Core rev: 2435c38e109cac68476ee672eca09b4cd6237ed4) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pseudo: Drop static linking to sqlite3Richard Purdie2019-11-132-19/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Back in 2010[1] we made pseudo statically link against sqlite3. Since then the world has changed, pseudo now has separate processes for the database in the server and the client and they have separate linking commands. Also, whilst there were concerns about needing specific versions of sqlite3, in the OE environment, this is always the case. [1] http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=ad0ac0ecd38fc77daf42485489fccc10a5e1e3e7 The static sqlite3-native is causing us problems, in particular: tmp/work/x86_64-linux/pseudo-native/1.9.0+gitAUTOINC+060058bb29-r0/recipe-sysroot-native/usr/lib/libsqlite3.a(sqlite3.o):(.data.rel+0xb0): undefined reference to `fcntl64' which occurs if sqlite3-native was built on a machine with glibc 2.28 or later and pseudo-native is being built on glibc before that. With dyanmical linking, libc is backwards compatible and works but with static linking it does not. There appears to be no easy way to avoid this other than adding a copy of sqlite3 into the pseudo recipe. Given the static linking doesn't seem to be required any longer due to the separate processes, drop that to fix those issues. (From OE-Core rev: 664c8f9837db7b20ff540d5f6373e4ae0f2b4b02) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsdl2: fix race when building in parallelAnuj Mittal2019-11-132-0/+46
| | | | | | | (From OE-Core rev: 4e3e8d8270f318e6384c3d9bb5f6c7503f41d736) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgcrypt: fix CVE-2019-13627Trevor Gamblin2019-11-133-0/+200
| | | | | | | | | | | Backport two fixes for CVE-2019-13627 from upstream to zeus. (From OE-Core rev: 3361760dbb46cca2e00f053286404b5df39590b3) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpam: set CVE_PRODUCTRoss Burton2019-11-131-0/+2
| | | | | | | | | | (From OE-Core rev: d764ed9515d10db636ef63e0d05ac66f2a454ad4) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: whitelist CVE-2018-13419Ross Burton2019-11-131-0/+4
| | | | | | | | | | | | | This is a memory leak that nobody else can replicate and has been rejected by upstream. (From OE-Core rev: 541ec2f0590ab1f2c0667bf36df7c4c1bb0b6a25) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* procps: whitelist CVE-2018-1121Ross Burton2019-11-131-3/+6
| | | | | | | | | | | | | | This CVE is about race conditions in 'ps' which make it unsuitable for security audits. As these race conditions are unavoidable ps shouldn't be used for security auditing, so this isn't a valid CVE. (From OE-Core rev: 16b98e759a33d9f20e5b40aa1cff5b1c27dbee9d) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpng: whitelist CVE-2019-17371Ross Burton2019-11-131-0/+3
| | | | | | | | | | | | | This is actually a memory leak in gif2png 2.x, so whitelist it in the libpng recipe. (From OE-Core rev: a10b6e0e8d4e6b5778b5ca4db60e96ea025ea475) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Upgrade 3.7.4 -> 3.7.5Adrian Bunk2019-11-134-137/+4
| | | | | | | | | | | | | Backported patch removed. 3.7.5 also includes the fix for CVE-2019-16935. (From OE-Core rev: efc4236112d599a3a39376f5a5898072061efc8d) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxslt: fix CVE-2019-18197Joe Slater2019-11-132-0/+34
| | | | | | | | | | | Use patch from upstream after 1.1.33 release. (From OE-Core rev: 27969c5987d974ff10e5d0f00415b8a8576143e0) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtiff: fix CVE-2019-17546Joe Slater2019-11-132-0/+104
| | | | | | | | | | | Apply unmodified patch from upstream. (From OE-Core rev: 6dc3813bda9aaf8eed5a5a3f74b27b6a32c9cb42) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* e2fsprogs: fix CVE-2019-5094Changqing Li2019-11-132-0/+218
| | | | | | | | (From OE-Core rev: 56f38b042d68528009283491b9d40c75f13b8f16) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: fetch2: Ensure cached url data is matched to a datastoreRichard Purdie2019-11-131-2/+2
| | | | | | | | | | | | | | | | | | | | There was a weird error in OE-Core where "devtool modify virtual/kernel" was showing basehash mismatch errors. This was due to SRCPV sometimes being: AUTOINC+b867b78b50_47b80ef7bd and sometimes AUTOINC+b867b78b50_255a750d28. The latter hash comes from KBRANCH and meant sometimes the correct branch was seen, sometimes it was not. The issue was complicated by the execution using a remote datastore over tinfoil. The problem turns out to be a fetcher caching error. If the datastore changes, the cached url data may not be valid. We therefore ensure we match cached url data against the datastore that generated it, which appears to fix this issue. (Bitbake rev: 1a79651c518abc35b99005c137ab7e82a99c75b0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mega-manual: Updated mega-manual Bitbake manual search pathScott Rifenbark2019-11-101-6/+6
| | | | | | | | | | | using ../.. instead of ../../.. Fixes [YOCTO #13553] (From yocto-docs rev: fc5a20a8c40d900a54eaaddfca482526338193dd) Signed-off-by: Scott Rifenbark <srifenbark@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: Added 3.0 migration section.Scott Rifenbark2019-11-101-48/+449
| | | | | | | (From yocto-docs rev: c247f87e657cb63c8fd6a79b38ad66affe8c52a7) Signed-off-by: Scott Rifenbark <srifenbark@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bitbake: bitbake-worker child process create group before registering ↵Ivan Efimov2019-11-071-3/+5
| | | | | | | | | | | | | | | | | | SIGTERM handler The bitbake-worker child on the SIGTERM signal handling send the SIGTERM to all processes in it's process group. In cases when the bitbake-worker child got SIGTERM after registering own SIGTERM handler and before the os.setsid() call it can send SIGTERM to unwanted processes. In the worst case during SIGTERM processing the bitbake-worker child can be in the group of the process that started BitBake itself. As a result it can kill processes that not related to BitBake at all. (Bitbake rev: 4d7017a48c17e9b64d5824c77abe94cc3ab0f579) Signed-off-by: Ivan Efimov <i.efimov@inango-systems.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* connman: mark connman-wait-online as SYSTEMD_PACKAGEAndré Draszik2019-10-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The connman-wait-online package currently isn't marked as systemd-enabled package. This means it is impossible to auto-enable the service during image creation or package installation, as no preset files and no pkg_postinst() snippet is being created. This change should have been done as part of the upgrade to v1.31 Note: connman-wait-online is needed when connman is in use in more complex network/interface setups for systemd's network-online.target to report success. systemd-networkd's systemd-networkd-wait-online.service alone doesn't work in such scenarios and simply times out, as it know nothing about the expected network/ interface configuration, meaning the target doesn't boot successfully (systemctl list-units --failed), and long delays are seen, caused by waiting for the systemd-networkd-wait-online.service timeout. (From OE-Core rev: 5607d38af39294bf97a878b414a0212278b66b2c) Signed-off-by: André Draszik <git@andred.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1a8d18eeee6dc188d8becc778bfa933031490781) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic/engine: use 'linux-swap' for swap file systemChee Yang Lee2019-10-291-1/+1
| | | | | | | | | | | | | | | | | [YOCTO #13312] see https://bugzilla.yoctoproject.org/show_bug.cgi?id=13312 wic/engine.Disk._get_part_image was looking at variable fstypes for supported fstype which is 'swap' but image build with 'linux-swap'. supported fstype should be 'linux-swap'. (From OE-Core rev: 759a37e315d72e462a617f1cda326b8f198e3d4e) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7e6da22fe4faf841bcec02e55f376b4dae04d6a8) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* util-linux: fix PKNAME name is NULL when use lsblk [LIN1019-2963]Liwei Song2019-10-292-0/+37
| | | | | | | | | | | | | PKNAME is NULL when run "lsblk -o+PKNAME /dev/sda1" backport an upstream patch to fix it. (From OE-Core rev: dba4cc01463c2edad29f6f8c854b298255cc7562) Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5a987ff5e5e333e28be44a12e729907272ea3cb) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2019-16276Chen Qi2019-10-292-0/+164
| | | | | | | | | | (From OE-Core rev: bedeecf57ebf013aa24535eaf1345c53ba22a494) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e31f87e289dfd3bbca961e927447a9c7ba816d3f) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sudo: fix CVE-2019-14287Changqing Li2019-10-293-0/+292
| | | | | | | | | | | | | | | | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. (From OE-Core rev: b7b6d39565f8fad61f2347a3fe31c9ee77a4da15) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: update dbus-1.init to reflect new PID fileTom Benn2019-10-291-2/+2
| | | | | | | | | | | | The PID file referenced in dbus-1.init script was out of date and no longer existed. This meant that dbus could not be restarted via init.d without force removing the old PID file. (From OE-Core rev: a9d3cae5668fbcae7145b8cdba786caa30b5b3d3) Signed-off-by: fridgecow <fridgecow@fb.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 2ed6f06f30cb54b9c70f1a92d93c920ec4d01ffe) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgcrypt: fix CVE-2019-12904Yi Zhao2019-10-294-0/+603
| | | | | | | | | | | | | | | | | | | | | | | In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12904 Patches from: https://github.com/gpg/libgcrypt/commit/1374254c2904ab5b18ba4a890856824a102d4705 https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762 https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020 (From OE-Core rev: 757f2d50d7cd194e5f734a24e68d8f0da98b38f8) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 37e390ff05b6a4509019db358ed496731d80cc51) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: Fix CVE-2019-10160Changqing Li2019-10-292-0/+82
| | | | | | | | | | (From OE-Core rev: 50ba17abdcc6579ce0629cf1755d45308facb768) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit b4240b585d7fcac2fdbf33a8e72d48cb732eb696) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* icecc: Export ICECC_CC and friends via wrapper-scriptDouglas Royds via Openembedded-core2019-10-291-12/+20
| | | | | | | | | | | | | | | | | | | By exporting ICECC_CC, ICECC_CXX, and ICECC_VERSION in a wrapper-script, and putting this wrapper-script in the PATH, the Makefiles generated by CMake or the autotools are able to function correctly outside of bitbake. This provides a convenient developer workflow in which the modify-compile-unittest cycle can happen directly in the ${B} directory. The `rm -f $ICE_PATH/$compiler` line is transitional, and can go at some later date (October 2020 or later, perhaps). (From OE-Core rev: 0f47d4ef50d6b0732ac40f7ede31f554a757864c) Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 40d74cb1d0ddce930267e49764cacb263b244091) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: make OPENSSL_ENGINES match install pathGeorge McCollister2019-10-291-1/+1
| | | | | | | | | | | | Set OPENSSL_ENGINES to the path where engines are actually installed. (From OE-Core rev: 4aa5d551af3d0eb800c1640c98cbd591224726f8) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 59565fec0b3f3e24eb01c03b671913599cd3134d) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Fix CVE-2019-12068Changqing Li2019-10-292-0/+109
| | | | | | | | | | (From OE-Core rev: 82c4fb091199b737722a60d517b694860b6e6ba8) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 81b375ac7851088a671317468a8e2eed69d4a827) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: -dev should depend on distutilsRoss Burton2019-10-291-1/+2
| | | | | | | | | | | | | | | | | | | | | python3-config uses distutils: Traceback (most recent call last): File "/usr/bin/python3-config", line 9, in <module> from distutils import sysconfig ModuleNotFoundError: No module named 'distutils' Add the dependency so that distutils is always present. [ YOCTO #13592 ] (From OE-Core rev: 5fae2306184023165e21a87d1cca3016ba105d5f) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 04136dbac48986dce5b2b872b2c0b46c673c44f2) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* i2c-tools: Add missing RDEPENDRicardo Ribalda Delgado2019-10-291-0/+1
| | | | | | | | | | | | | | | | | | | Fixes: # decode-dimms Can't locate Carp.pm in @INC (you may need to install the Carp module) (@INC contains: /usr/lib/perl5/site_perl/5.28.1/x86_64-linux /usr/lib/perl5/site_perl/5.28.1 /usr/lib/perl5/vendor_perl/5.28.1/x86_64-linux /usr/lib/perl5/vendor_perl/5.28.1 /usr/lib/perl5/5.28.1/x86_64-linux /usr/lib/perl5/5.28.1 .) at /usr/lib/perl5/5.28.1/Tie/Hash.pm line 190. BEGIN failed--compilation aborted at /usr/lib/perl5/5.28.1/Tie/Hash.pm line 190. Compilation failed in require at /usr/lib/perl5/5.28.1/x86_64-linux/POSIX.pm line 505. Compilation failed in require at /usr/bin/decode-dimms line 41. BEGIN failed--compilation aborted at /usr/bin/decode-dimms line 41. root@qt5222:~# apt-get install perl-module-carp (From OE-Core rev: 60ee826ec6f07b270ae77e24be0088269a93081e) Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c73d2a2c0ecc99f0d6d7e6a1861ecce7a2312a57) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* file: explicitly disable seccompRoss Burton2019-10-291-0/+2
| | | | | | | | | | | | | | | | file will automatically enable seccomp if the seccomp headers are available, but the build will fail on Opensuse Tumbleweed because the include paths are wrong. Enabling seccomp is a bad idea because it interacts badly with pseudo (causing build failures), so explicitly and globally disable seccomp. (From OE-Core rev: cbbbee1dce84d6ff62fb72282088f839cb642857) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a752faa152df031df5acaa40491299ac115109a4) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wic/rawcopy: Support files in sub-directoriesEugene Smirnov2019-10-291-0/+3
| | | | | | | | | | | | | | | | | | If the source file is located in a subdirectory of DEPLOY_DIR rawcopy will currently fail in sparse_copy function on open(dst_fname, 'wb'), as the parent directory for destination file does not exist. This patch helps to avoid that by recursively creating parent directories. (From OE-Core rev: 03796926046e5b5b57349d66de6bb009a34d2cb2) Signed-off-by: Eugene Smirnov <evgenii.smirnov@here.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 073c435644091c2801e45c6d02afa917de575082) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: fix CVE-2019-16905Hongxu Jia2019-10-292-0/+41
| | | | | | | | | | | | | Backport a patch from upstream to fix CVE-2019-16905 https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a (From OE-Core rev: e8f39536d2616ea0bb8bab459da29af63e3ee336) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8bd4b87071c073a0e4d265bc00df34684a355eff) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uninative: check .done file instead of tarballStefan Agner2019-10-291-1/+1
| | | | | | | | | | | | | | | | In case multiple builds share UNINATIVE_DLDIR's location, one build might be in the process of downloading the tarball while another is just checking whether the tarball exists. Check for the done file instead and rely on the fetchers lockfile mechanism in case two builds are running. (From OE-Core rev: 956ae2c2a72914c7e9a1d59e5906c7fc75670a39) Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a1c95580549cb4f77601e62c7f026b19c752d853) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sanity: check the format of SDK_VENDORRoss Burton2019-10-291-0/+5
| | | | | | | | | | | | | | | | | | If SDK_VENDOR isn't formatted as -foosdk and is instead for example -foo-sdk then the triple that are constructed are not in fact triples, which results in mysterious compile errors. Check in sanity.bbclass so this failure is detected early. [ YOCTO #13573 ] (From OE-Core rev: 95d3ca54453cdb0662fae2a2cf7e8173611c86f4) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b0efd8d4d0dbc30e6505b42f5603f18fa764d732) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsdl2: fix CVE-2019-13616Yi Zhao2019-10-292-0/+35
| | | | | | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-13616 Patch from: https://hg.libsdl.org/SDL/rev/e7ba650a643a (From OE-Core rev: 691f04965faf58d9d6323898478916ae306d046c) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 70b9cdf86b9c5ed14937500619387a890a57ef20) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sysstat: fix CVE-2019-16167Wenlin Kang2019-10-292-1/+49
| | | | | | | | | | | | | This commit is another part of CVE-2019-16167, please see https://github.com/sysstat/sysstat/issues/232. (From OE-Core rev: 5c11937348debf57e3a87c7c6a6c0429fd756eca) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 586c045eb81b79200b46bf743f5d3fdb5f68c12d) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ncurses: fix CVE-2019-17594, CVE-2019-17595Trevor Gamblin2019-10-292-0/+170
| | | | | | | | | | | Backport changes to tinfo/comp_hash.c, tinfo/parse_entry.c, and progs/dump_entry.c from upstream to fix CVEs. (From OE-Core rev: 7ec70aeb0c6f6080523efa0f983fa36b92cb5558) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* runqemu: Remove disabling of high resolution timerJoerg Vehlow2019-10-291-2/+2
| | | | | | | | | | | | | The option 'highres=off' sneaked itself into the runqemu script for all configurations, where the root filesystem type is not 'cpio' or 'cpio.gz'. See: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13590 (From OE-Core rev: f71b1a96529d658d1c6c7dc04dca1957ea647e4e) Signed-off-by: Joerg Vehlow <joerg.vehlow@aox-tech.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* runqemu: unset another environment variable for 'egl-headless'Alexander Kanavin2019-10-291-0/+1
| | | | | | | | | | | | | Some host distributions (opensuse for example) are using 'pkgconf', which, unlike the original pkg-config, appends PKG_CONFIG_SYSROOT_DIR to every directory from the .pc file. (From OE-Core rev: 5f51c9303940423b05ba8cfeaa1c9c2b24e36a53) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: CVE-2019-16056Chen Qi2019-10-292-0/+133
| | | | | | | | | (From OE-Core rev: b80c0a4b6821da55d2882b60d5d3e7b21d43a383) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python: CVE-2019-16056Chen Qi2019-10-292-0/+91
| | | | | | | | | (From OE-Core rev: 27be9cf71a6fe906a23e81b56f1cc18a6fc9ef97) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* aspell: fix CVE-2019-17544Trevor Gamblin2019-10-292-1/+59
| | | | | | | | | | Backport CVE-2019-17544 fix to zeus. (From OE-Core rev: 7ed241ff1f93c623a3b3030249c09f7c3c429a46) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite3: fix CVE-2019-16168Qi.Chen@windriver.com2019-10-292-1/+42
| | | | | | | | (From OE-Core rev: 948b0dd6d91eeed529c6983141ab80327fa4ae9c) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual, dev-manual: Added CMake toolchain files.Scott Rifenbark2019-10-232-3/+31
| | | | | | | | | | | | | | | Fixes [YOCTO #12760] Updated the cmake.bbclass description to tell what directory to insall custom CMake toolchain files into. Also, updated the two areas in the "Writing a New Recipe" section that mention CMake. Placed a couple notes there concerning the same directory stuff. (From yocto-docs rev: a65cd2c4c062d4ae388191b9d6708b4fadffaa3f) Signed-off-by: Scott Rifenbark <srifenbark@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-manual: Updated the BUSYBOX_SPLIT_SUID variable.Scott Rifenbark2019-10-231-2/+3
| | | | | | | | | Fixes [YOCTO #13596] (From yocto-docs rev: 015991b26ed091385cfb94f13e00c6a964c20160) Signed-off-by: Scott Rifenbark <srifenbark@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-30 07:41:08 +0000