summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
Commit message (Collapse)AuthorAgeFilesLines
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.10kirkstone-4.0.10Steve Sakoman2023-05-121-1/+1
| | | | | | (From OE-Core rev: d2713785f9cd2d58731df877bc8b7bcc71b6c8e6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2023-28484 and CVE-2023-29469Peter Marko2023-05-123-0/+123
| | | | | | | | | | | Backports from: * https://gitlab.gnome.org/GNOME/libxml2/-/commit/e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68 * https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df (From OE-Core rev: 7d03d5dbc98aa701869c73c1c55a5868c70c5287) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.35 branch updates.Deepthi Hemraj2023-05-031-1/+1
| | | | | | | | | | | | | | | | | | | Below commits on glibc-2.35 stable branch are updated. 1c7f51c75a x86_64: Fix asm constraints in feraiseexcept (bug 30305) 8d07e65d15 gshadow: Matching sgetsgent, sgetsgent_r ERANGE handling (bug 30151) b7cc55a24e x86: Check minimum/maximum of non_temporal_threshold [BZ #29953] 3f63f9dfe1 stdlib: Undo post review change to 16adc58e73f3 [BZ #27749] 757d9a6306 elf: Smoke-test ldconfig -p against system /etc/ld.so.cache 416bd20b3f Use 64-bit time_t interfaces in strftime and strptime (bug 30053) ae045ed16b cdefs: Limit definition of fortification macros 6bcd5d8e36 x86: Prevent SIGSEGV in memcmp-sse2 when data is concurrently modified [BZ #29863] 82663d3c03 time: Set daylight to 1 for matching DST/offset change (bug 29951) d9923235f0 elf/tst-tlsopt-powerpc fails when compiled with -mcpu=power10 (BZ# 29776) (From OE-Core rev: 2d67702bdfc64358d364dd6484ae41842ee7c52f) Signed-off-by: Deepthi Hemraj <deepadeepthi98@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: fix wrong nobody-group assignmentPiotr Łobacz2023-03-281-1/+1
| | | | | | | | | | | | | | | | | | The generated /etc/group file had a wrong group name for nobody-group which was nobody with same id as nogroup groupd. This was leading to duplcate groups, with same ids and different names. More can be read on this link: https://bugzilla.yoctoproject.org/show_bug.cgi?id=11766 (From OE-Core rev: 08ab1f02da65ee9815115e6a1cdb51ffed10a2dc) Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d69fccf2e5d108dd7c6059310924588d36a45865) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2022-4415Peter Marko2023-03-283-0/+502
| | | | | | | | | | Backport from v250-stable branch (v250.9) (From OE-Core rev: 2e502df0610cd65c7e2897458ee8a25359614f1a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base-files: Drop localhost.localdomain from hosts fileRichard Purdie2023-03-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This was likely something we took inspiration from elsewhere with. It was added in: https://git.openembedded.org/openembedded/commit/packages/netbase/netbase/hosts?id=c8e5702127e507e82e6f68a4b8c546803accea9d in 2005. Debian added this entry around 2004 and discussed and dropped it in 2005: https://lists.debian.org/debian-devel/2005/10/msg00559.html resulting in: https://salsa.debian.org/installer-team/netcfg/-/commit/3c15ee521b2b8f47b34ccc7f610523cd284f2221 We should drop this for some of the reasons in those threads, it doesn't seem to be doing anything too helpful and isn't what most applications expect. (From OE-Core rev: 7df46e003ea76cf7d5b7263f23bd6e6a781bd22c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e730d005fa8aec07f9ae25c58d4566eaa92a6997) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: Handle spaces within user $PATHKenfe-Mickael Laventure2023-03-231-1/+1
| | | | | | | | | | | | | | | The environment-setup script generated by the recipe was not quoting the user existing PATH when updating it causing the export command to fail. Add necessary double quotes around $PATH. (From OE-Core rev: c9bf05d819fc27cb2943d138e2376b69140727b4) Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2d4c032bf3187aaa953a0c33a999074e695f54bb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Add missing binutils dependencyRichard Purdie2023-03-231-1/+3
| | | | | | | | | | | | | | | | | | glibc has it's dependencies handled more manually due to it's place in the toolchain bootstrap. It depends upon the compiler and indirectly through that to binutils. This did mean that if binutils changes and the compiler does not, sstate and hash equivalence could mean that glibc wouldn't rebuild. Add a direct dependency on binutils that if it changes, it forces glibc to rebuild, as it should. (From OE-Core rev: de967efc52b858fd51b857d8de731692287430d7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c4a7b3decff636292f5e76e95406a22b6fe4a994) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: add group sgx to udev packagePeter Marko2023-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | >From NEWS for v250: * Device nodes for the Software Guard eXtension enclaves (sgx_vepc) are now also owned by the system group "sgx". >From NEWS for v248: * Intel SGX enclave device nodes (which expose a security feature of newer Intel CPUs) will now be owned by a new system group "sgx". Fixes following journal error entry during startup: /lib/udev/rules.d/50-udev-default.rules:43 Unknown group 'sgx', ignoring This is seen already on kirkstone. (From OE-Core rev: 3fd47697df858d4093d9cb4c6a378fc07aa4d064) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bab455cd9b1b82e778f8523a767eb281edf6689e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Security fix for CVE-2023-0687Shubham Kulkarni2023-03-202-0/+83
| | | | | | | | | | Backport from https://sourceware.org/git/?p=glibc.git;a=patch;h=801af9fafd4689337ebf27260aa115335a0cb2bc (From OE-Core rev: eadf28a0640c9b714bfa8081626641a7d3d30537) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: Fix depmod patchSaul Wold2023-03-091-1/+1
| | | | | | | | | | | | | | | | | The original patch was actually allowing .debug modules though which was in-correct. This change blocks the parsing of .debug modules (which is correct). As noted in [YOCTO #15022] this should address the empty modules.dep when using the BusyBox depmod. (From OE-Core rev: 49bddef864768bbf339513414b42a820f861bdb7) Signed-off-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 339c3c3abe8d405cfe7b3f34db9b3547bcaaf878) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: upgrade 1.14.4 -> 1.14.6Alexander Kanavin2023-03-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Denial of service fixes: • Fix an incorrect assertion that could be used to crash dbus-daemon or other users of DBusServer prior to authentication, if libdbus was compiled with assertions enabled. We recommend that production builds of dbus, for example in OS distributions, should be compiled with checks but without assertions. (dbus#421, Ralf Habacker; thanks to Evgeny Vereshchagin) Other fixes: • When connected to a dbus-broker, stop dbus-monitor from incorrectly replying to Peer method calls that were sent to the dbus-broker with a NULL destination (dbus#301, Kai A. Hiller) • Fix out-of-bounds varargs read in the dbus-daemon's config-parser. This is not attacker-triggerable and appears to be harmless in practice, but is technically undefined behaviour and is detected as such by AddressSanitizer. (dbus!357, Evgeny Vereshchagin) • Avoid a data race in multi-threaded use of DBusCounter (dbus#426, Ralf Habacker) • Fix a crash with some glibc versions when non-auditable SELinux events are logged (dbus!386, Jeremi Piotrowski) • If dbus_message_demarshal() runs out of memory while validating a message, report it as NoMemory rather than InvalidArgs (dbus#420, Simon McVittie) • Use C11 _Alignof if available, for better standards-compliance (dbus!389, Khem Raj) • Stop including an outdated copy of pkg.m4 in the git tree (dbus!365, Simon McVittie) • Documentation: · Consistently use Gitlab bug reporting URL (dbus!372, Marco Trevisan) • Tests fixes: · Fix the test-apparmor-activation test after dbus#416 (dbus!380, Dave Jones) Internal changes: • Fix CI builds with recent git versions (dbus#447, Simon McVittie) (From OE-Core rev: be5d5919242d6d26bdb1e70b83aab88949ffe0eb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 31245df3061c1a913bffe5e11ad6ac7fa9c83915) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 83e9bd1507fd5f79c680dde30b0f66df84cde6b0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.8kirkstone-4.0.8Richard Purdie2023-02-271-1/+1
| | | | | | (From OE-Core rev: b20e2134daec33fbb8ce358d984751d887752bd5) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: set pkg-config search pathRoss Burton2023-02-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | The buildtools-tarball includes a native sysroot with .pc files, and in the case of buildtools-extended-tarball a pkg-config binary too. If we're using the host pkg-config then it doesn't know to search in the native sysroot. If we're using our pkg-config then it searches in the build-time prefix and not the actual SDK installation location. Neither of these are correct, so set PKG_CONFIG_LIBDIR to search: - The native sysroot - The host pkg-config's default search path, if present - Falling back to /usr/lib/pkgconfig, if not In an ideal world this would be handled by the generic toolchain script, but that is slightly more involved. [ YOCTO #15007 ] (From OE-Core rev: 9a110453f6b4b2c2d86af4ae20860037796a284d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8f768a3f4c7ff477e994d60800e5a1b83891615a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to kirkstone head revisionRichard Purdie2023-01-301-1/+1
| | | | | | (From OE-Core rev: a8c82902384f7430519a31732a4bb631f21693ac) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: rm temporary files if do_compile was interruptedAntonin Godard2023-01-261-0/+3
| | | | | | | | | | | | To avoid working with undeterministic config files, remove all the temporary files to start from scratch. (From OE-Core rev: a1cd0c804b974ae100cfe8cb34ddd400e3c8206b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 74cd440c4e3df0ed3b81cf5c60a3f92e0dd3fe6c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: always start do_compile with orig config filesAntonin Godard2023-01-261-8/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiling busybox a second time (e.g. with `compile -f`), busybox can use an altered autoconf.h file for compiling, which can ultimately produces different and unwanted binaries. This can produce errors like this one: ERROR: busybox-1.35.0-r0 do_package: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:ptest_update_alternatives(d) 0003: File: '…/poky/meta/classes/ptest.bbclass', lineno: 100, function: ptest_update_alternatives 0096: for alt_name, alt_link, alt_target, _ in alternatives: 0097: # Some alternatives are for man pages, 0098: # check if the alternative is in PATH 0099: if os.path.dirname(alt_link) in bin_paths: *** 0100: os.symlink(alt_target, os.path.join(ptest_bindir, alt_name)) 0101:} 0102: 0103:do_configure_ptest_base[dirs] = "${B}" 0104:do_compile_ptest_base[dirs] = "${B}" Exception: FileExistsError: [Errno 17] File exists: '/bin/busybox.suid' -> '…/busybox/1.35.0-r0/package/usr/lib/busybox/ptest/bin/login' This happens because ALTERNATIVE:busybox contains `/bin/login` twice, initially that's because `/bin/login` is present in both busybox.links.suid and busybox.links.nosuid. The reason for that is because of the altered autoconf.h. Steps to reproduce above error: <add ptest to distro configs> bitbake busybox -c clean bitbake busybox -c package -f bitbake busybox -c compile -f bitbake busybox -c package -f This patch guards against potential bugs by: - making a backup of .config and autoconf.h that have matching timestamps. - make sure do_compile always starts with these files. - restore .config and autoconf.h at the end of do_compile. (From OE-Core rev: 7e94d0563fadb858aca60d1b1cc3a23e995a500d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6b4a0f063edcfe0a5a4f418842e86ac0c46d9cad) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: show IP on failureRoss Burton2023-01-261-1/+4
| | | | | | | | | | | | | | | | | We get random SSL failures when fetching the CVE database, and it's notable that the NVD server is behind a DNS round-robin or geographically diverse servers. On a hunch that there is one misconfigured server, dump the IP that we connected to. (From OE-Core rev: 99f1a8971192f85fefad3cbc993b23a59627eb4c) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91f46d431dc8f40e8c6475c800bb61cb08b82b0a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: avoid incomplete updatesMarta Rybczynska2023-01-261-22/+61
| | | | | | | | | | | | | | | | | | | | | The database update has been done on the original file. In case of network connection issues, temporary outage of the NVD server or a similar situation, the function could exit with incomplete data in the database. This patch solves the issue by performing the update on a copy of the database. It replaces the main one only if the whole update was successful. See https://bugzilla.yoctoproject.org/show_bug.cgi?id=14929 Reported-by: Alberto Pianon <alberto@pianon.eu> (From OE-Core rev: 878988a67b488a01f53658bcc528b5d0422672ae) Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8efe99214d8b005f0ecac690ce5ba17b31758f92) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: stable 2.35 branch updates.Yash Shinde2023-01-261-1/+1
| | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.35 stable branch are updated. 293211b6fd time: Use 64 bit time on tzfile 26c8278889 nscd: Use 64 bit time_t on libc nscd routines (BZ# 29402) f75f61b659 nis: Build libnsl with 64 bit time_t ca97201c24 Apply asm redirections in syslog.h before first use [BZ #27087] cad7947db7 elf: Fix wrong fscanf usage on tst-pldd e9eb987894 Allow for unpriviledged nested containers 2636fbb7ef elf: Fix wrong fscanf usage on tst-pldd e7019eeeb5 x86: Fix wcsnlen-avx2 page cross length comparison [BZ #29591] fb73a40981 elf: Fix rtld-audit trampoline for aarch64 (From OE-Core rev: 4db5727a0b44d471382c95c3897b68af5ab1a3b4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: backport another change from v252 to fix build with ↵Martin Jansa2023-01-152-0/+61
| | | | | | | | | | | | | | | | | | | | CVE-2022-45873.patch * CVE-2022-45873.patch was backported from systemd/main, but it doesn't build without another change from v252 when elfutils PACKAGECONFIG is enabled. * fixes: | ../git/src/shared/elf-util.c: In function 'parse_elf_object': | ../git/src/shared/elf-util.c:792:27: error: void value not ignored as it ought to be | 792 | r = json_variant_dump(package_metadata, JSON_FORMAT_FLUSH, json_out, NULL); | | ^ (From OE-Core rev: bc8501a5a2ffc5673bad50f744d78822525bea9d) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: CVE-2022-45873 deadlock in systemd-coredump via a crash with a long ↵Hitendra Prajapati2023-01-152-0/+125
| | | | | | | | | | | | backtrace Upstream-Status: Backport from https://github.com/systemd/systemd/commit/076b807be472630692c5348c60d0c2b7b28ad437 (From OE-Core rev: 447d514037a234f181dbeca1a6e4af484461c9b6) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: fix test data checksumsMartin Jansa2023-01-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | * switch from tar.gz to tar, because the tar.gz archives upstream are regular tar as well now https://www.w3.org/XML/Test/ still has 3 separate URLs for .zip, .tar and .tar.gz, but both tar links return the same file: xmlts20080827.tar: POSIX tar archive (GNU) xmlts20080827.tar.gz: POSIX tar archive (GNU) -rw-r--r-- 1 martin martin 5.7M Sep 1 2008 xmlts20080827.tar -rw-r--r-- 1 martin martin 5.7M Sep 1 2008 xmlts20080827.tar.gz 9b2c865aba66c6429ca301a7ef048d7eca2cdb7a9106184416710853c7b37d0d xmlts20080827.tar 9b2c865aba66c6429ca301a7ef048d7eca2cdb7a9106184416710853c7b37d0d xmlts20080827.tar.gz 96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c209286c03e9cc7 /OE/build/downloads/xmlts20080827.tar.gz (From OE-Core rev: 55f37f90dc2039fda085c66bb8c6095374b2947f) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxcrypt-compat: upgrade 4.4.30 -> 4.4.33Wang Mingyu2022-12-232-1/+1
| | | | | | | | | | | | | | | | | Changelog: ========== * Fix -Werror=sign-conversion in lib/alg-yescrypt-platform.c. With commit 894aee75433b4dc8d9724b126da6e79fa5f6814b we introduced some changes to huge page handling, that show this error when building with GCC v12.2.1, and thus need a small fix. (From OE-Core rev: fbad6f482d2c3213eff12bda4020d14bbe4df288) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6918477ad121f9c7335c661433a909e948f66d51) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: Add missing CVE product nameMathieu Dubois-Briand2022-12-231-0/+2
| | | | | | | | | | (From OE-Core rev: 655fc82974478b5986dc58f898d818bba692c2c6) Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 67b2db202834f1213bed3580badda2a67655ab7d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Fix CVE-2022-40303 && CVE-2022-40304Hitendra Prajapati2022-12-233-0/+732
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0 && https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b (From OE-Core rev: b46d0b7a599ee5d3009cca302ad5322d64eb94b9) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.6kirkstone-4.0.6Richard Purdie2022-12-131-1/+1
| | | | | | (From OE-Core rev: 45a8b4101b14453aa3020d3f2b8a76b4dc0ae3f2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* psplash: consider the situation of psplash not exist for systemdChen Qi2022-12-132-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | In current psplash framework, the psplash might not exist at all. For example, in case DSITRO is set to nodistro, the psplash does not exist. In our psplash recipe, we have: SPLASH_IMAGES = "file://psplash-poky-img.h;outsuffix=default" This variable is parsed to if psplash-poky-img.h exists, a package named psplash-default is created and is added to RDEPENDS:${PN}. We can see that the psplash-poky-img.h resides in meta-poky, and in psplash_git.bbappend file in meta-poky, we have: FILESEXTRAPATHS:prepend:poky := "${THISDIR}/files:" So this file is only available in case poky distro is used. To fix this issue, add condition check in the corresponding systemd services. (From OE-Core rev: c1d57880c786b3650f29afb89530941797e85560) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7a62ff9ed39c179d2b9b0c40f4f8423ced413063) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: upgrade 1.14.0 -> 1.14.4Xiangyu Chen2022-12-074-262/+4
| | | | | | | | | | | | | | | | | | | | License-Update: D-Bus changed to dbus. 1.14.4 has contians following CVEs, removing local patches: CVE-2022-42012: 0001-dbus-marshal-byteswap-Byte-swap-Unix-fd-indexes-if-n.patch [https://github.com/freedesktop/dbus/commit/3fb065b0752db1e298e4ada52cf4adc414f5e946] CVE-2022-42011: 0001-dbus-marshal-validate-Validate-length-of-arrays-of-f.patch [https://github.com/freedesktop/dbus/commit/b9e6a7523085a2cfceaffca7ba1ab4251f12a984] CVE-2022-42010: 0001-dbus-marshal-validate-Check-brackets-in-signature-ne.patch [https://github.com/freedesktop/dbus/commit/3e53a785dee8d1432156188a2c4260e4cbc78c4d] (From OE-Core rev: 300216ca357ae58fbe52e49c76832b66f15c6c13) Signed-off-by: Xiangyu Chen <xiangyu.chen@eng.windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dropbear: fix CVE-2021-36369Chee Yang Lee2022-12-072-1/+148
| | | | | | | | (From OE-Core rev: 212dd2ce833aaf7f19111e95fbc22fc8c6d63db4) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: add group render to udev packagePeter Marko2022-12-011-0/+2
| | | | | | | | | | | | | | | | | | | | From NEWS for v236: * The "uaccess" udev tag has been dropped from /dev/kvm and /dev/dri/renderD*. These devices now have the 0666 permissions by default (but this may be changed at build-time). /dev/dri/renderD* will now be owned by the "render" group along with /dev/kfd. Without the group systemd-udevd startup logs: /lib/udev/rules.d/50-udev-default.rules:39 Unknown group 'render', ignoring /lib/udev/rules.d/50-udev-default.rules:40 Unknown group 'render', ignoring (From OE-Core rev: f902338f312cf5c55b2857e5c7e980cb11a26a9c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 84efd72d48616405dbe4d73ec95917077144ed09) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Consider PACKAGECONFIG in RRECOMMENDSNiko Mauno2022-11-241-2/+2
| | | | | | | | | | | | | | | Since RRECOMMENDS declaration implictly induces building the recipes that provide the runtime recommended packages, conditionalize adding such values according to associated PACKAGECONFIG settings in order to avoid redundant building. (From OE-Core rev: 41ecfff7a413fff178364d67c1bf96c8e6d31c30) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit a1989add927f7805378fe4d5afbde780b747ba77) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ovmf: correct patches statusAlexander Kanavin2022-11-242-2/+7
| | | | | | | | | | | (From OE-Core rev: 80280e06923b4adcf56d0726311da8d68f51ac57) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0f758719ad26fd7b23bbf21a37375f8de7068f0e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc-locale: Do not INHIBIT_DEFAULT_DEPSNathan Rossi2022-11-241-8/+3
| | | | | | | | | | | | | | | | | | | | | | | The glibc-locale recipe already partially depends on the base depends in order to satisfy the do_package dependency on binutils. However since commit d6ffd683bf6 NM has defaulted to gcc-nm, meaning do_package depends on gcc (for minidebuginfo). Whilst the do_package task could handle having the dependencies explicitly defined (either in glibc-locale or in package.bbclass), setting these would require some amount of conditional dependency configuration (cross/crosssdk/etc.). Since both binutils and gcc are already dependencies of virtual/libc (although compilerlibs is not), having glibc-locale not inhibit the default depends simplifies the handling of this situation for both glibc-locale and package.bbclass. (From OE-Core rev: 97020ee9912663196a7e8a524a23b0b70d8cf686) Signed-off-by: Nathan Rossi <nathan.rossi@digi.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 8a40d0a6039e87a5b4b26a0e84dd797fe5c75cba) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxcrypt: upgrade 4.4.28 -> 4.4.30Wang Mingyu2022-11-243-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== * configure: Restore ucontext api functionality check. In c3f01c72b303cbbb0cc8983120677edee2f3fa4b the use of the ucontext api in the main program was removed, and with it the configure check for it. However, the ucontext api is still used in the "explicit_bzero" test and thus this test still needs to be in place. See also: https://bugs.gentoo.org/838172 * configure: Restore the functionality of the '--disable-symvers' switch. Without this fix the build was simply broken, if symbol versioning was disabled for any reason, e.g. whether the compiler nor the linker supporting it, or if disabled on purpose by the user (issue #142). * Fix variable name in crypt(3) for a datamember of 'struct crypt_data' (issue #153). * Add glibc-on-loongarch-lp64 (Loongson LA464 / LA664) entry to libcrypt.minver. This was added in GNU libc 2.36. (From OE-Core rev: 061a969a6d7a8d3a7009190a18c1564cae4ad990) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7da5dd3b43718b876645602b1a23c739cbe8016d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: upgrade to 2.5.0Ross Burton2022-11-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release 2.5.0 Tue October 25 2022 Security fixes: #616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager destruction of a shared DTD in function XML_ExternalEntityParserCreate in out-of-memory situations. Expected impact is denial of service or potentially arbitrary code execution. Bug fixes: #612 #645 Fix curruption from undefined entities #613 #654 Fix case when parsing was suspended while processing nested entities #616 #652 #653 Stop leaking opening tag bindings after a closing tag mismatch error where a parser is reset through XML_ParserReset and then reused to parse #656 CMake: Fix generation of pkg-config file #658 MinGW|CMake: Fix static library name Other changes: #663 Protect header expat_config.h from multiple inclusion #666 examples: Make use of XML_GetBuffer and be more consistent across examples #648 Address compiler warnings #667 #668 Version info bumped from 9:9:8 to 9:10:8; see https://verbump.de/ for what these numbers do Includes a fix for CVE-2022-43680. (From OE-Core rev: 8dda30a9c64a4ad1f8eee11deb2e5143ba5fd719) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a257a674272dc638f09167e9b9202adfb477ef1e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "expat: backport the fix for CVE-2022-43680"Steve Sakoman2022-11-242-34/+0
| | | | | | | | Prepare for version bump which includes this fix This reverts commit 791fe354e5887af3fa3d3f772fafacc5eaedca21. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: CVE-2022-3821 Fix buffer overrunHitendra Prajapati2022-11-242-0/+46
| | | | | | | | | | | | Upstream-Status: Backport from https://github.com/systemd/systemd-stable/commit/72d4c15a946d20143cd4c6783c802124bc894dc7 Affects "systemd <= 251" (From OE-Core rev: 4a29ef039897e2d45e5c0b7416ce30a22b668453) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: fix CVE-2022-42012 dbus-marshal-byteswap: Byte-swap Unix fd indexes if ↵Xiangyu Chen2022-11-242-0/+77
| | | | | | | | | | | | | | | needed Backport a patch from upstream [1] to fix CVE-2022-42012 dbus-marshal-byteswap: Byte-swap Unix fd indexes if needed [1] https://gitlab.freedesktop.org/dbus/dbus/-/commit/3fb065b0752db1e298e4ada52cf4adc414f5e946 (From OE-Core rev: ad5c72d7f4c5ac2ad84eff8235d87f6c097af386) Signed-off-by: Xiangyu Chen <xiangyu.chen@eng.windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: fix CVE-2022-42011 dbus-daemon can be crashed by messages with array ↵Xiangyu Chen2022-11-242-0/+62
| | | | | | | | | | | | | length inconsistent with element type Backport a patch from upstream[1] to fix CVE-2022-42011 dbus-daemon can be crashed by messages with array length inconsistent with element type [1] https://gitlab.freedesktop.org/dbus/dbus/-/commit/b9e6a7523085a2cfceaffca7ba1ab4251f12a984 (From OE-Core rev: 5d96a3c244388623d87a2999dafaa25d0bd216b6) Signed-off-by: Xiangyu Chen <xiangyu.chen@eng.windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dbus: fix CVE-2022-42010 Check brackets in signature nest correctlyXiangyu Chen2022-11-242-0/+120
| | | | | | | | (From OE-Core rev: 901e2d7e785cfbeee6dd01146dd5185d023e70d5) Signed-off-by: Xiangyu Chen <xiangyu.chen@eng.windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildtools-tarball: export certificates to python and curlJan-Simon Moeller2022-11-091-0/+2
| | | | | | | | | | | | | | The custom path of the ca-certificates.crt within the buildtools-tarball requires more environment variables to be exported. Namely REQUESTS_CA_BUNDLE for the python requests library and CURL_CA_BUNDLE for curl. (From OE-Core rev: a38eab48fa1ccd6ae3ba0bd8ed30f5a9bdf9b661) Signed-off-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 5c249db9de8ad8cfe0996ff4fee4c575a5ff1e34) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glib-2.0: fix rare GFileInfo test case failureRoss Burton2022-11-092-0/+52
| | | | | | | | | | | | | | | | If a access or creation timestamp has 0 microseconds, then the test fails as it doesn't expect this to be a valid value. Expand a previous fix for modification times to cover these timestamps too. [ YOCTO #14373 ] (From OE-Core rev: a4e29fe2bd3f834f8253716790fbbf032aad9fcc) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 15715e6ad81c97cd50e288f3745615eb19be90d1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* psplash: add psplash-default in rdependsThomas Perrot2022-11-091-1/+1
| | | | | | | | | | | | | | Otherwise when the installation of recommended packages is prevented (NO_RECOMMENDATIONS = "1"), then splash screen will not be cast. (From OE-Core rev: 15342afa50de81bb882bc879892efa6ba63e75ff) Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2a0928532b8303858980d6df6271669dbb69e224) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ifupdown: upgrade 0.8.37 -> 0.8.39wangmy2022-11-091-1/+1
| | | | | | | | | | (From OE-Core rev: acd017d7b7af29508212798224ba559bb47ddcae) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f0462e3336c7134aeeb2684692732c187971b330) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: add timeout to urlopen() callsFrank de Brabander2022-11-091-2/+7
| | | | | | | | | | | | | | | | | | The urlopen() call can block indefinitely under some circumstances. This can result in the bitbake process to run endlessly because of the 'do_fetch' task of cve-update-bb-native to remain active. This adds a default timeout of 60 seconds to avoid this hang, while being large enough to minimize the risk of unwanted timeouts. (From OE-Core rev: 28497b96346a669ba0ed3873cc40bc3ade611251) Signed-off-by: Frank de Brabander <debrabander@gmail.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e5f6652854f544106b40d860de2946954de642f3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: backport the fix for CVE-2022-43680Ross Burton2022-11-042-0/+34
| | | | | | | | (From OE-Core rev: 791fe354e5887af3fa3d3f772fafacc5eaedca21) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.5kirkstone-4.0.5Richard Purdie2022-10-291-1/+1
| | | | | | (From OE-Core rev: fbdf93f43ff4b876487e1f26752598ec8abcb46e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: stable 2.35 branch updates.Yash Shinde2022-10-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Below commits on glibc-2.35 stable branch are updated. 8d125a1f91 (HEAD -> release/2.35/master, origin/release/2.35/master) elf: Do not completely clear reused namespace in dlmopen (bug 29600) f8730697d2 nss: Use shared prefix in IPv4 address in tst-reload1 135c29bf9c nss: Fix tst-nss-files-hosts-long on single-stack hosts (bug 24816) 767c99850b nss: Implement --no-addrconfig option for getent bca80a916e nscd: Drop local address tuple variable [BZ #29607] 20152a849b x86-64: Require BMI1/BMI2 for AVX2 strrchr and wcsrchr implementations 02aa1f4a5b x86-64: Require BMI2 and LZCNT for AVX2 memrchr implementation c85a45acac x86-64: Require BMI2 for AVX2 (raw|w)memchr implementations 1523fbedff x86-64: Require BMI2 for AVX2 wcs(n)cmp implementations 7e1326c43a x86-64: Require BMI2 for AVX2 strncmp implementation 6260de8867 x86-64: Require BMI2 for AVX2 strcmp implementation 0161ebf15b x86-64: Require BMI2 for AVX2 str(n)casecmp implementations 97ff96b0e1 x86: include BMI1 and BMI2 in x86-64-v3 level a6d2e2c192 hppa: undef __ASSUME_SET_ROBUST_LIST 562e5b2821 hppa: Fix initialization of dp register [BZ 29635] e36aeeaf08 nptl: Add backoff mechanism to spinlock loop 4f3c6dcd20 sysdeps: Add 'get_fast_jitter' interace in fast-jitter.h a7d5383328 m68k: Enforce 4-byte alignment on internal locks (BZ #29537) dee4146cec gconv: Use 64-bit interfaces in gconv_parseconfdir (bug 29583) 6fea8e6b94 resolv: Fix building tst-resolv-invalid-cname for earlier C standards 649213ae27 nss_dns: Rewrite _nss_dns_gethostbyname4_r using current interfaces 4a214c7448 resolv: Add new tst-resolv-invalid-cname 519e1b0251 nss_dns: In gaih_getanswer_slice, skip strange aliases (bug 12154) ee74c14325 nss_dns: Rewrite getanswer_r to match getanswer_ptr (bug 12154, bug 29305) 692fc980eb nss_dns: Remove remnants of IPv6 address mapping def97e7f71 nss_dns: Rewrite _nss_dns_gethostbyaddr2_r and getanswer_ptr 51b6c3c28b nss_dns: Split getanswer_ptr from getanswer_r 492d259ebc resolv: Add DNS packet parsing helpers geared towards wire format a333ba1d50 resolv: Add internal __ns_name_length_uncompressed function d7c22ec359 resolv: Add the __ns_samebinaryname function 83b09a8e86 resolv: Add internal __res_binary_hnok function 6e56f918a8 resolv: Add tst-resolv-aliases fae10fcb3b resolv: Add tst-resolv-byaddr for testing reverse lookup d883d02008 elf: Implement force_first handling in _dl_sort_maps_dfs (bug 28937) c15c0f1985 elf: Rename _dl_sort_maps parameter from skip to force_first ff344711ea scripts/dso-ordering-test.py: Generate program run-time dependencies f4687bb416 elf: Fix hwcaps string size overestimation 55a636430b Use __ehdr_start rather than _begin in _dl_start_final 61e15f6815 elf: Run tst-audit-tlsdesc, tst-audit-tlsdesc-dlopen everywhere (From OE-Core rev: ab154b24419782bdf281d038e093003909e698fe) Signed-off-by: Yash Shinde <yashinde145@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: add openssl PACKAGECONFIGDaniel McGregor2022-10-111-0/+1
| | | | | | | | | | | | | | | | | coreutils-native will pick up openssl on the host if it's GPL compatible (version >= 3), which causes uninative failures with hosts that don't have openssl3. Add a PACKAGECONFIG entry for openssl so it can be enabled, but isn't by default. (From OE-Core rev: e728d0965d6fda8ac54e065ca7bf7eb9da9a8170) Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9859a8124a0c09ac38d476445e7df7097f41d153) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-09-27 05:00:40 +0000