summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
Commit message (Collapse)AuthorAgeFilesLines
* dropbear: set CVE_PRODUCTChen Qi2019-11-071-0/+2
| | | | | | | | | (From OE-Core rev: 3c247a4a166cabf7ddfea403cf272b3fb4e00872) (From OE-Core rev: 52a716ed45c9b36c893b56c4f71a84769ae67878) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: fix https proxy issuesChin Huat Ang2019-11-071-11/+30
| | | | | | | | | | | | | | | | When https_proxy is set, use proxy opener to open CVE metadata and database URLs, otherwise fallback to the urllib.request.urlopen. Also fix a minor issue where the json database which has been gzip decompressed as byte object should be decoded as utf-8 string as expected by update_db. (From OE-Core rev: 95438d52b732bec217301fbfc2fb019bbc3707c8) (From OE-Core rev: 6d3222fb7ecde524c4e033729318fb0fb80a444c) Signed-off-by: Chin Huat Ang <chin.huat.ang@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: clean up JSON fetchingRoss Burton2019-11-071-17/+12
| | | | | | | | | | | | | | | Currently the code fetches the compressed JSON, writes it to a temporary file, uncompresses that with gzip and passes the fake file object to update_db(). Instead, uncompress the gzip'd data in memory and pass the JSON directly to update_db(). (From OE-Core rev: 9422745979256c442f533770203f62ec071c18fb) (From OE-Core rev: 1d34aec479156a7dadf7867bbf0d53f12d21ef3e) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: improve metadata parsingRoss Burton2019-11-071-8/+10
| | | | | | | | | | | | | | | | | | The metadata parser is fragile: first it coerces a bytes() to a str() (so the string is b'LastModifiedDate:2019...'), assumes the first line is the date, and then uses a regex to parse (which then includes the trailing quote as part of the date). Clean this up by parsing the bytes as UTF-8 (ASCII is probably fine, but this is safer), iterate through the lines and split on colons to find the right key/value pair. (From OE-Core rev: bb4e53af33d6ca1e9346464adbdc1b39c47530f3) (From OE-Core rev: c718e073e8e9cd5df9e19dd02fcac2139758b5b7) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: use executemany() to optimise CPE insertionRoss Burton2019-11-071-53/+32
| | | | | | | | | | | | Instead of calling execute() repeatedly, rewrite the function to be a generator and use executemany() for performance. (From OE-Core rev: b309840b6aa3423b909a43499356e929c8761318) (From OE-Core rev: d248ec9764d0439eb30fdb3605e9d05ee4219348) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db: actually inherit nativeRoss Burton2019-11-071-2/+1
| | | | | | | | | | | The recipe was called -native but didn't inherit native. (From OE-Core rev: f0d822fad2a163d1ee32ed3b4c0359245140e19b) (From OE-Core rev: 5eeafcb492daf63602f0e2ed4a12f755701597d7) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: use os.path.join instead of +Ross Burton2019-11-071-4/+4
| | | | | | | | | (From OE-Core rev: 4b301030cf9cf7a981dcff85a50e915c045e3130) (From OE-Core rev: 7df7cd765e67535b72cd56eb679c6f5078c08460) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: Remove hash column from database.Pierre Le Magourou2019-11-071-14/+7
| | | | | | | | | | | | | | djb2 hash algorithm was found to do collisions, so the database was sometime missing data. Remove this hash mechanism, clear and populate elements from scratch in PRODUCTS table if the current year needs an update. (From OE-Core rev: 78de2cb39d74b030cd4ec811bf6f9a6daa003d19) (From OE-Core rev: e6541c6add1714938a81cca394886893cf24cdb0) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db: Use NVD CPE data to populate PRODUCTS tablePierre Le Magourou2019-11-071-14/+74
| | | | | | | | | | | | | | | Instead of using expanded list of affected versions that is not reliable, use the 'cpe_match' node in the 'configurations' json node. For cve-check to correctly match affected CVE, the sqlite database need to contain operator_start, operator_end and the corresponding versions fields. (From OE-Core rev: f7676e9a38d595564922e5f59acbc69c2109a78f) (From OE-Core rev: 6977d15fbc3b78958768b21f6c501e7d63be9499) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db-native: use SQL placeholders instead of format stringsRoss Burton2019-11-071-1/+1
| | | | | | | | | (From OE-Core rev: 91770338f76ef35f3c4eeac216eb9d2b3188e575) (From OE-Core rev: 075683d23018760e8b2fa0b793ceacd9027e55c3) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: exclude child recipes from CVE scanningRoss Burton2019-11-073-0/+9
| | | | | | | | | | | | | | | | As glibc will be scanned for CVEs, we don't need to scan glibc-locale, glibc-mtrace, and glibc-scripts which are all separate recipes for technical reasons. Exclude the recipes by setting CVE_PRODUCT in the recipe, instead of using the global whitelist. (From OE-Core rev: 1f9a963b9ff7ebe052ba54b9fcbdf7d09478dd17) (From OE-Core rev: 2b9f1b654c726e7c7b2fe8710d60ca10212295f5) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: Depends on cve-update-db-nativePierre Le Magourou2019-11-071-0/+0
| | | | | | | | | | | | | | do_populate_cve_db is a native task. (From OE-Core rev: 4078da92b49946848cddebe1735f301af161e162) (From OE-Core rev: 5d6cbab419770eb556b57445fd5509339d3142b4) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/conf/distro/include/maintainers.inc
* cve-update-db: Catch request.urlopen errors.Pierre Le Magourou2019-11-071-9/+21
| | | | | | | | | | | | | If the NVD url is not accessible, print a warning on top of the CVE report, and continue. The database will not be fully updated, but cve_check can still run on the previous database. (From OE-Core rev: 0325dd72714f0b447558084f481b77f0ec850eed) (From OE-Core rev: ae743789d893e950583014f38f0ad246aa4fe034) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db: do_populate_cve_db depends on do_fetchPierre Le Magourou2019-11-071-8/+13
| | | | | | | | | | | | | | | | | To be able to populate NVD database on a fetchall (bitbake <image> --run-all=fetch), set the do_populate_cve_db task to be executed before do_fetch. Do not get CVE_CHECK_DB_DIR, CVE_CHECK_DB_FILE and CVE_CHECK_TMP_FILE variable because do_populate_cve_db can be called in a context where cve-check class is not loaded. (From OE-Core rev: 975793e3825a2a9ca6dc0e43577f680214cb7993) (From OE-Core rev: 5d265e84ef47ec6545eaa0fa64b16ccbb9e8a4ea) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db: Manage proxy if needed.Pierre Le Magourou2019-11-071-2/+9
| | | | | | | | | | | | If https_proxy environment variable is defined, manage proxy to be able to download meta and json data feeds from https://nvd.nist.gov (From OE-Core rev: 09be21f4d1793b1e26e78391f51bfc0a27b76deb) (From OE-Core rev: 3af4399ea35b5c4b87d656f09dd2afed11791f0a) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db: Use std library instead of urllib3Pierre Le Magourou2019-11-071-6/+4
| | | | | | | | | | | | | urllib3 was used in this recipe but it was not set as a dependency. As it is not specifically needed, rewrite the recipe with urllib from the standard library. (From OE-Core rev: c0eabd30d7b9c2517f4ec9229640be421ecc8a5e) (From OE-Core rev: bfaee04b8a7cb0fc6e149106619a01b848fd8a98) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-update-db: New recipe to update CVE databasePierre Le Magourou2019-11-071-0/+121
| | | | | | | | | | | | | | | | | | | | cve-check-tool-native do_populate_cve_db task was using deprecated NVD xml data feeds, cve-update-db uses NVD json data feeds. Sqlite database schema was updated to take into account CVSSv3 CVE scores and operator in affected product versions. A new META table was added to store the last modification date of the NVD json data feeds. (From OE-Core rev: 546d14135c50c6a571dfbf3baf6e9b22ce3d58e0) (From OE-Core rev: e344a27003cc9e39058b41c0e96463f231ebf245) Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/conf/distro/include/maintainers.inc
* build-appliance-image: Update to sumo head revisionyocto-2.5.3sumo-19.0.3Richard Purdie2019-03-271-1/+1
| | | | | | (From OE-Core rev: 0a2db923fd17019d07d88204b355aa46590f0b97) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to sumo head revisionRichard Purdie2019-03-261-1/+1
| | | | | | (From OE-Core rev: ece8242187558011940d7c6762b64c7116e38689) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: 8.29: fix native buildStefan Müller-Klieser2019-03-253-0/+382
| | | | | | | | | | | This fixes the native build on glibc 2.28 hosts, by backporting two gnulib patches from master. (From OE-Core rev: fe7c33cd470d7466be48391b11ea703746812014) Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: backport fix for issues introduced by CVE-2011-5325.patchMartin Jansa2019-03-252-0/+394
| | | | | | | | | (From OE-Core rev: d0555e89514f2641387ef061f9ffcd1c8ced008c) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Reviewed-by: Tom Rini <trini@konsulko.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2019-6454George McCollister2019-03-243-0/+273
| | | | | | | | | | | | | | | Apply patches from systemd_237-3ubuntu10.13 to fix CVE-2019-6454. CVE-2019-6454 is an issue in which systemd (PID1) can be crashed with a specially formed D-Bus message. For information see: https://usn.ubuntu.com/3891-1/ https://git.launchpad.net/ubuntu/+source/systemd/commit/?h=applied/ubuntu/bionic-updates&id=d7584b894afcaa8a4a1abb69db2a9c81a6276e80 (From OE-Core rev: 342157b135e7493e5965b706ede93bee190fbe32) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-6954George McCollister2019-03-243-0/+2473
| | | | | | | | | | | | | | | | | | | | | | | Apply patches to fix CVE-2018-6954 NVD description from https://nvd.nist.gov/vuln/detail/CVE-2018-6954 systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on. Patches from systemd_237-3ubuntu10.13.debian. These patches shouldn't be required on newer OE releases since they use systemd v239 or higher. (From OE-Core rev: 607350d98aa4c65b71fe1f10900e205fad81d1ec) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Security fix CVE-2018-16866Marcus Cooper2019-03-242-0/+50
| | | | | | | | | | | | | | Affects < v240 (From OE-Core rev: 10fa35a75617e82650b12d3e353a554f05f036dd) Signed-off-by: Marcus Cooper <marcusc@axis.com> >From v2 patch on openembedded-core@lists.openembedded.org Incresed file name number from 0026 to 0027. Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Security fix CVE-2018-16865George McCollister2019-03-243-0/+141
| | | | | | | | | | | | | | Affects < v240 Based on thud commit d5d2b821fc85b8cf39f683061ac2a45bddd2139f The second patch in the thud commit doesn't apply against 237. Use the version of the second patch CVE-2018-16865_2.patch from systemd_237-3ubuntu10.13.debian. (From OE-Core rev: da41e48567eb21a47426a6fbe23ea07ce780cd3c) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Security fix CVE-2018-16864George McCollister2019-03-242-0/+194
| | | | | | | | | | | | | | Affects < v240 Based on thud commit 403e74b07b6f3c4a2444e68c74a8434fb17aee49 The patch in the thud commit doesn't compile against 237. Use the version of this patch, CVE-2018-16864.patch from systemd_237-3ubuntu10.13.debian. (From OE-Core rev: ddbe969d0c9052a3ae17ef8f1cec8da847c722d3) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-15688Chen Qi2019-03-242-0/+40
| | | | | | | | | | | | | | | | Backport patch to fix the following CVE. CVE: CVE-2018-15688 (From OE-Core rev: d490839e881f3ff30a4bde8137cb04cb0fd37acd) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Cherry-picked from thud 13591d7224393dc0ae529a03cdf74aceb3540ce9 Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-15687George McCollister2019-03-242-0/+253
| | | | | | | | | | | | | | | | Backport patch to fix the following CVE. CVE: CVE-2018-15687 Based on thud commit eeb621aa19f690971caf862290a172a115578ba1 The patch in the thud commit doesn't compile against 237. Use the version of this patch, CVE-2018-15687.patch from systemd_237-3ubuntu10.13.debian. (From OE-Core rev: 3e8ba9af58253ed9db0f0376a8e2966e45ee089e) Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix CVE-2018-15686Chen Qi2019-03-242-0/+251
| | | | | | | | | | | | | | | | Backport patch to fix the following CVE. CVE: CVE-2018-15686 (From OE-Core rev: 06bf145cee24b677ab076498fe8399126971bc43) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Cherry-picked from thud 0ef70603bc983315eb0e8a97958d995a31198c35 Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Fix typo in root home variable.ROGEZ Matthieu2019-03-241-1/+1
| | | | | | | | | | | This regression has been introduced while upgrading to version 237 (commit 906230a73b3ccfa4afd2a19a6b0aa18cd1d5fa08) and seems to only affect sumo version. (From OE-Core rev: 665b41d326654235d305649be4be69a1be8dc00b) Signed-off-by: Matthieu Rogez <matthieu.rogez@fivesgroup.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: Put klogd/syslogd alternative links in syslog packageRichard Purdie2019-02-251-1/+4
| | | | | | | | | | | | | | | Currently these are in ${PN} and ${PN}-syslog may get replaced by other packages but update-alternatives would error in the postinst if other files were installed first. Avoid the problems by putting the links in the correct package. (From OE-Core rev: ef11c54ba99af261a70ec31091216cdd1556da24) (From OE-Core rev: a0afcd457af14c3bf3a74514be0e8a029a4fcf63) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to sumo head revisionyocto-2.5.2sumo-19.0.2Richard Purdie2018-12-051-1/+1
| | | | | | (From OE-Core rev: 6637f400fb01501353f376d73658b359cedfa3c2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: make busybox.links.{suid, nosuid} reproducibleMartin Hundebøll2018-12-051-1/+2
| | | | | | | | | | | | | | | | | | The busybox.link.* files are generated from autoconf.h and applets.h, which are both auto-generated by the build system. The contents of the two files might be in different order, and so the link files are not reproducble as is. Fix this by sorting the lists using `sort`. (From OE-Core rev: bade7cc344c2f0e9316f973c34e9c9dfcbdbe32d) (From OE-Core rev: 0f70da971e6e01ed9b669137b3ba39b1898a7dfe) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: Use double colon for chown OWNER:GROUPKosta Zertsekel2018-11-243-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Rationale - excerp from `info chown` ==================================== OWNER‘:’GROUP If the OWNER is followed by a colon and a GROUP (a group name or numeric group ID), with no spaces between them, the group ownership of the files is changed as well (to GROUP). Some older scripts may still use ‘.’ in place of the ‘:’ separator. POSIX 1003.1-2001 (*note Standards conformance::) does not require support for that, but for backward compatibility GNU ‘chown’ supports ‘.’ so long as no ambiguity results. New scripts should avoid the use of ‘.’ because it is not portable, and because it has undesirable results if the entire OWNER‘.’GROUP happens to identify a user whose name contains ‘.’. (From OE-Core rev: 185918234a07cb506d7d7464a49ac33972c7d963) (From OE-Core rev: 8105b6384042e04d8bdfaa881370616c6e46acfa) Signed-off-by: Kosta Zertsekel <zertsekel@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base-files: change permissions on /sys and /procDan McGregor2018-11-161-2/+6
| | | | | | | | | | | | | | | | | | | The kernel mounts /proc and /sys with the mode 555. Fedora explicitly sets this value in its filesystem setup package. Debian doesn't seem to set it explictly. Having them be 755 causes permission issues on upgrades inside a container where the guest does not have the permission to change the modes of the mount points. So, just bite the bullet and force them to be 555. (From OE-Core rev: 7e311b0c7222fa9127a96945c9ded7bee5e40eb3) (From OE-Core rev: 26d5ceb33425fa85bc84b825609e1b45b13d3ddd) Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* os-release: move to nonarch_libdirDan McGregor2018-11-161-4/+4
| | | | | | | | | | | | | | Even on multilib systems, /usr/lib is where systemd expects the os-release file to live. (From OE-Core rev: b7b476efee8c959a0227905e40bd9b5ef493632d) (From OE-Core rev: 0362788144c3eff36099d8812c85cc70e8736859) Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Update git.gnome.org addresses after upstream changesRichard Purdie2018-10-181-1/+1
| | | | | | | | | | | | | | | | | | | | git.gnome.org is no more. It has ceased to be. It's an ex-git. Please see here: https://about.gitlab.com/2018/05/31/welcome-gnome-to-gitlab/ Note that gitlab does not support git://, only https:// (and ssh). [Commit message from Alexander Kanavin] (From OE-Core rev: 8382cdc0888ca645a44aacaac1155afb8dcde979) (From OE-Core rev: a6b6af83e344501057b0eb28dce1077992e5a7f3) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [Fixup for sumo context] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: CVE-2018-14404Sinan Kaya2018-10-182-0/+59
| | | | | | | | | | | | | | | | | | | * CVE-2018-14404 A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the application. Affects libxml <= 2.9.8 CVE: CVE-2018-14404 Ref: https://access.redhat.com/security/cve/cve-2018-14404 (From OE-Core rev: 06d7f9039b005c2112e28336ac1c30e5120ec815) Signed-off-by: Sinan Kaya <okaya@kernel.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* initramfs-framework/udev: call settle before killAnuj Mittal2018-10-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | When mount command is executed in rootfs module of initrd, eudev creates a loop0 device node, applies rules and adds a inotify watch to it. Right after this step, we execute finish which first tries to kill any running udevd daemon before doing a switch_root. In some cases, it is possible that switch_root is executed before inotify_add_watch was actually processed which would lead to errors like: | inotify_add_watch(6, /dev/loop0, 10) failed: No such file or directory Make sure that we process all the events in queue before actually trying to kill udevd to prevent this race. Fixes [YOCTO #12861] (From OE-Core rev: a85c34d263fcf1542bbedcaf1634302466bb20cf) (From OE-Core rev: 196659ca05623996e2b36f7b1e52195a81fd3bdd) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: fix CVE-2018-11237Zheng Ruoqin2018-09-272-0/+83
| | | | | | | | | | | | | glibc: fix CVE-2018-11237 (From OE-Core rev: b9b254da08c1db94ac9ded5f67d7e2e82e3b9be7) (From OE-Core rev: 361c40d4bea101875747eac9c8cc46e92ced173f) Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: CVE-2017-15874Sinan Kaya2018-09-272-0/+31
| | | | | | | | | | | | | | | | | * CVE-2017-15874 busybox: Integer underflow in archival/libarchive/decompress_unlzma.c (cherry picked from 9ac42c500586fa5f10a1f6d22c3f797df11b1f6b) Affects busybox <= 1.27.2 CVE: CVE-2017-15874 Ref: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15874 (From OE-Core rev: c35a0355a3561cd17703ece3a66c3389ceb224bf) Signed-off-by: Sinan Kaya <okaya@kernel.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libcgroup: CVE-2018-14348Jagadeesh Krishnanjanappa2018-09-272-1/+39
| | | | | | | | | | | | | Affects libcgroup <= 0.41 (From OE-Core rev: 37101fa37107c498393492ccdbc8652f685b6cce) (From OE-Core rev: e3254b4ec0f7c22cca1952df22df6568b8d8b81c) Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* os-release: fix to install in the expected locationJoshua Lock2018-09-271-3/+6
| | | | | | | | | | | | | | | os-release (5) recommends that the os-release file be installed in /usr/lib/os-release and that /etc/os-release be a relative symlink to it. (From OE-Core rev: 4feb8614ee25a3d3ceb7f5187120a1256a993155) (From OE-Core rev: 4e67fa950cd3ca6e44d7f46743904d23a756e498) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox/mdev-mount.sh: Fix partition detect and cleanup mountpoint on failMike Looijmans2018-09-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | This fixes issues mainly seen when mounting eMMC devices: The wildcard /sys/block/${DEVBASE}/${DEVBASE}*1 matches both "mmcblk0p1" and "mmcblk0boot1" for example, and this results in syntax errors. Fix this by searching for a "partition" file instead, which only exists for real partitions and not 'fakes' like the eMMC extra's. When mount fails, the mountpoint file is left behind, causing later attempts at auto-mounting it to fail. If mount fails, remove the mountpoint, leaving the system in the state as it was before the mount attempt. (From OE-Core rev: 8645c0419456c1bd3ae15a9a7dd2b2e9a960eaf4) (From OE-Core rev: 38f1648f1472f70a3e747f270cc3230b5993d94b) Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: move init related configs to init.cfgChen Qi2018-09-272-7/+12
| | | | | | | | | | | | | | | | Move init related configs to init.cfg. These config items do not make much sense unless busybox is selected as the init manager. They should belong to init.cfg. (From OE-Core rev: 4af10fe67a31368163bb5d468ee2c5a85ce0fff3) (From OE-Core rev: 996247ba7dfffbeb444f793f7e105fcfb5ffa939) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: handle syslogYadi.hu2018-09-271-5/+9
| | | | | | | | | | | | | | | | | | | | | | If CONFIG_KLOGD is not enabled, then the related service file should not be installed, The error message is below: Cannot add dependency job for unit busybox-klogd.service, ignoring: Unit busybox-klogd.service failed to load: No such file or directory. So we should first check the configuration before we install these service files. (From OE-Core rev: c3cc402df996654bf6f838b1e79e16a8bdd6d4d7) (From OE-Core rev: df1cd90140456dbed0c1bd29ead7c1c81f498b99) Signed-off-by: Yadi.hu <yadi.hu@windriver.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* util-linux: upgrade 2.32 -> 2.32.1Chen Qi2018-09-271-2/+2
| | | | | | | | | | | | (From OE-Core rev: 711f867b1d036aba04e839e955e0fa9d81d3c794) (From OE-Core rev: a925096c62b2034c824bfdf68631e037809b6a30) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> [Bug fix update] Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: CVE-2017-18018Jagadeesh Krishnanjanappa2018-08-293-0/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2017-18018-1: doc: clarify chown/chgrp --dereference defaults * doc/coreutils.texi: the documentation for the --dereference flag of chown/chgrp states that it is the default mode of operation. Document that this is only the case when operating non-recursively. CVE-2017-18018-2: doc: warn about following symlinks recursively in chown/chgrp In both chown and chgrp (which shares its code with chown), operating on symlinks recursively has a window of vulnerability where the destination user or group can change the target of the operation. Warn about combining the --dereference, --recursive, and -L flags. * doc/coreutils.texi (warnOptDerefWithRec): Add macro. (node chown invocation): Add it to --dereference and -L. (node chgrp invocation): Likewise. Affects coreutils <= 8.29 (From OE-Core rev: a523bc6a2ff7d5b5415a789de02fb055ccd2c077) Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Make bits/wordsize.h multilibbed againDaniel Díaz2018-08-161-1/+1
| | | | | | | | | | | | | | | | | As reported by ChenQi, leaving bits/wordsize.h out of being multilibbed introduced a problem in building the SDK for arm64: Error: Transaction check error: file /usr/include/bits/wordsize.h conflicts between attempted installs of lib32-libc6-dev-2.27-r0.armv7vet2hf_vfp and libc6-dev-2.27-r0.aarch64 This effectively reverts commit a74c77d6. (From OE-Core rev: 90ad502bf8faa233e25cf297c1eeefcb0367aea3) (From OE-Core rev: 056ae940da49b38890c2960651f0fdb5331a5fac) Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to sumo head revisionyocto-2.5.1sumo-19.0.1Richard Purdie2018-08-061-1/+1
| | | | | | (From OE-Core rev: 2a4595f0c45a9c0ecdeb1d92613821321e48a1ae) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-10 11:10:55 +0000