linux/meta-openembedded.git/meta-filesystems, branch rocko

fuse: CVE-2018-10906

2018-09-04T14:36:55+00:00

* CVE-2018-10906-1: fusermount: don't feed "escaped commas" into mount options The old code permits the following behavior: $ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument) However, backslashes do not have any special meaning for the kernel here. As it happens, you can't abuse this because there is no FUSE mount option that takes a string value that can contain backslashes; but this is very brittle. Don't interpret "escape characters" in places where they don't work. * CVE-2018-10906-2: fusermount: refuse unknown options Blacklists are notoriously fragile; especially if the kernel wishes to add some security-critical mount option at a later date, all existing systems with older versions of fusermount installed will suddenly have a security problem. Additionally, if the kernel's option parsing became a tiny bit laxer, the blacklist could probably be bypassed. Whitelist known-harmless flags instead, even if it's slightly more inconvenient. Affects fuse < 2.9.8 and fuse < 3.2.5 Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster

README: update maintainers list for rocko

2017-10-17T10:40:25+00:00

v2: bumped bitbake version in meta-filesystems Signed-off-by: Armin Kuster Signed-off-by: Martin Jansa

smbnetfs: delete blacklisted

2017-09-18T08:16:23+00:00

* there was some work on it recently, but it still doesn't work and no reply in 2 weeks: http://lists.openembedded.org/pipermail/openembedded-devel/2017-August/114480.html Signed-off-by: Martin Jansa

xfsdump: Upgrade to 3.1.7

2017-09-13T09:13:25+00:00

Fix build on musl Point to new SRC_URI Signed-off-by: Khem Raj Signed-off-by: Martin Jansa

xfsprogs: Upgrade to 4.12.0

2017-09-13T09:13:22+00:00

Fix cross builds with hardening flags Fix build with gold Specify libtool tag Add DISABLE_STATIC = "" Signed-off-by: Khem Raj Signed-off-by: Martin Jansa

aufs-util: Use cross strip tool

2017-09-13T09:13:20+00:00

Honor the STRIP variable when passed from environment Fixes build with musl/raspberrypi Signed-off-by: Khem Raj Signed-off-by: Martin Jansa

recipes: remove blacklisted recipes

2017-08-31T08:18:33+00:00

* as PNBLACKLIST message says, these recipes are blacklisted for long time and nobody showed any interest to fix them * remove all unused .patch and .inc files as well Signed-off-by: Martin Jansa

udevil: Add missing rdep on bash

2017-08-28T09:06:05+00:00

Signed-off-by: Khem Raj Signed-off-by: Martin Jansa

aufs-util: Upgrade to 4.4 release

2017-07-24T16:57:36+00:00

- Download aufs_type.h instead of housing a local copy - Build uses paste utility from coreutils-native - Replace hardcoded strip command with STRIP env varible helps in cross compiling Signed-off-by: Khem Raj Signed-off-by: Martin Jansa

xfsdump: Fix build with musl

2017-07-24T16:57:36+00:00

Signed-off-by: Khem Raj Signed-off-by: Martin Jansa