linux/meta-openembedded.git/meta-filesystems, branch sumo

fuse: CVE-2018-10906

2018-08-26T18:03:11+00:00

* CVE-2018-10906-1: fusermount: don't feed "escaped commas" into mount options The old code permits the following behavior: $ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument) However, backslashes do not have any special meaning for the kernel here. As it happens, you can't abuse this because there is no FUSE mount option that takes a string value that can contain backslashes; but this is very brittle. Don't interpret "escape characters" in places where they don't work. * CVE-2018-10906-2: fusermount: refuse unknown options Blacklists are notoriously fragile; especially if the kernel wishes to add some security-critical mount option at a later date, all existing systems with older versions of fusermount installed will suddenly have a security problem. Additionally, if the kernel's option parsing became a tiny bit laxer, the blacklist could probably be bypassed. Whitelist known-harmless flags instead, even if it's slightly more inconvenient. Affects fuse < 2.9.8 and fuse < 3.2.5 Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster

aufs-util: refresh patches

2018-05-02T01:12:48+00:00

Refresh patches to fix do_patch warning. Signed-off-by: Yi Zhao

update layer maintainers

2018-04-13T19:43:44+00:00

Signed-off-by: Armin Kuster

meta-*: add LAYERSERIES_COMPAT to layer.conf files

2018-04-13T19:43:37+00:00

Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

smbnetfs: refresh patch

2018-04-09T00:00:06+00:00

WARNING: smbnetfs-git-r0 do_patch: Some of the context lines in patches were ignored. This can lead to incorrectly applied patches. The context lines in the patches can be updated with devtool: devtool modify devtool finish --force-patch-refresh Then the updated patches and the source tree (in devtool's workspace) should be reviewed to make sure the patches apply in the correct place and don't introduce duplicate lines (which can, and does happen when some of the context is ignored). Further information: http://lists.openembedded.org/pipermail/openembedded-core/2018-March/148675.html https://bugzilla.yoctoproject.org/show_bug.cgi?id=10450 Details: Applying patch Using-PKG_CHECK_MODULES-to-found-headers-and-libraries.patch patching file configure.ac Hunk #1 succeeded at 119 with fuzz 2 (offset -6 lines). patching file src/Makefile.am Hunk #1 succeeded at 17 (offset 1 line). Now at patch Using-PKG_CHECK_MODULES-to-found-headers-and-libraries.patch Signed-off-by: Hains van den Bosch Signed-off-by: Armin Kuster

xfsdump: Use new config.guess and config.sub

2018-03-29T23:48:04+00:00

This brings in new architecture support for risc-v Signed-off-by: Khem Raj Signed-off-by: Armin Kuster

samba, openwsman, pam-ssh-agent-auth, sblim-sfcb, passwdqc, python-pam, smbnetfs: require pam in DISTRO_FEATURES

2018-03-05T16:45:40+00:00

* there is explicit dependency on libpam without respecting pam in DISTRO_FEATURES so add the check to prevent people building it against broken libpam Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster Signed-off-by: Joe MacDonald

xfsprogs: Upgrade to 4.14

2018-02-11T19:52:32+00:00

Fix build with glibc 2.27 while here Signed-off-by: Khem Raj Signed-off-by: Armin Kuster

smbnetfs: update to version 0.6.1

2018-02-11T19:48:12+00:00

gnome-keyring is deprecated and replaced with libsecret. Signed-off-by: Armin Kuster

smbnetfs: update update 0.5.3a -> 0.6.0

2017-11-16T00:30:50+00:00

It seems that updating smbnetfs to latest revision fixes build issues. Also remove the blacklist allowing the plugin to build again. Patches reworked to apply on 0.6.0. Additionally handle missing libexecinfo (DEPENDS and LDFLAGS) when building with musl else we are getting the following error: | ../../git/src/common.c:7:10: fatal error: execinfo.h: No such file or directory | #include Signed-off-by: Athanasios Oikonomou Signed-off-by: Armin Kuster