linux/meta-openembedded.git/meta-oe/recipes-security, branch wrynose

bubblewrap: upgrade 0.11.1 -> 0.11.2

2026-05-15T03:53:04+00:00

Changelog: =========== - bug fix: CVE-2026-41163 - enhancement : New build option -Dsupport_setuid, which if set to false (which is the default) disables the support for setuid. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 8cb0926b53d6b129fc301588cc64f23c8e977d8d) Signed-off-by: Anuj Mittal

keyutils: Fix build with lld linker

2026-04-13T14:59:59+00:00

Signed-off-by: Khem Raj

audit: fix build with autoconf-2.73

2026-04-11T00:25:50+00:00

On hosts with gcc-13 it was trying to use -std=gnu23 and failing with unrecognized command-line option (gnu23 needs gcc-14 and newer) Signed-off-by: Martin Jansa Signed-off-by: Khem Raj

spectre-meltdown-checker: upgrade 0.46 -> 26.26.0404682

2026-04-10T14:59:58+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

spdm-emu: use SkipRecipe instead of fatal error for unsupported architectures

2026-04-10T14:59:49+00:00

Current code fails to parse meta-oe layer for machine with unsupported architecture. This is too restrictive as it requires downstream layers to play tricks with masking the recipe. Usual way is to skip the recipe instead. Signed-off-by: Peter Marko Signed-off-by: Khem Raj

audit: upgrade 4.1.3 -> 4.1.4

2026-04-02T02:29:03+00:00

0001-Fixed-swig-host-contamination-issue.patch refreshed for 4.1.4 Changelog: =========== - Update syscalls and io_uring tables for the 7.0 kernel - Code cleanups - Avoid blocking auditd while handling disk space alerts - Tighten auditctl permission checks and rule deletion handling - Fix ausearch and auparse parsing for several newer record types - Prevent queue resize races in audisp and oversize records in af_unix - Fix memory safety issues in auparse and the audisp filter plugin - Improve reliability of audisp-remote, auplugin, and the ids plugin - Fix stats collection and parsing in the audisp-statsd plugin - Refresh ausearch and aureport man pages Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

nmap: make python3 RDEPENDS conditional on ndiff

2026-03-31T02:46:40+00:00

When ndiff was disabled by default in 51e070301e ("nmap: disable ndiff"), the python3 RDEPENDS were left unconditional on the main package. This causes python3-difflib, python3-asyncio and python3-xml to be pulled into every image that includes nmap, even though ndiff is not built and the core nmap binary (C++) does not need Python. Gate the RDEPENDS behind the ndiff PACKAGECONFIG so that Python is only required when ndiff is actually enabled. Signed-off-by: Paolo Barbolini Signed-off-by: Khem Raj

bubblewrap: upgrade 0.11.0 -> 0.11.1

2026-03-26T14:43:37+00:00

Bug fixes: ========= * Reset disposition of 'SIGCHLD', restoring normal subprocess management if bwrap was run from a process that was ignoring that signal, such as Erlang or volumeicon * Don't ignore '--userns 0', '--userns2 0' or '--pidns 0' if used Note that using a fd number >= 3 for these purposes is still preferred, to avoid confusion with the stdin, stdout, stderr that will be inherited by the command inside the container. * Fix grammar in an error message * Fix a broken link in the documentation Internal changes: ================== * Enable user namespaces in Github Actions configuration, fixing a CI regression with newer Ubuntu * Clarify comments Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

libspdm & spdm-emu: update arch map

2026-03-25T06:32:48+00:00

It fails to run `bitbake -p` for qemuppc64 with errors: ERROR: /path_to/meta-oe/recipes-security/spdm-emu/spdm-emu_git.bb: unsupported architecture 'powerpc64le' ERROR: /path_to/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb: unsupported architecture 'powerpc64le' Add qemuppc64 default TARGET_ARCH to the arch map. Signed-off-by: Kai Kang Signed-off-by: Khem Raj

spectre-meltdown-checker: Update 0.46 -> git

2026-03-20T16:51:44+00:00

The git repo gained some bugfixes, esp. for arm32. But there was no release since mid 2023. So, use the git repo. a20641f fix: handle non-numeric ARM CPU architecture values d550ea8 fix: harmless 'dmesg: write error' that could happen on some systems 8e33a1d fix: set cpu_* vars to a default value 68b4617 update: fwdb from v345+i20251110+4df2 to v347+i20251110+615b, 2 microcode changes 9fed5ce update: fwdb from v344+i20250811+1523 to v345+i20251110+4df2, 45 microcode changes 72bce72 chore: really fix autoupdate workflow to avoid useless PRs 5f18e67 chore: fix autoupdate workflow a8466b7 fix CVE-2017-5715 reporting when IBRS_FW is enabled b99be23 update: fwdb from v296+i20240514+988c to v344+i20250811+1523, 128 microcode changes ee4cfd0 chore: add autoupdate workflow for fwdb c2c60e0 chore: fix recent shellcheck warnings bae43d8 Replace head -1 by head -n1 34c6095 fix: Linux 6.9+ changed some config options names (#490) e806e4b chore: docker compose v2 388d44e Fix Retpoline detection for Linux 6.9+ (issue #490) bd0c7c9 fix: typo introduced by #483, fixes #486 d70e4c2 fwdb: update to v296+i20240514+988c 4e29fb5 fix: ucode_platformid_mask is hexa (fixes #485) 0f2edb1 feat: blacklist some more microcodes (fixes #475) 8ac2539 fix: microcode check now supports pf_mask (fixes #482) 97f4d5f feat(reptar): add detection and mitigation of Reptar 9b7b09a fix(inception): continued mitigation detection c94811e fix(inception): Zen1/2 results based on kernel mitigations 3e67047 feat(inception): README ecee757 feat(inception): kernel checks + sbpb support detection fb6933d feat(inception): Zen1/2 IBPB and SMT checks dc6921a feat(inception): handle sysfs interface 3167762 feat(inception): start supporting AMD inception 44223c5 fix: bsd: kernel version detection dbe208f enh: downfall: detect kernel mitigation without sysfs aca4e2a enh: move root warning to the bottom c1c1ac4 feat(downfall): detection of the kernel mitigation relying on dmesg ba0daa6 feat: downfall: add kernel soft mitigation support check 227c0aa feat(downfall): add downfall checks 8ba3751 fwdb: update to latest Intel ucode versions d013c0a doc: add kernel src as additional ucode version source cbe8ba1 fix: inteldb: cpuid 0x00090660 and 0x000A0680 9c2587b enh: when CPUID can't be read, built it by ourselves 2a5ddc8 feat: add Intel known affected processors DB 2ef6c1c enh: factorize file download func 3c22401 chore: update disclaimer and FAQ Signed-off-by: Jörg Sommer Signed-off-by: Khem Raj