linux/poky.git, branch daisy-11.0.2

dev-manual: Updated the "Making Images More Secure" section.

2014-11-20T17:24:52+00:00

Fixes [YOCTO #5482] I did some significant re-writing and re-organization of this section. It now includes a bit about securing an image in general, provides general considerations, considerations specific to the OpenEmbedded build system, pointers to some tools in meta-security layer, and some other items. I added some key references to the section on considerations specific to the OpenEmbedded build system. In particular, I provided some cross-linking back to the extrausers.bbclass section to reference an example of adding a user account. I also split out the topics of adding an extra user and setting a password on the image in the bulleted list. Updated the setting root and extra user's passwords. Also, permanently removed the reference to the wiki that showed the less optimal way of setting a root password. Added a cross-reference to the meta-selinux layer in the section that describes how to make images more secure. (From yocto-docs rev: 812bf8e2c91c4dd14a2245509ea7008a24e90835) Signed-off-by: Scott Rifenbark Signed-off-by: Richard Purdie

profile-manual: Updates to the LTTng Documentation section.

2014-11-08T11:14:55+00:00

The LTTng Documentation website has been updated to actually have extensive documentation now. Previously, in the profile-manual, we were stating that documentation did not exist, which was true at the time of writing. I updated the section to link to the main LTTng documentation website and altered some other text in the section appropriately. Additionally, I found and corrected a couple spelling errors in this chapter. (From yocto-docs rev: d40ea4d8cfcbc225025d73288cd01336e0d41afc) Signed-off-by: Scott Rifenbark Signed-off-by: Richard Purdie

build-appliance-image: Update to daisy head revision

2014-11-06T14:27:23+00:00

(From OE-Core rev: 1c7a2d764c9a5df4f1d249f34c9dacfc09c0071c) Signed-off-by: Richard Purdie

readline: Patch for readline multikey dispatch issue

2014-11-06T11:40:39+00:00

(From OE-Core rev: 5ef447d243e5c4954e00d49a4c499dc3fd691725) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

wget: Fix for CVE-2014-4887

2014-11-06T11:40:38+00:00

(From OE-Core rev: 52f9eebe86e4b641229b524dd7701c01d9ed833c) Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

libarchive: avoid dependency on e2fsprogs

2014-11-06T11:40:38+00:00

libarchive's configure script looks for ext2fs/ext2_fs.h in order to use some defines for file attributes support if present (but doesn't link to any additional libraries.) There is no configure option to disable this, and if e2fsprogs is rebuilding between do_configure and do_compile you can currently get a failure. Because it doesn't need anything else from e2fsprogs, and e2fsprogs isn't currently buildable for nativesdk anyway, copy the headers in from e2fsprogs-native which we're likely to have built already (and add it to DEPENDS just to be sure we have.) Fixes [YOCTO #6268]. (From OE-Core master rev: ad754e46ad477acfbe7543187a5c38bc333b8612) (From OE-Core rev: 7504c2e715d675775e166a52ae83cf48504add19) Signed-off-by: Paul Eggleton Signed-off-by: Saul Wold Signed-off-by: Richard Purdie

python: force off_t size to 8 to enable large file support

2014-11-06T11:40:38+00:00

If DISTRO_FEATURES contains "largefile", force the size of off_t to 8 as a workaround for having ac_cv_sizeof_off_t=4 on 32-bit systems. In future we will likely drop the value from the site file, but for now this is a slightly safer fix. Fixes [YOCTO #6813]. (From OE-Core master rev: a8216030ee6c65531de8fbf3eed878a345a94edc) (From OE-Core rev: 94483eff5d0858ef1b5a8850268aa6a7bc6e6463) Signed-off-by: Paul Eggleton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssh: avoid screen sessions being killed on disconnect with systemd

2014-11-06T11:40:37+00:00

Tell systemd just to kill the sshd process when the ssh connection drops instead of the entire cgroup for sshd, so that any screen sessions (and more to the point, processes within them) do not get killed. (This is what the Fedora sshd service file does, and what we're already doing in the dropbear service file). (From OE-Core master rev: 3c238dff41fbd3687457989c7b17d22b2cc844be) (From OE-Core rev: 6e6aeb7cca52b92a0c8013473e2b8bb18738a119) Signed-off-by: Paul Eggleton Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

build-appliance-image: Update to daisy head revision

2014-11-05T23:28:16+00:00

(From OE-Core rev: d1729495a19bda411fa84310ecf6c0ac3073ce36) Signed-off-by: Richard Purdie

curl: Security Advisory - curl - CVE-2014-3620

2014-11-05T23:27:45+00:00

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. (From OE-Core rev: ddbaade8afbc9767583728bfdc220639203d6853) (From OE-Core rev: 13bb2ee98cfd159455e459501dda280a78cb5a3b) Signed-off-by: Chong Lu Signed-off-by: Richard Purdie