mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-06-04 14:39:54 +00:00
chrony: Upgrade to 4.0
ChangeLog is here [1]
Do not install /var/log as it conflicts with basefiles package
Collected errors:
* check_data_file_clashes: Package chrony wants to install file /var/log
But that file is already provided by package * base-files
Remove CVE patch since its upstream
Forward port arm_eabi.patch patch
Make builds reproducible
[1] https://chrony.tuxfamily.org/news.html
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Khem Raj
@@ -1,204 +0,0 @@
|
||||
From f00fed20092b6a42283f29c6ee1f58244d74b545 Mon Sep 17 00:00:00 2001
|
||||
From: Miroslav Lichvar <mlichvar@redhat.com>
|
||||
Date: Thu, 6 Aug 2020 09:31:11 +0200
|
||||
Subject: main: create new file when writing pidfile
|
||||
|
||||
When writing the pidfile, open the file with the O_CREAT|O_EXCL flags
|
||||
to avoid following a symlink and writing the PID to an unexpected file,
|
||||
when chronyd still has the root privileges.
|
||||
|
||||
The Linux open(2) man page warns about O_EXCL not working as expected on
|
||||
NFS versions before 3 and Linux versions before 2.6. Saving pidfiles on
|
||||
a distributed filesystem like NFS is not generally expected, but if
|
||||
there is a reason to do that, these old kernel and NFS versions are not
|
||||
considered to be supported for saving files by chronyd.
|
||||
|
||||
This is a minimal backport specific to this issue of the following
|
||||
commits:
|
||||
- commit 2fc8edacb810 ("use PATH_MAX")
|
||||
- commit f4c6a00b2a11 ("logging: call exit() in LOG_Message()")
|
||||
- commit 7a4c396bba8f ("util: add functions for common file operations")
|
||||
- commit e18903a6b563 ("switch to new util file functions")
|
||||
|
||||
Reported-by: Matthias Gerstner <mgerstner@suse.de>
|
||||
|
||||
Upstream-Status: Backport [https://git.tuxfamily.org/chrony/chrony.git/commit/?id=f00fed20092b6a42283f29c6ee1f58244d74b545]
|
||||
CVE: CVE-2020-14367
|
||||
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
|
||||
|
||||
diff --git a/logging.c b/logging.c
|
||||
index d2296e0..fd7f900 100644
|
||||
--- a/logging.c
|
||||
+++ b/logging.c
|
||||
@@ -171,6 +171,7 @@ void LOG_Message(LOG_Severity severity,
|
||||
system_log = 0;
|
||||
log_message(1, severity, buf);
|
||||
}
|
||||
+ exit(1);
|
||||
break;
|
||||
default:
|
||||
assert(0);
|
||||
diff --git a/main.c b/main.c
|
||||
index 6ccf32e..8edb2e1 100644
|
||||
--- a/main.c
|
||||
+++ b/main.c
|
||||
@@ -281,13 +281,9 @@ write_pidfile(void)
|
||||
if (!pidfile[0])
|
||||
return;
|
||||
|
||||
- out = fopen(pidfile, "w");
|
||||
- if (!out) {
|
||||
- LOG_FATAL("Could not open %s : %s", pidfile, strerror(errno));
|
||||
- } else {
|
||||
- fprintf(out, "%d\n", (int)getpid());
|
||||
- fclose(out);
|
||||
- }
|
||||
+ out = UTI_OpenFile(NULL, pidfile, NULL, 'W', 0644);
|
||||
+ fprintf(out, "%d\n", (int)getpid());
|
||||
+ fclose(out);
|
||||
}
|
||||
|
||||
/* ================================================== */
|
||||
diff --git a/sysincl.h b/sysincl.h
|
||||
index 296c5e6..873a3bd 100644
|
||||
--- a/sysincl.h
|
||||
+++ b/sysincl.h
|
||||
@@ -37,6 +37,7 @@
|
||||
#include <glob.h>
|
||||
#include <grp.h>
|
||||
#include <inttypes.h>
|
||||
+#include <limits.h>
|
||||
#include <math.h>
|
||||
#include <netinet/in.h>
|
||||
#include <pwd.h>
|
||||
diff --git a/util.c b/util.c
|
||||
index e7e3442..83b3b20 100644
|
||||
--- a/util.c
|
||||
+++ b/util.c
|
||||
@@ -1179,6 +1179,101 @@ UTI_CheckDirPermissions(const char *path, mode_t perm, uid_t uid, gid_t gid)
|
||||
|
||||
/* ================================================== */
|
||||
|
||||
+static int
|
||||
+join_path(const char *basedir, const char *name, const char *suffix,
|
||||
+ char *buffer, size_t length, LOG_Severity severity)
|
||||
+{
|
||||
+ const char *sep;
|
||||
+
|
||||
+ if (!basedir) {
|
||||
+ basedir = "";
|
||||
+ sep = "";
|
||||
+ } else {
|
||||
+ sep = "/";
|
||||
+ }
|
||||
+
|
||||
+ if (!suffix)
|
||||
+ suffix = "";
|
||||
+
|
||||
+ if (snprintf(buffer, length, "%s%s%s%s", basedir, sep, name, suffix) >= length) {
|
||||
+ LOG(severity, "File path %s%s%s%s too long", basedir, sep, name, suffix);
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
+/* ================================================== */
|
||||
+
|
||||
+FILE *
|
||||
+UTI_OpenFile(const char *basedir, const char *name, const char *suffix,
|
||||
+ char mode, mode_t perm)
|
||||
+{
|
||||
+ const char *file_mode;
|
||||
+ char path[PATH_MAX];
|
||||
+ LOG_Severity severity;
|
||||
+ int fd, flags;
|
||||
+ FILE *file;
|
||||
+
|
||||
+ severity = mode >= 'A' && mode <= 'Z' ? LOGS_FATAL : LOGS_ERR;
|
||||
+
|
||||
+ if (!join_path(basedir, name, suffix, path, sizeof (path), severity))
|
||||
+ return NULL;
|
||||
+
|
||||
+ switch (mode) {
|
||||
+ case 'r':
|
||||
+ case 'R':
|
||||
+ flags = O_RDONLY;
|
||||
+ file_mode = "r";
|
||||
+ if (severity != LOGS_FATAL)
|
||||
+ severity = LOGS_DEBUG;
|
||||
+ break;
|
||||
+ case 'w':
|
||||
+ case 'W':
|
||||
+ flags = O_WRONLY | O_CREAT | O_EXCL;
|
||||
+ file_mode = "w";
|
||||
+ break;
|
||||
+ case 'a':
|
||||
+ case 'A':
|
||||
+ flags = O_WRONLY | O_CREAT | O_APPEND;
|
||||
+ file_mode = "a";
|
||||
+ break;
|
||||
+ default:
|
||||
+ assert(0);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+try_again:
|
||||
+ fd = open(path, flags, perm);
|
||||
+ if (fd < 0) {
|
||||
+ if (errno == EEXIST) {
|
||||
+ if (unlink(path) < 0) {
|
||||
+ LOG(severity, "Could not remove %s : %s", path, strerror(errno));
|
||||
+ return NULL;
|
||||
+ }
|
||||
+ DEBUG_LOG("Removed %s", path);
|
||||
+ goto try_again;
|
||||
+ }
|
||||
+ LOG(severity, "Could not open %s : %s", path, strerror(errno));
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ UTI_FdSetCloexec(fd);
|
||||
+
|
||||
+ file = fdopen(fd, file_mode);
|
||||
+ if (!file) {
|
||||
+ LOG(severity, "Could not open %s : %s", path, strerror(errno));
|
||||
+ close(fd);
|
||||
+ return NULL;
|
||||
+ }
|
||||
+
|
||||
+ DEBUG_LOG("Opened %s fd=%d mode=%c", path, fd, mode);
|
||||
+
|
||||
+ return file;
|
||||
+}
|
||||
+
|
||||
+/* ================================================== */
|
||||
+
|
||||
void
|
||||
UTI_DropRoot(uid_t uid, gid_t gid)
|
||||
{
|
||||
diff --git a/util.h b/util.h
|
||||
index e3d6767..a2481cc 100644
|
||||
--- a/util.h
|
||||
+++ b/util.h
|
||||
@@ -176,6 +176,17 @@ extern int UTI_CreateDirAndParents(const char *path, mode_t mode, uid_t uid, gid
|
||||
permissions and its uid/gid must match the specified values. */
|
||||
extern int UTI_CheckDirPermissions(const char *path, mode_t perm, uid_t uid, gid_t gid);
|
||||
|
||||
+/* Open a file. The full path of the file is constructed from the basedir
|
||||
+ (may be NULL), '/' (if basedir is not NULL), name, and suffix (may be NULL).
|
||||
+ Created files have specified permissions (umasked). Returns NULL on error.
|
||||
+ The following modes are supported (if the mode is an uppercase character,
|
||||
+ errors are fatal):
|
||||
+ r/R - open an existing file for reading
|
||||
+ w/W - open a new file for writing (remove existing file)
|
||||
+ a/A - open an existing file for appending (create if does not exist) */
|
||||
+extern FILE *UTI_OpenFile(const char *basedir, const char *name, const char *suffix,
|
||||
+ char mode, mode_t perm);
|
||||
+
|
||||
/* Set process user/group IDs and drop supplementary groups */
|
||||
extern void UTI_DropRoot(uid_t uid, gid_t gid);
|
||||
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
||||
@@ -18,45 +18,60 @@ Subject: [PATCH] chrony: fix build failure for arma9
|
||||
Refresh patch for new upstream version.
|
||||
|
||||
Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
|
||||
|
||||
Refreshed for 4.0
|
||||
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
sys_linux.c | 20 ++++++++++++++------
|
||||
1 file changed, 14 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/sys_linux.c b/sys_linux.c
|
||||
index 898dc7a..b268ad1 100644
|
||||
--- a/sys_linux.c
|
||||
+++ b/sys_linux.c
|
||||
@@ -479,14 +479,14 @@ SYS_Linux_EnableSystemCallFilter(int level)
|
||||
const int syscalls[] = {
|
||||
/* Clock */
|
||||
SCMP_SYS(adjtimex), SCMP_SYS(clock_gettime), SCMP_SYS(gettimeofday),
|
||||
- SCMP_SYS(settimeofday), SCMP_SYS(time),
|
||||
+ SCMP_SYS(settimeofday),
|
||||
@@ -499,14 +499,12 @@ SYS_Linux_EnableSystemCallFilter(int lev
|
||||
#endif
|
||||
SCMP_SYS(gettimeofday),
|
||||
SCMP_SYS(settimeofday),
|
||||
- SCMP_SYS(time),
|
||||
|
||||
/* Process */
|
||||
SCMP_SYS(clone), SCMP_SYS(exit), SCMP_SYS(exit_group), SCMP_SYS(getpid),
|
||||
- SCMP_SYS(getrlimit), SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigreturn),
|
||||
+ SCMP_SYS(rt_sigaction), SCMP_SYS(rt_sigreturn),
|
||||
SCMP_SYS(rt_sigprocmask), SCMP_SYS(set_tid_address), SCMP_SYS(sigreturn),
|
||||
SCMP_SYS(wait4), SCMP_SYS(waitpid),
|
||||
SCMP_SYS(clone),
|
||||
SCMP_SYS(exit),
|
||||
SCMP_SYS(exit_group),
|
||||
SCMP_SYS(getpid),
|
||||
- SCMP_SYS(getrlimit),
|
||||
SCMP_SYS(getuid),
|
||||
SCMP_SYS(rt_sigaction),
|
||||
SCMP_SYS(rt_sigreturn),
|
||||
@@ -519,7 +517,6 @@ SYS_Linux_EnableSystemCallFilter(int lev
|
||||
/* Memory */
|
||||
- SCMP_SYS(brk), SCMP_SYS(madvise), SCMP_SYS(mmap), SCMP_SYS(mmap2),
|
||||
+ SCMP_SYS(brk), SCMP_SYS(madvise), SCMP_SYS(mmap2),
|
||||
SCMP_SYS(mprotect), SCMP_SYS(mremap), SCMP_SYS(munmap), SCMP_SYS(shmdt),
|
||||
/* Filesystem */
|
||||
SCMP_SYS(_llseek), SCMP_SYS(access), SCMP_SYS(chmod), SCMP_SYS(chown),
|
||||
@@ -499,14 +499,22 @@ SYS_Linux_EnableSystemCallFilter(int level)
|
||||
SCMP_SYS(bind), SCMP_SYS(connect), SCMP_SYS(getsockname), SCMP_SYS(getsockopt),
|
||||
SCMP_SYS(recv), SCMP_SYS(recvfrom), SCMP_SYS(recvmmsg), SCMP_SYS(recvmsg),
|
||||
SCMP_SYS(send), SCMP_SYS(sendmmsg), SCMP_SYS(sendmsg), SCMP_SYS(sendto),
|
||||
SCMP_SYS(brk),
|
||||
SCMP_SYS(madvise),
|
||||
- SCMP_SYS(mmap),
|
||||
SCMP_SYS(mmap2),
|
||||
SCMP_SYS(mprotect),
|
||||
SCMP_SYS(mremap),
|
||||
@@ -573,8 +570,6 @@ SYS_Linux_EnableSystemCallFilter(int lev
|
||||
SCMP_SYS(sendmsg),
|
||||
SCMP_SYS(sendto),
|
||||
SCMP_SYS(shutdown),
|
||||
- /* TODO: check socketcall arguments */
|
||||
- SCMP_SYS(socketcall),
|
||||
|
||||
/* General I/O */
|
||||
SCMP_SYS(_newselect), SCMP_SYS(close), SCMP_SYS(open), SCMP_SYS(openat), SCMP_SYS(pipe),
|
||||
SCMP_SYS(pipe2), SCMP_SYS(poll), SCMP_SYS(ppoll), SCMP_SYS(pselect6), SCMP_SYS(read),
|
||||
- SCMP_SYS(futex), SCMP_SYS(select), SCMP_SYS(set_robust_list), SCMP_SYS(write),
|
||||
+ SCMP_SYS(futex), SCMP_SYS(set_robust_list), SCMP_SYS(write),
|
||||
/* Miscellaneous */
|
||||
SCMP_SYS(getrandom), SCMP_SYS(sysinfo), SCMP_SYS(uname),
|
||||
SCMP_SYS(_newselect),
|
||||
@@ -597,7 +592,6 @@ SYS_Linux_EnableSystemCallFilter(int lev
|
||||
#ifdef __NR_futex_time64
|
||||
SCMP_SYS(futex_time64),
|
||||
#endif
|
||||
- SCMP_SYS(select),
|
||||
SCMP_SYS(set_robust_list),
|
||||
SCMP_SYS(write),
|
||||
|
||||
@@ -605,6 +599,15 @@ SYS_Linux_EnableSystemCallFilter(int lev
|
||||
SCMP_SYS(getrandom),
|
||||
SCMP_SYS(sysinfo),
|
||||
SCMP_SYS(uname),
|
||||
+ /* not always available */
|
||||
+#if ! defined(__ARM_EABI__)
|
||||
+ SCMP_SYS(time),
|
||||
@@ -66,10 +81,6 @@ index 898dc7a..b268ad1 100644
|
||||
+ /* TODO: check socketcall arguments */
|
||||
+ SCMP_SYS(socketcall),
|
||||
+#endif
|
||||
+
|
||||
};
|
||||
|
||||
const int socket_domains[] = {
|
||||
--
|
||||
2.17.1
|
||||
|
||||
const int socket_domains[] = {
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
PATH=/sbin:/bin:/usr/bin:/usr/sbin
|
||||
|
||||
DAEMON=/usr/sbin/chronyd
|
||||
PIDFILE=/var/run/chronyd.pid
|
||||
PIDFILE=/run/chrony/chronyd.pid
|
||||
|
||||
test -x $DAEMON -a -r /etc/chrony.conf || exit 0
|
||||
|
||||
|
||||
+6
-7
@@ -34,14 +34,12 @@ SRC_URI = "https://download.tuxfamily.org/chrony/chrony-${PV}.tar.gz \
|
||||
file://chrony.conf \
|
||||
file://chronyd \
|
||||
file://arm_eabi.patch \
|
||||
file://CVE-2020-14367.patch \
|
||||
"
|
||||
|
||||
SRC_URI_append_libc-musl = " \
|
||||
file://0001-Fix-compilation-with-musl.patch \
|
||||
"
|
||||
SRC_URI[md5sum] = "5f66338bc940a9b51eede8f391e7bed3"
|
||||
SRC_URI[sha256sum] = "4e02795b1260a4ec51e6ace84149036305cc9fc340e65edb9f8452aa611339b5"
|
||||
SRC_URI[sha256sum] = "be27ea14c55e7a4434b2fa51d53018c7051c42fa6a3198c9aa6a1658bae0c625"
|
||||
|
||||
DEPENDS = "pps-tools"
|
||||
|
||||
@@ -82,6 +80,10 @@ DISABLE_STATIC = ""
|
||||
do_configure() {
|
||||
./configure --sysconfdir=${sysconfdir} --bindir=${bindir} --sbindir=${sbindir} \
|
||||
--localstatedir=${localstatedir} --datarootdir=${datadir} \
|
||||
--with-ntp-era=$(shell date -d '1970-01-01 00:00:00+00:00' +'%s') \
|
||||
--with-pidfile=/run/chrony/chronyd.pid \
|
||||
--chronyrundir=/run/chrony \
|
||||
--host-system=Linux \
|
||||
${PACKAGECONFIG_CONFARGS}
|
||||
}
|
||||
|
||||
@@ -107,9 +109,6 @@ do_install() {
|
||||
# Variable data (for drift and/or rtc file)
|
||||
install -d ${D}${localstatedir}/lib/chrony
|
||||
|
||||
# Log files
|
||||
install -d ${D}${localstatedir}/log/chrony
|
||||
|
||||
# Fix hard-coded paths in config files and init scripts
|
||||
sed -i -e 's!/var/!${localstatedir}/!g' -e 's!/etc/!${sysconfdir}/!g' \
|
||||
-e 's!/usr/sbin/!${sbindir}/!g' -e 's!/usr/bin/!${bindir}/!g' \
|
||||
@@ -120,7 +119,7 @@ do_install() {
|
||||
sed -i 's!^EnvironmentFile=.*!EnvironmentFile=-${sysconfdir}/default/chronyd!' ${D}${systemd_unitdir}/system/chronyd.service
|
||||
}
|
||||
|
||||
FILES_${PN} = "${sbindir}/chronyd ${sysconfdir} ${localstatedir}"
|
||||
FILES_${PN} = "${sbindir}/chronyd ${sysconfdir} ${localstatedir}/lib/chrony ${localstatedir}"
|
||||
CONFFILES_${PN} = "${sysconfdir}/chrony.conf"
|
||||
INITSCRIPT_NAME = "chronyd"
|
||||
INITSCRIPT_PARAMS = "defaults"
|
||||
Reference in New Issue
Block a user