* Allow sysinfo() in the seccomp sandbox otherwise
comes below OOPS: priv_sock_get_cmd as the syscall
sysinfo() not allowed
tnftp 192.168.1.1
Connected to 192.168.1.1.
220 (vsFTPd 3.0.3)
Name (192.168.1.1:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> prompt
Interactive mode off.
ftp> mget small*
OOPS: priv_sock_get_cmd
* use "strace -ff /usr/sbin/vsftpd" to track in both
seccomp sandbox on and seccomp sandbox off (add
seccomp_sandbox=NO in /etc/vsftpd.conf) scenarios when
type the commands at ftp client as above, the ftp
connection at server side ends up each time with SIGSYS when
call sysinfo() syscall in seccomp sandbox on case,
so we need to add sysinfo() in the seccomp sandbox if
still use seccomp sandbox for vsftpd
* The issue still exists in other distribution, Please
check https://bugzilla.redhat.com/show_bug.cgi?id=845980 for details
And check ftp://195.220.108.108/linux/fedora/linux/updates/\
24/SRPMS/p/proftpd-1.3.5b-2.fc24.src.rpm for fedora, there
is even a patch vsftpd-3.0.2-seccomp.patch as below to turn off
seccomp sandbox for vsftpd by default which also means fedora
doesn't limit the syscall any more by default.
From dd86a1c28f11fa67b1263d5dc79fa9953629d30d Mon Sep 17 00:00:00 2001
From: Martin Sehnoutka <msehnout@redhat.com>
Date: Fri, 8 Apr 2016 15:03:16 +0200
Subject: [PATCH 1/7] vsftpd-3.0.2-seccomp
---
tunables.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tunables.c b/tunables.c
index 93f85b1..b024be4 100644
--- a/tunables.c
+++ b/tunables.c
@@ -232,7 +232,7 @@ tunables_load_defaults()
tunable_isolate_network = 1;
tunable_ftp_enable = 1;
tunable_http_enable = 0;
- tunable_seccomp_sandbox = 1;
+ tunable_seccomp_sandbox = 0;
tunable_allow_writeable_chroot = 0;
tunable_accept_timeout = 60;
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Remove the ftpmail script to avoid confusion
about it fails to run because it lacks a dependency
on Mail/Sendmail.pm which is not shipped by default.
Also it has not been maintained for more than 10 years as
http://search.cpan.org/~mivkovic/Mail-Sendmail/Sendmail.pm.
* And it's bad to add the dependency perl module
Mail/Sendmail.pm as it's too old and also send email to
Proftp-devel@lists.sourceforge.net to ask guidance about
ftpmail as below:
Q: In my environment, the ftpmail fails to run as
it lacks the dependency on Mail/Sendmail.pm which
is not shipped by default and also not maintained more
than 10 years as
http://search.cpan.org/~mivkovic/Mail-Sendmail/Sendmail.pm.
A: Patches for updates to the ftpmail script are highly
encouraged! If the Mail-Sendmail package is not to
your preference, what would you suggest/prefer using
instead?
We don't plan to do more improvements about the perl module
Mail-Sendmail now since it's not something we, or other distros
apparently need as other distribution also not include the
ftpmail script.
* The ftpmail is initially added as a perl script to send an email
notification when upload proftpd log as below commit in
https://github.com/proftpd/proftpd.git:
commit 8d602d4bf01ef0c6464c7a16dbbe570a0322dc17
Author: castaglia <castaglia>
Date: Thu Mar 6 03:06:14 2008 +0000
Added ftpmail, a Perl script which reads a TransferLog FIFO and sends
automatic email notifications for uploads.
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Use =+ to replace the previous += to let samba-pidl
do package before samba to guarantee the file /usr/bin/pidl
packaged in samba-pidl as both samba and samba-pidl have
rules to package /usr/bin/pidl and the command pidl depends
on perl modules such as Parse/Pidl.pm resides in samba-pidl
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
The thin provisioning tools is runtime dependency,
so disable build time detection.
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* fix build with gcc-6
* add intltool-native to DEPENDS
* add gtk-icon-cache to inherit
Signed-off-by: Andreas Müller <schnitzeltony@googlemail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* inherit systemd
* Add PACKAGECONFIG for systemd and control
it based on DISTRO_FEATURES
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
As the package maintainer said, this is mostly a release with:
"the huge amount of critical bug fixes brought to the library since 2 years"
The full list of bugs fixed and other changes is here:
https://github.com/uclouvain/openjpeg/blob/openjpeg-2.1/CHANGELOG.md
The homepage link was broken so that was fixed.
The project also moved to github and does not appear
to provide tarballs other than via github archives so
the SRC_URI was updated.
An explicit dependency on zlib was added even though cmake was finding
the sysroot version.
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
This fixes following error:
../src/native-state-x11.cpp:63:33: error: invalid suffix on literal; C++11 requires a space between literal and string macro [-Werror=literal-suffix]
static const char *win_name("glmark2 "GLMARK_VERSION);
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
1) Upgrade openvpn from 2.3.8 to 2.3.9.
2) Modify EXTRA_OECONF, Since the Changelog in the new version shows:
Remove --enable-password-save option
Reflect enable-password-save change in documentation
Also remove second instance of enable-password-save in the man page
3) Fix the Warning:
WARNING: openvpn-2.3.9-r0 do_configure: QA Issue: openvpn: configure was passed unrecognised options: --enable-password-save [unknown-configure-option]
Signed-off-by: Wang Xin <wangxin2015.fnst@cn.fujitsu.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* squid-conf-tests is a test to run "squid -k parse -f"
to perse the config files, which should not be run
at build time since we are cross compiling, so remove
it when compiling test-suite
* Fix the directories of the conf files for squid-conf-tests
so that it can run on the target and add it for ptest
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Rebase the patch fix-disable-ipv6.patch
* Add PACKAGECONFIG for ipv6 and ping6 instead of
using noipv6 in EXTRA_OECONF
* Fix the do_install to avoid failure when ipv6
is disable
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* Upgrade lftp from 4.6.3a to 4.7.3
* Add readline and expat to PACKAGECONFIG and update
zlib to add detailed prefix as better configure checks
is included in 4.7.3 as below commit from lftp repo
https://github.com/lavv17/lftp.git
commit c2ef3838421ca954c378d109c0328fdeea3fc89e
Author: Alexander V. Lukyanov <lavv17f@gmail.com>
Date: Mon Dec 14 11:34:38 2015 +0300
use better configure checks for expat, zlib, readline
Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
The current version of ifenslave is 2.6_1.1.0 actually, then update to
2.7 and change the version to 2.7 too.
* update to SRC_URI to the debian git repo
* the license is changed from GPLv2 to GPLv3
* the program is rewrote with shell script
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
