mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-08-30 00:33:19 +00:00
Wang Mingyu
dae9f04be9
Backport from wrynose (8bd9783601). Fixes CVE-2026-41054 (local privilege escalation via command socket credential check bypass). Changelog: =========== * Add ReadWritePaths=/dev/shm to systemd service for semaphore creation under ProtectSystem=full sandboxing * Fix privilege escalation via command socket (CVE-2026-41054) * Check peer credentials before reading command (CVE-2026-41054) * Handle failing opening of semaphore * Fix /dev/shm permissions to use sticky bit * Use chmod after mkdir to ensure correct /dev/shm permissions * Update libtool: add lib64 search paths, remove dead code Tested: Built core-image-full-cmdline for qemux86-64 (scarthgap, bitbake 2.8). Booted in QEMU, verified haveged 1.9.22 starts and provides entropy (entropy_avail=256, pool full). (cherry picked from commit8bd9783601) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Venkatasainath Ravikanti <venkatasainath.ravikanti@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> Assisted-by: Kiro (Amazon) Signed-off-by: Venkatasainath Ravikanti <venkatasainath.ravikanti@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Collection of layers for the OE-core universe
Main layer maintainer: Anuj Mittal anuj.mittal@oss.qualcomm.com
This repository is a collection of layers to suppliment OE-Core with additional packages, Each layer have designated maintainer Please see the respective READMEs in the layer subdirectories