This fixes the native build on glibc 2.28 hosts, by backporting two
gnulib patches from master.
(From OE-Core rev: fe7c33cd470d7466be48391b11ea703746812014)
Signed-off-by: Stefan Müller-Klieser <s.mueller-klieser@phytec.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Apply patches to fix CVE-2018-6954
NVD description from https://nvd.nist.gov/vuln/detail/CVE-2018-6954
systemd-tmpfiles in systemd through 237 mishandles symlinks present in
non-terminal path components, which allows local users to obtain
ownership of arbitrary files via vectors involving creation of a
directory and a file under that directory, and later replacing that
directory with a symlink. This occurs even if the fs.protected_symlinks
sysctl is turned on.
Patches from systemd_237-3ubuntu10.13.debian.
These patches shouldn't be required on newer OE releases since they use
systemd v239 or higher.
(From OE-Core rev: 607350d98aa4c65b71fe1f10900e205fad81d1ec)
Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Affects < v240
Based on thud commit d5d2b821fc85b8cf39f683061ac2a45bddd2139f
The second patch in the thud commit doesn't apply against 237. Use the
version of the second patch CVE-2018-16865_2.patch from
systemd_237-3ubuntu10.13.debian.
(From OE-Core rev: da41e48567eb21a47426a6fbe23ea07ce780cd3c)
Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Affects < v240
Based on thud commit 403e74b07b6f3c4a2444e68c74a8434fb17aee49
The patch in the thud commit doesn't compile against 237. Use the
version of this patch, CVE-2018-16864.patch from
systemd_237-3ubuntu10.13.debian.
(From OE-Core rev: ddbe969d0c9052a3ae17ef8f1cec8da847c722d3)
Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport patch to fix the following CVE.
CVE: CVE-2018-15687
Based on thud commit eeb621aa19f690971caf862290a172a115578ba1
The patch in the thud commit doesn't compile against 237. Use the
version of this patch, CVE-2018-15687.patch from
systemd_237-3ubuntu10.13.debian.
(From OE-Core rev: 3e8ba9af58253ed9db0f0376a8e2966e45ee089e)
Signed-off-by: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This regression has been introduced while upgrading to version 237
(commit 906230a73b3ccfa4afd2a19a6b0aa18cd1d5fa08)
and seems to only affect sumo version.
(From OE-Core rev: 665b41d326654235d305649be4be69a1be8dc00b)
Signed-off-by: Matthieu Rogez <matthieu.rogez@fivesgroup.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently these are in ${PN} and ${PN}-syslog may get replaced by
other packages but update-alternatives would error in the postinst
if other files were installed first. Avoid the problems by putting
the links in the correct package.
(From OE-Core rev: ef11c54ba99af261a70ec31091216cdd1556da24)
(From OE-Core rev: a0afcd457af14c3bf3a74514be0e8a029a4fcf63)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The busybox.link.* files are generated from autoconf.h and applets.h,
which are both auto-generated by the build system. The contents of the
two files might be in different order, and so the link files are not
reproducble as is.
Fix this by sorting the lists using `sort`.
(From OE-Core rev: bade7cc344c2f0e9316f973c34e9c9dfcbdbe32d)
(From OE-Core rev: 0f70da971e6e01ed9b669137b3ba39b1898a7dfe)
Signed-off-by: Martin Hundebøll <martin@geanix.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Rationale - excerp from `info chown`
====================================
OWNER‘:’GROUP
If the OWNER is followed by a colon and a GROUP (a group name or
numeric group ID), with no spaces between them, the group ownership
of the files is changed as well (to GROUP).
Some older scripts may still use ‘.’ in place of the ‘:’ separator.
POSIX 1003.1-2001 (*note Standards conformance::) does not require
support for that, but for backward compatibility GNU ‘chown’ supports
‘.’ so long as no ambiguity results. New scripts should avoid the use
of ‘.’ because it is not portable, and because it has undesirable
results if the entire OWNER‘.’GROUP happens to identify a user whose
name contains ‘.’.
(From OE-Core rev: 185918234a07cb506d7d7464a49ac33972c7d963)
(From OE-Core rev: 8105b6384042e04d8bdfaa881370616c6e46acfa)
Signed-off-by: Kosta Zertsekel <zertsekel@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The kernel mounts /proc and /sys with the mode 555. Fedora explicitly
sets this value in its filesystem setup package. Debian doesn't seem
to set it explictly. Having them be 755 causes permission issues on
upgrades inside a container where the guest does not have the
permission to change the modes of the mount points.
So, just bite the bullet and force them to be 555.
(From OE-Core rev: 7e311b0c7222fa9127a96945c9ded7bee5e40eb3)
(From OE-Core rev: 26d5ceb33425fa85bc84b825609e1b45b13d3ddd)
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Even on multilib systems, /usr/lib is where systemd expects the
os-release file to live.
(From OE-Core rev: b7b476efee8c959a0227905e40bd9b5ef493632d)
(From OE-Core rev: 0362788144c3eff36099d8812c85cc70e8736859)
Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* CVE-2018-14404
A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval()
function of libxml2 when parsing invalid XPath expression. Applications processing
untrusted XSL format inputs with the use of libxml2 library may be vulnerable to
denial of service attack due to crash of the application.
Affects libxml <= 2.9.8
CVE: CVE-2018-14404
Ref: https://access.redhat.com/security/cve/cve-2018-14404
(From OE-Core rev: 06d7f9039b005c2112e28336ac1c30e5120ec815)
Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When mount command is executed in rootfs module of initrd, eudev creates
a loop0 device node, applies rules and adds a inotify watch to it. Right
after this step, we execute finish which first tries to kill any running
udevd daemon before doing a switch_root.
In some cases, it is possible that switch_root is executed before
inotify_add_watch was actually processed which would lead to errors like:
| inotify_add_watch(6, /dev/loop0, 10) failed: No such file or directory
Make sure that we process all the events in queue before actually trying
to kill udevd to prevent this race.
Fixes [YOCTO #12861]
(From OE-Core rev: a85c34d263fcf1542bbedcaf1634302466bb20cf)
(From OE-Core rev: 196659ca05623996e2b36f7b1e52195a81fd3bdd)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
os-release (5) recommends that the os-release file be installed in
/usr/lib/os-release and that /etc/os-release be a relative symlink to it.
(From OE-Core rev: 4feb8614ee25a3d3ceb7f5187120a1256a993155)
(From OE-Core rev: 4e67fa950cd3ca6e44d7f46743904d23a756e498)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes issues mainly seen when mounting eMMC devices:
The wildcard /sys/block/${DEVBASE}/${DEVBASE}*1 matches both "mmcblk0p1"
and "mmcblk0boot1" for example, and this results in syntax errors. Fix this
by searching for a "partition" file instead, which only exists for real
partitions and not 'fakes' like the eMMC extra's.
When mount fails, the mountpoint file is left behind, causing later attempts
at auto-mounting it to fail. If mount fails, remove the mountpoint, leaving
the system in the state as it was before the mount attempt.
(From OE-Core rev: 8645c0419456c1bd3ae15a9a7dd2b2e9a960eaf4)
(From OE-Core rev: 38f1648f1472f70a3e747f270cc3230b5993d94b)
Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Move init related configs to init.cfg.
These config items do not make much sense unless busybox is selected
as the init manager. They should belong to init.cfg.
(From OE-Core rev: 4af10fe67a31368163bb5d468ee2c5a85ce0fff3)
(From OE-Core rev: 996247ba7dfffbeb444f793f7e105fcfb5ffa939)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If CONFIG_KLOGD is not enabled, then the related service file should
not be installed, The error message is below:
Cannot add dependency job for unit busybox-klogd.service,
ignoring: Unit busybox-klogd.service failed to load:
No such file or directory.
So we should first check the configuration before we install these
service files.
(From OE-Core rev: c3cc402df996654bf6f838b1e79e16a8bdd6d4d7)
(From OE-Core rev: df1cd90140456dbed0c1bd29ead7c1c81f498b99)
Signed-off-by: Yadi.hu <yadi.hu@windriver.com>
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2017-18018-1:
doc: clarify chown/chgrp --dereference defaults
* doc/coreutils.texi: the documentation for the --dereference
flag of chown/chgrp states that it is the default mode of
operation. Document that this is only the case when operating
non-recursively.
CVE-2017-18018-2:
doc: warn about following symlinks recursively in chown/chgrp
In both chown and chgrp (which shares its code with chown), operating
on symlinks recursively has a window of vulnerability where the
destination user or group can change the target of the operation.
Warn about combining the --dereference, --recursive, and -L flags.
* doc/coreutils.texi (warnOptDerefWithRec): Add macro.
(node chown invocation): Add it to --dereference and -L.
(node chgrp invocation): Likewise.
Affects coreutils <= 8.29
(From OE-Core rev: a523bc6a2ff7d5b5415a789de02fb055ccd2c077)
Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As reported by ChenQi, leaving bits/wordsize.h out of being
multilibbed introduced a problem in building the SDK for
arm64:
Error: Transaction check error:
file /usr/include/bits/wordsize.h conflicts between attempted installs of lib32-libc6-dev-2.27-r0.armv7vet2hf_vfp and libc6-dev-2.27-r0.aarch64
This effectively reverts commit a74c77d6.
(From OE-Core rev: 90ad502bf8faa233e25cf297c1eeefcb0367aea3)
(From OE-Core rev: 056ae940da49b38890c2960651f0fdb5331a5fac)
Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
for core-image-minimal image, missing these two dependency
will cause below warning and error:
warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
./test/icu_parse_test.xml generated an error
(From OE-Core rev: 848031cf0b89b752c6fedcb63fc6938642a87fd8)
(From OE-Core rev: e27b09395c3bd5eb92f0478de03f9738874a7e66)
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixes
ERROR: glibc-locale-2.27-r0 do_package_qa: QA Issue: glibc-locale: /glibc-binary-localedata-hy-am/usr/lib/locale/hy_AM/LC_MEASUREMENT.tmp is owned by uid 3004, which is the same as the user running bitbake. This may be due to host contamination [host-user-contaminated]
(From OE-Core rev: 06d831d12fe2a2366480c79f4c018942937b753a)
(From OE-Core rev: 06003fba975adb1c6c374eb31067bf356cc81baa)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Once another header #includes <bits/wordsize.h>, there is a
potential recursion going on because the
multilib_header_wrapper.h #includes <bits/wordsize.h> again!
This should not happen because an __arm__ (32-bits) or an
__aarch64__ (64-bits) environment guarantees that we will
be getting the correct definition, but when building against
a different target (like BPF), recursion is what happens.
This can be seen, for instance, when building eBPF programs
from the kernel with `clang -target bpf', such as the ones
located in linux/tools/testing/selftests/bpf/.
(From OE-Core rev: a74c77d6168101e88c3a3bce7130f4f52cfab95d)
(From OE-Core rev: 7fe620ed0f9bb0404a1929d9c1c47f432f9a6b37)
Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Aníbal Limón <anibal.limon@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The upstream commit 61f32bff6130a44d077886d38cff89ad161bf177 included in
the release v229 removed the use of the group:
commit 61f32bff6130a44d077886d38cff89ad161bf177
Author: Martin Pitt <martin.pitt@ubuntu.com>
Date: Mon Feb 1 12:09:34 2016 +0100
tmpfiles: drop /run/lock/lockdev
Hardly any software uses that any more, and better locking mechanisms like
flock() have been available for many years.
Also drop the corresponding "lock" group from sysusers.d/basic.conf.in, as
nothing else is using this.
[...]
diff --git a/sysusers.d/basic.conf.in b/sysusers.d/basic.conf.in
index 823d6cb20..b2dc5ebd4 100644
--- a/sysusers.d/basic.conf.in
+++ b/sysusers.d/basic.conf.in
@@ -19,7 +19,6 @@ g wheel - - -
# Access to certain kernel and userspace facilities
g kmem - - -
-g lock - - -
g tty @TTY_GID@ - -
g utmp - - -
[...]
The upstream documentation doc/UIDS-GIDS.md says that basic.conf.in is "the
precise list of the currently defined groups":
## Special `systemd` GIDs
`systemd` defines no special UIDs beyond what Linux already defines (see
above). However, it does define some special group/GID assignments, which are
primarily used for `systemd-udevd`'s device management. The precise list of the
currently defined groups is found in this `sysusers.d` snippet:
[basic.conf](https://raw.githubusercontent.com/systemd/systemd/master/sysusers.d/basic.conf.in)
It's strongly recommended that downstream distributions include these groups in
their default group databases.
Removing the creation of the group also avoids the need to define a GID
for it when using static ids.
(From OE-Core rev: da3659155cd1825a4a8d3d7c5288b4273714de15)
(From OE-Core rev: d3e1ec73a27e0c9305d3c3bd09c141b16d4c7d0d)
Signed-off-by: Hannu Lounento <hannu.lounento@vaisala.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The change "fix hostname conflict with other packages" moved the
hostname util to the list of base_bindir_progs, so do_install_append()
now expects hostname to have been built.
coreutils do_install_append() is shared between target and nativesdk
builds (though not used by native build, see comment) so hostname should
be enabled to build on both of them.
(From OE-Core rev: 57f1f5708306a6121b1172c5163c6566d5bcb89c)
(From OE-Core rev: c936af150459873fe9d135b7d5c2c0d0d9e7745f)
Signed-off-by: S. Lockwood-Childs <sjl@vctlabs.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5f3a3d4063)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously, when dropbear was started via its init script, relocation
of DROPBEAR_RSAKEY_DIR to support read-only rootfs was handled at
run time from within the init script.
Update the init script to take advantage of the read-only rootfs
config setup by read_only_rootfs_hook() and therefore be consistent
with startup under systemd (where relocation of DROPBEAR_RSAKEY_DIR
is handled by the read_only_rootfs_hook() at build time).
(From OE-Core rev: 4990f87b2f6a8b30c8d1c767636e7f5527f595ba)
(From OE-Core rev: b1f3fac327da43ccc079a03d3554f1365b298608)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- fix multiple lzma segmentation faults
- patch includes multiple fixing commits
- test-cases have been removed due to binary data
(From OE-Core rev: e865e5056235a9b4e3911d4c734a3ffa71bb9e62)
(From OE-Core rev: 5e1a402e8cf5e87ea200a04c4218cbd7b8d608d7)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
After installing an image from an iso, booting the system using
the legacy boots makes the grub prompt wait for an enter.
This is not desirable since many of this devices are embedded
devices that should start by them self without user entry.
(From OE-Core rev: f6d85426e48d458d0835d4fd3314ce53ab92bd38)
(From OE-Core rev: c82968498e57fb726b299ff4fff2b61e92e22063)
Signed-off-by: Catalin Enache <catalin.enache@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Minor release primary fixes are
* get it building with gcc8
* Fixes for riscv64
drop local gcc8 support patch which is not needed now
(From OE-Core rev: b02ac5dd2dc27fe742cb7f20a12090eda3190c84)
(From OE-Core rev: 793d613253ea23ee4dc0819591e5c9851e6bd829)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[Fixup for Sumo context, skipped gcc8 fix]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead, first check if we need to do anything at all during first boot,
and if so, either postpone to first boot via pkg_postinst_ontarget()
when running on host, or run the necessary setup code when running on target.
(From OE-Core rev: 16df1717c3813ba773e0dfa2d1db471816d8b99b)
This is a backport from master
(From OE-Core rev: f9f045ce9cbd441375f15911f3535cb1e304ba5b)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Manjukumar Matha <manjukumar.harthikote-matha@xilinx.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie
Stefan Müller-Klieser
Martin Jansa
George McCollister
Marcus Cooper
Chen Qi
ROGEZ Matthieu
Martin Hundebøll
Kosta Zertsekel
Dan McGregor
Sinan Kaya
Anuj Mittal
Zheng Ruoqin
Jagadeesh Krishnanjanappa
Joshua Lock
Mike Looijmans
Yadi.hu
Daniel Díaz
Changqing Li
Khem Raj
Fabio Berton
Christopher Larson
Hannu Lounento
Zhixiong Chi
S. Lockwood-Childs
Andre McCurdy
Andrej Valek
Catalin Enache
Yue Tao
Alexander Kanavin