This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277
See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
(From OE-Core daisy rev: de596b5f31e837dcd2ce991245eb5548f12d72ae)
(From OE-Core rev: 1e155330f6cf132997b91a7cfdfe7de319410566)
Signed-off-by: Catalin Popeanga <Catalin.Popeanga@enea.com>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Follow up bash42-049 to parse properly function definitions in the
values of environment variables, to not allow remote attackers to
execute arbitrary code or to cause a denial of service.
See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
(From OE-Core daisy rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa)
(From OE-Core rev: 5a802295d1f40af6f21dd3ed7e4549fe033f03a0)
Signed-off-by: Catalin Popeanga <Catalin.Popeanga@enea.com>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187
(From OE-Core daisy rev: 153d1125659df9e5c09e35a58bd51be184cb13c1)
(From OE-Core rev: bdfe1e3770aeee9a1a7c65d4834f1a99820d3140)
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a followup patch to incomplete CVE-2014-6271 fix code execution via
specially-crafted environment
This patch changes the encoding bash uses for exported functions to avoid
clashes with shell variables and to avoid depending only on an environment
variable's contents to determine whether or not to interpret it as a shell
function.
(From OE-Core daisy rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45)
(From OE-Core rev: af1f65b57dbfcaf5fc7c254dce80ac55f3a632cb)
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bash_4.2 recipe was missed when the fix was backported to the dora
branch.
Patch from OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc
by Khem Raj <raj.khem@gmail.com>
(From OE-Core rev: a71680ec6e12c17159336dc34d904cb70155d0d7)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bash_4.2 recipe was missed when the fix was backported to the dora
branch.
Patch based on the one from OE-Core master rev
798d833c9d4bd9ab287fa86b85b4d5f128170ed3 by Ross Burton
<ross.burton@intel.com>, with the content replaced from the
appropriate upstream patch.
(From OE-Core rev: 74d45affd5cda2e388d42db3322b4a0d5aff07e8)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a followup patch to incomplete CVE-2014-6271 fix
code execution via specially-crafted environment
Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed
(From OE-Core master rev: 76a2d6b83472995edbe967aed80f0fcbb784b3fc)
(From OE-Core rev: 1c8f43767c7d78872d38652ea808f30ea825bbef)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2014-6271 aka ShellShock.
"GNU Bash through 4.3 processes trailing strings after function definitions in
the values of environment variables, which allows remote attackers to execute
arbitrary code via a crafted environment."
(From OE-Core master rev: 798d833c9d4bd9ab287fa86b85b4d5f128170ed3)
(From OE-Core rev: 05eecceb4d2a5821cd0ca0164610e9e6d68bb22c)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
== is a bashism use = instead.
(Based on OE-Core master rev: c90d1047c41148cbd57f26b5a34563346602a71b)
(From OE-Core rev: 9981f760ac890d01a07db8faa24ceee2bea78b62)
Signed-off-by: Stefan Stanacar <stefanx.stanacar@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core master rev: 1d6caef7222d0c1086a08a109ea4135a388c88e6)
(From OE-Core rev: f9b4ca8304a657f167cc78055631e9b0b996a28e)
Signed-off-by: Krzysztof Sywula <krzysztof.m.sywula@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core master rev: fb9b12121f97f59d92ec2b8fdbe0e68f336f0576)
(From OE-Core rev: c560ada1bc2aa127b7dd7bf10722c90c10c7dcc4)
Signed-off-by: Christopher Larson <kergoth@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
xinetd does not enforce the user and group configuration directives
for TCPMUX services, which causes these services to be run as root
and makes it easier for remote attackers to gain privileges by
leveraging another vulnerability in a service.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4342
the patch come from:
https://bugzilla.redhat.com/attachment.cgi?id=799732&action=diff
(From OE-Core master rev: c6ccb09cee54a7b9d953f58fbb8849fd7d7de6a9)
(From OE-Core rev: 478b7f533c6664f1e4cab9950f257d927d32bb28)
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ltp installs 2 different runtests_noltp.sh files from different
directories into /opt/ltp/testcases/bin/runtests_noltp.sh
last one installed wins and causes unexpected changes in
buildhistory's files-in-image.txt report, rename them to have
unique name as other ltp scripts have.
* also define PREFERRED_PROVIDER to resolve note shown when
building with meta-oe layer:
NOTE: multiple providers are available for ltp (ltp, ltp-ddt)
NOTE: consider defining a PREFERRED_PROVIDER entry to match ltp
* use patch generated without -M
in my builds both versions worked, but Saul reported that it fails to
apply with:
Applying patch
0001-Rename-runtests_noltp.sh-script-so-have-unique-name.patch
patch: **** Only garbage was found in the patch input.
Now I've see the same issue on different builder (with Ubuntu 12.04).
(From OE-Core master rev: ec3bb2c2203b2e8bafc1a631f623f858779e20b7)
(From OE-Core rev: 198623d80d31f19c963e61d03cbcb12dd318dfdf)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
buildtest-TESTS is a phony target and does nothing which results in a
do_install error since the tests aren't built. Since there isn't
a suitable make target but the number of tests are small, hardcode
the two to build to unbreak the build when ptest is enabled.
(From OE-Core master rev: 5dd8653fdcda5e0e8b4f3c37a46f357bc97ec66c)
(From OE-Core rev: b9b213b43c5ff6aa7c04733ce035fc9832065328)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
*PPC64 uses long long for u64 in the kernel, but powerpc's asm/types.h
prevents 64-bit userland from seeing this definition, instead defaulting
to u64 == long in userspace.
*fix the below error
|super-ddf.c:4542:5: error: format '%llu' expects argument of type 'long long unsigned int',
|but argument 5 has type '__u64' [-Werror=format=]
|dprintf("BVD %u has %08x at %llu\n", 0,
(From OE-Core master rev: d3caab6eb03264b4f4d744f914598022299011ba)
(From OE-Core rev: c5e59e68efcf2a3f902dbfd827da57ed3e8ad4ce)
Signed-off-by: Chunrong Guo <B40290@freescale.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This check was looking for /run/mdadm on the host system, this check is optional so disable it.
[YOCTO #5447]
(From OE-Core master rev: d62882794890eeee8e8d5c9ba4837ec77a58d787)
(From OE-Core rev: 6c212e229ba1be0c536e7c36ebe2a3e8b2ef84b4)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Allow the user to provide additional packages to this image.
This lets core-image-basic behave like all other core-image*
recipes (which do support CORE_IMAGE_EXTRA_INSTALL), as well
as match the documentation which suggests this as the mode to
extend any core-image* image.
v2 - drop redundant setting of CORE_IMAGE_EXTRA_INSTALL
(From OE-Core master rev: 5faabf398819d40b55c46bc83ae03942d115024b)
(From OE-Core rev: cdda59d2850b163ced4dfc847c4e114f8592ae52)
Signed-off-by: Gary Thomas <gary@mlbassoc.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When using the tar executable in the buildtools, tar will execute
gzip. If this happens before zlib-native is built, then the gzip
on the host will be used and can fail if the libz in the buildtools
is not compatible. Adding pigz to the build tools avoids this host
contamination.
(From OE-Core master rev: af6424e8c2bf3a938fddabc669c0956d68964ed0)
(From OE-Core rev: dd9945dd510d6e7764721bec5573591a0ad69ba4)
Signed-off-by: Konrad Scherer <Konrad.Scherer@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core master rev: 89d7d46947d9bb8c7bf568c65e52d5bbe159027f)
(From OE-Core rev: 7c6504c6c059ba6b37f88143801ac8137267cf83)
Signed-off-by: Konrad Scherer <Konrad.Scherer@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
this init script fails when the default shell is busybox sh. This
is because busybox sh doesn't set the UID. No other init scripts
in oecore feel the need to check the UID so just remove the check.
(From OE-Core master rev: dd6a45536043af34c05a699e468cef4845f7affd)
(From OE-Core rev: 11385321982411d3d1c2aa663b2b2d195c74f353)
Signed-off-by: Jack Mitchell <jmitchell@cbnl.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Buffer used for copying a "%c" character was getting
out of scope when it was required by the sprintf operation.
[YOCTO #5272]
(From OE-Core rev: c7de71813c8f47438f44749136877442cf73d536)
Signed-off-by: Marius Avram <marius.avram@intel.com>
Signed-off-by: Irina Patru <irina.patru@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a second in a series of patches to enable
offline rootfs creation from a package repository.
Some postinstall cmds are Yocto specific and needed to create a
rootfs with pre and post install hooks successfully run,
using only the toolchain tarball + a package repo.
End goal is to create a sandbox where users of a Yocto
based distribution can customize a rootfs from a package feed
with their package manager of choice.
With this patch, I can successfully create packagegroup-core-boot
with only the toolchain tarball(OPKG). More fixes for a few postinstall
hooks outside of packagegroup-core-boot will come next.
(From OE-Core rev: f90e1a45a042468e4e9a0fc91b57c6dba6f7adc9)
Signed-off-by: David Nyström <david.nystrom@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The po.m4 file is deleted by the more recent autotools.bbclass
autotools_do_configure code which handles gettext. There is therefore
no point in patching the file anymore.
(From OE-Core rev: 986c660cdb34e23a9c72f219db9363a6b4e4b7ec)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The po.m4 file is deleted by the more recent autotools.bbclass
autotools_do_configure code which handles gettext. There is therefore
no point in patching the file anymore.
(From OE-Core rev: c3265281c3ab0979ec2753eb7580c39b005d5fa9)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since we dont use prelude in OE, we just disable autodetection of
prelude in the libpam configuration.
Seems like an old bug:
http://lists.openembedded.org/pipermail/openembedded-devel/2012-March/083804.html
(From OE-Core rev: 9096c6a46cf2467c90873c235b4533faf97d6175)
Signed-off-by: David Nyström <david.nystrom@enea.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
So that sysvinit images don't warn on every login only add it to common-session
if systemd is a DISTRO_FEATURE.
[ YOCTO #3805 ]
(From OE-Core rev: 3ccb0855a7a6b147e5025855c6376747ba72986a)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In busybox, util-linux and shadow, su has been moved to /usr/bin/,
but lsb cmdchk needs su in /bin.
Move su to /bin could fix this issue.
[YOCTO#5175]
(From OE-Core rev: 464d274e45bb94d9990577d85aa5ad02eb5da99c)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The libqt-mt is tested by lsb-dist-checker and lsb-test-desktop,
and it locates in meta-qt3 layer.
So if meta-qt3 is not added, there should be a warning to call
attention; if added, it will add libqt-mt to RDEPENDS.
[YOCTO #5153]
(From OE-Core rev: f646f96015b408f4c6d56998f08178a69ed9f2a6)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The install_initd and remove_initd are linked to /sbin/chkconfig for lsb
core test, but chkconfig has been moved from /sbin to /usr/sbin in order
to fix QA warning about unsafe references in binaries.
(In commit e486242db8)
Let install_initd and remove_initd link to /usr/sbin/chkconfig could fix
this issue.
[YOCTO #5152]
(From OE-Core rev: 789c4c13c5095a2865d1ee1b242141b5b076bed5)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The whiptail package is written by the libnewt recipe so for the python version
we need to ensure its not in PACKAGES.
(From OE-Core rev: b26157a8b575aa7b5c96ffe782fc23ec0920311c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These links were moved to the lsb package because lsbsetup was to be
removed. Subsequently an earlier patch that moved them to chkconfig was
also merged. This results in duplicate installations that generate a
warning when building core-image-lsb under DISTRO=poky-lsb which enables the
linuxstdbase feature.
(From OE-Core rev: 77a0b904e18688ecf81a35544f3a5d6ba0aa61a8)
Signed-off-by: Peter A. Bigot <pab@pabigot.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The sysklogd package hasn't got systemd support yet. So in case of
a systemd based system, the commands and corresponding configuration
files should have a lower priority than that of the busybox's syslogd
and klogd utilities. These two utilities from busybox have internal
systemd support if CONFIG_FEATURE_SYSTEMD is enabled. And that config
item is enabled by default.
[YOCTO #5066]
(From OE-Core rev: 45d18a1b6bcdc56d252b289d0d304b26799943b0)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To support the building of recent kernels in minimal environments, we should
provide bc-native.
(From OE-Core rev: 2138961cc75be2690f2f9b5df8cb2d810dcebc99)
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We do not want libpam to build using audit just
because it happens to be lying around, so we
create PACKAGECONFIG[] data to give us explicit
control.
(From OE-Core rev: 4db6aa2094447f8d2a9c234089a80ddcd78fcbd0)
Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We add PACKAGECONFIG[] data for audit and move
the current pam related stuff into it's own entry.
(From OE-Core rev: ada22cab96bb6b7cc98782a14e7c44fbebde77df)
Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
After stat -h is executed, the return code is 1.
This patch changes it to 0.
(From OE-Core rev: c10435025f5c51c4827d71af82a9a517f5f8f6d8)
Signed-off-by: Zhangle Yang <zhangle.yang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
xprop is called by xdg-utils scripts.
(From OE-Core rev: 58d05c817cf3be071c66c7e4dbbb9942fd7a0752)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When run 'bc -l', it segmentation faults. Apply patch from BLFS to fix it.
Ref:
http://www.mail-archive.com/blfs-support@linuxfromscratch.org/msg04601.html
(From OE-Core rev: ae3158e0cfbfa1f1027976bff34ad502eeb28583)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch needed only with automake-1.13 no longer worked as expected
after texinfo has been updated to version 5.1.
(From OE-Core rev: abda8c052e2c4098c828671c9dd46993c1e81de2)
Signed-off-by: Marko Lindqvist <cazfi74@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport a Debian patch to fix the reading of the
gshadow file in order to make newgrp work correctly.
(From OE-Core rev: 3ef8db6217f7c40a9eb063d21ce6f25b16d88d53)
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
[sgw - tweaked commit message]
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport the patch to fix the error when @enumerate is greater than 10:
mpatrol.texi:6356: bad argument to @enumerate
(From OE-Core rev: 9dca06b16fc10743ed879221fadb836733a9332c)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Catalin Popeanga
Paul Eggleton
Khem Raj
Ross Burton
Stefan Stanacar
Krzysztof Sywula
Christopher Larson
Li Wang
Martin Jansa
Richard Purdie
Chunrong Guo
Saul Wold
Gary Thomas
Konrad Scherer
Jack Mitchell
Marius Avram
David Nyström
Jackie Huang
Hongxu Jia
Muhammad Shakeel
Peter A. Bigot
Chen Qi
Bruce Ashfield
Joe Slater
Zhangle Yang
Cristian Iorga
Kai Kang
Marko Lindqvist
Roy.Li