Commit Graph

18935 Commits

Author SHA1 Message Date
Holger Hans Peter Freyther 588357482d initramfs: Do not attempt to put files in /etc/opkg.
The /etc/opkg directory does not exist in the initramfs. Do not
install the feeds.
2014-08-21 13:30:23 +02:00
Holger Hans Peter Freyther e12cf92023 Merge remote-tracking branch 'upstream/dora' into dora 2014-07-30 17:21:49 +02:00
Khem Raj e72727500d binutils: Fix building nativesdk binutils with gcc 4.9
Patches explain the issue in detail but this is exposed
with gcc 4.9 in binutils 2.23.2

(From OE-Core rev: fc5c467b680fc5aef4b0f689e6988e17a9322ae0)

(From OE-Core rev: 4dfb8847ebf8aab90ad8888933468e2899c96998)

(From OE-Core rev: af347d3298e15552d502d5b2ce497bbda9705bc7)

(From OE-Core rev: 07a7228392ec5157616888cee1eb119f4adb39a7)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-27 08:37:49 +01:00
Richard Purdie dc743744d8 build-appliance-image: Update to dora head revision
(From OE-Core rev: 026d26e3b6c2f608cc03aa00fe1fb1ace9e070d8)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-08 16:27:53 +01:00
Richard Purdie 5d1f0c0160 build-appliance-image: Update to dora head revision
(From OE-Core rev: 2bfb8cbe773f6e496ed6192c94a74db1293d72eb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-08 16:23:43 +01:00
Roy Li acb65ef18e opkg: putting the service files into PN
(From OE-Core rev: f0ec7f81c1951211f049c342fd6bd1cad424564a)

[YOCTO #6392]

(From OE-Core rev: b76a5dd195000d157034f1f0a9a35d4ba4680e60)

Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-08 16:16:10 +01:00
Chen Qi c4a539c8c8 populate-extfs.sh: fix to handle special file names correctly
`debugfs' treats spaces and "" specially. So when we are dealing with
file names, great care should be taken to make sure that `debugfs'
recognizes file names correctly.

The basic solution here is:
1. Use quotation marks to handle spaces correctly.
2. Replace "xxx" with ""xxx"" so that debugfs knows that the quotation
   marks are parts of the file name.

[YOCTO #6503]

(From OE-Core rev: 24f17607e996c499c8f86eda0588d02af1e960b9)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-08 16:09:58 +01:00
Richard Purdie 845df01345 libtool-cross/native: Force usage of bash due to sstate inconsistencies
Scenario:
a) libtool script is built on system with bash as /bin/sh
b) machine B installs sstate from build a)
c) machine B has dash as /bin/sh

In this scenario, the script fails to work properly since its expecting
/bin/sh to have bash like syntax and it no longer does have it.

This patch forces the configure process to use /bin/bash, not /bin/sh
and hence allows the scripts to work correctly when used from sstate.

(From OE-Core rev: 24d5b449e5f4d91119f0d8e13c457618811aadfc)

(From OE-Core rev: 330c3085317a0b0981163ff5c41c54596e0d127d)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-03 14:56:45 +01:00
Henning Heinold 2e2a6d0c4e perf: split packging
* some fundamental perf commands can work
  without the dependency on perl, python or bash
  make them separate packages and RSUGGEST them

* bump PR

The patch was sponsored by sysmocom

(From OE-Core rev: a6f79561f7a2f6bc354d5ea8d84b836ac5c9b08f)

Signed-off-by: Henning Heinold <henning@itconsulting-heinold.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-03 13:47:22 +01:00
Henning Heinold a63f07c4ce perf: add slang to the dependencies
* TUI/GUI support was added in 2.6.35 based on libnewt
* since 3.10 slang replaced libnewt completly
* changing TUI_DEFINES is not necessary, because NO_NEWT is
  still respected with newer kernels
* add comment about the gui history to the recipe

The patch was sponsored by sysmocom

(From OE-Core rev: 104e317f1fe68244d31c72897df2e5c997ff502a)

Signed-off-by: Henning Heinold <henning@itconsulting-heinold.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-03 13:47:22 +01:00
Henning Heinold 19f3e362b3 perf: fix broken shell comparsion in do_install
The patch was sponsored by sysmocom

(From OE-Core rev: 7e38d8ad6f7f4c289975acdac5c4d254ff3df7e6)

Signed-off-by: Henning Heinold <henning@itconsulting-heinold.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-03 13:47:22 +01:00
Stéphane Cerveau 4a18e162d8 e2fsprogs: Fix populate-extfs.sh
Fix the use of command dirname on ubuntu 12.04.
dirname does not accept space in file name.

(From OE-Core rev: ab6bd289d51c3c44862b43241a99d3e4f3ff13c0)

Signed-off-by: Stéphane Cerveau <scerveau@connected-labs.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-03 13:47:22 +01:00
Khem Raj 7c3f509c06 prelink: Fix SRC_URI
The SHA we use it actually on cross_prelink branch
if you do not use yocto source mirrors then the fetch
for prelink on dora fails due to missing branch in SRC_URI

(From OE-Core rev: 13b57cab7cdd2bf967622ec5015478dc56938b8b)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24 11:06:32 +01:00
Chen Qi 05f172c745 populate-extfs.sh: keep file timestamps
Fix populate-extfs.sh to keep file timestamps while generating the
ext file systems.

[YOCTO #6348]

(From OE-Core rev: f8c0359edc2ce740e13e874ea189770ff99d1525)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24 11:05:31 +01:00
Mark Hatle 47afe5bcfa rpm: Fix rpm -V usage
[YOCTO #6309]

It appears a logic issue has caused rpm -V to no longer
verify the files on the filesystem match what was installed.

(From OE-Core master rev: 117862cd0eebf6887c2ea6cc353432caee2653aa)

(From OE-Core rev: 9f9bcad51381887819d58ffdde2e41307d342473)

Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24 11:05:31 +01:00
Jonathan Liu c60886f9f5 consolekit: fix console-kit-log-system-start.service startup
console-kit-log-system-start.service fails to to start if the
/var/log/ConsoleKit directory does not exist. Normally it is created
automatically but as we mount a tmpfs at /var/log, we need to add
a tmpfiles.d entry to create it.

(From OE-Core master rev: 2a9a14bf400fe0c263c58aa85b02aba7311b1328)

(From OE-Core rev: 305da37a4dc0fba2b8f3219cfae47a1d4228f244)

Signed-off-by: Jonathan Liu <net147@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24 11:05:31 +01:00
Chen Qi 3ceb90eacd populate-extfs.sh: error out if debugfs encounters some error
Previously, even if we encounter some error when populating the
ext filesystem, we don't error out and the rootfs process still
succeeds.

However, what's really expected is that the populate-extfs.sh script
should error out if something wrong happens when using `debugfs' to
generate the ext filesystem. For example, if there's not enough block
in the filesystem, and allocating a block for some file fails, the
failure should not be ignored. Otherwise, we will have a successful
build but a corrupted filesystem.

The debugfs returns 0 as long as the command is valid. That is, even
if the command fails, the debugfs still returns 0. That's really a
pain here. That's why this patch checks the error output to see whether
there's any error logged.

(From OE-Core rev: 468d3e60ee10348578f78f846e87c02359fdb8bf)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24 11:04:18 +01:00
Chen Qi 8c346a66b5 populate-extfs.sh: fix to handle /var/lib/opkg/alternatives/[[ correctly
There was a patch trying to fix this problem by using 'dirname', but it
caused some build failures, thus got reverted.

The problem is that $DIR might be empty and we should first do the check
before trying to use $(dirname $DIR).

[YOCTO #5712]

(From OE-Core rev: 8277c71747758e2ba0815a6f5cd11c9e0c9c90ce)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24 11:04:18 +01:00
Khem Raj 527868fbfc x264: Update SRCREV to match commit in upstream git repo
It seems that 585324fee380109acd9986388f857f413a60b896 is no
longer there in git and it has been rewritten to
ffc3ad4945da69f3caa2b40e4eed715a9a8d9526

Change-Id: I9ffe8bd9bcef0d2dc5e6f6d3a6e4317bada8f4be
(master rev: b193c7f251542aa76cb5a4d6dcb71d15b27005eb)

(From OE-Core rev: b7371b49b4b83c2e864126480b65363fe9f2cfd2)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Patrick Doyle <wpdster@gmail.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-17 18:00:07 +01:00
Yue Tao 381c6b8957 openssl: fix for CVE-2010-5298
Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL
through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote
attackers to inject data across sessions or cause a denial of service
(use-after-free and parsing error) via an SSL connection in a
multithreaded environment.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-5298

(From OE-Core master rev: 751f81ed8dc488c500837aeb3eb41ebf3237e10b)

(From OE-Core rev: 3cc799213e6528fc9fb4a0c40a01a1817484f499)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-10 17:12:24 +01:00
Paul Eggleton 8ac53f3c2d openssl: fix CVE-2014-3470
http://www.openssl.org/news/secadv_20140605.txt

Anonymous ECDH denial of service (CVE-2014-3470)

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a
denial of service attack.

(Patch borrowed from Fedora.)

(From OE-Core rev: fe4e278f1794dda2e1aded56360556fe933614ca)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-10 17:12:24 +01:00
Paul Eggleton 0ea0a14bd9 openssl: fix CVE-2014-0224
http://www.openssl.org/news/secadv_20140605.txt

SSL/TLS MITM vulnerability (CVE-2014-0224)

An attacker using a carefully crafted handshake can force the use of weak
keying material in OpenSSL SSL/TLS clients and servers. This can be exploited
by a Man-in-the-middle (MITM) attack where the attacker can decrypt and
modify traffic from the attacked client and server.

The attack can only be performed between a vulnerable client *and*
server. OpenSSL clients are vulnerable in all versions of OpenSSL. Servers
are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1. Users
of OpenSSL servers earlier than 1.0.1 are advised to upgrade as a precaution.

(Patch borrowed from Fedora.)

(From OE-Core rev: f19dbbc864b12b0f87248d3199296b41a0dcd5b0)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-10 17:12:24 +01:00
Paul Eggleton bd1a6f3d56 openssl: fix CVE-2014-0221
http://www.openssl.org/news/secadv_20140605.txt

DTLS recursion flaw (CVE-2014-0221)

By sending an invalid DTLS handshake to an OpenSSL DTLS client the code
can be made to recurse eventually crashing in a DoS attack.

Only applications using OpenSSL as a DTLS client are affected.

(Patch borrowed from Fedora.)

(From OE-Core rev: 6506f8993c84b966642ef857bb15cf96eada32e8)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-10 17:12:24 +01:00
Paul Eggleton d6f29c0154 openssl: use upstream fix for CVE-2014-0198
This replaces the fix for CVE-2014-0198 with one borrowed from Fedora,
which is the same as the patch which was actually applied upstream for
the issue, i.e.:

https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=b107586c0c3447ea22dba8698ebbcd81bb29d48c

(From OE-Core rev: 21fa437a37dad14145b6c8c8c16c95f1b074e09c)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-10 17:12:24 +01:00
Paul Eggleton c5d81c3386 openssl: fix CVE-2014-0195
http://www.openssl.org/news/secadv_20140605.txt

DTLS invalid fragment vulnerability (CVE-2014-0195)

A buffer overrun attack can be triggered by sending invalid DTLS fragments
to an OpenSSL DTLS client or server. This is potentially exploitable to
run arbitrary code on a vulnerable client or server.

Only applications using OpenSSL as a DTLS client or server affected.

(Patch borrowed from Fedora.)

(From OE-Core rev: c707b3ea9e1fbff2c6a82670e4b1af2b4f53d5e2)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-10 17:12:23 +01:00
Valentin Popa ad2c79b0fd gnutls: patch for CVE-2014-3466 backported
Backported patch for CVE-2014-3466.
This patch is for dora.

(From OE-Core rev: 68da848e0f7f026bf18707d8d59143177ff66f9b)

Signed-off-by: Valentin Popa <valentin.popa@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-06 10:27:51 +01:00
Maxin B. John 1974599046 openssl: fix CVE-2014-0198
A null pointer dereference bug was discovered in do_ssl3_write().
An attacker could possibly use this to cause OpenSSL to crash, resulting
in a denial of service.

https://access.redhat.com/security/cve/CVE-2014-0198

(From OE-Core rev: 4c58fe468790822fe48e0a570779979c831d0f10)

Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21 09:32:55 +01:00
Saul Wold b626e109e8 build-appliance: Update to Dora 1.5.2
Fix to be HEAD of Dora, not master

(From OE-Core rev: abc158bf873bb7c01414e437eea2b538eb73881c)

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-29 22:46:16 +01:00
Richard Purdie e34b38b723 build-appliance-image: Update to head revision
(From OE-Core rev: d18553830ed3377b40878df1b0bef4e8e109bec3)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-29 18:01:09 +01:00
Hongxu Jia e07904836a make: fix invoking makeinfo failed at do_install time
Reproduce steps:
$ bitbake texinfo-native
$ bitbake make
$ bitbake make -cdevshell
In the devshell:
root:make-3.82# echo "" >> doc/make.texi
root:make-3.82# ../temp/run.do_install

Failed Log:
...
tmp/work/i586-poky-linux/make/3.81-r1/make-3.81/doc/make.texi:8165: @itemx must follow @item
...

Backport from make 4.0 to fix this issue.

[YOCTO #6219]

(From OE-Core rev: b191d869e86c7d4393716eee6ac27aa259d6521c)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-29 17:31:47 +01:00
Valentin Popa c65c136746 mesa: double check for eglplatform.h
Even if 'egl' is in PACKAGECONFIG, mesa egl support
can be disabled explicitly (changing configure flags
using a .bbappend, for example).
On dora, meta-fsl-arm is an example of this kind.
On master there are no known cases, and we should
encourge package configuration through PACKAGECONFIG.

This patch adds another check for the existence
of eglplatform.h before 'sed' can alter it.

(From OE-Core rev: 97bc1bce9a226cc02db8a5afc2c0d4f4f70034a6)

Signed-off-by: Valentin Popa <valentin.popa@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-19 11:04:48 +01:00
Paul Eggleton 99f46fd25c openssl: bump PR
We don't normally do this, but with the recent CVE fixes (most
importantly the one for the serious CVE-2014-0160 vulnerability) I am
bumping PR explicitly to make it a bit more obvious that the patch has
been applied.

(From OE-Core rev: 813fa9ed5e492e5dc08155d23d74127ca87304df)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-11 18:15:34 +01:00
Richard Purdie e5cb267922 sstatesig: Anchor inherits class tests
This avoids a nasty sstate hash corruption issue where the
fact the testimage bbclass was inherited meant that the checksum
changed due to testimage.bbclass being confused with image.bbclass.

This patch anchors the bbclass names to avoid this confusion.

(From OE-Core master rev: 943a75a4f3b6877e4092dae14b59b7afef8cad3d)

(From OE-Core rev: 71b15a41652e280aca2a451073a83a25fb4e6f50)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-11 12:02:50 +01:00
Paul Eggleton b96f0217e4 classes/image: ignore modules.* changing during multilib image construction
Since we now run depmod when building images (as the postinst that does
this is now on kernel-base instead of kernel-image) it is possible to
have module file differences between the two halves of the multilib image,
and the code that checks for such differences detects this and fails.
Whitelist this file to avoid the failure.

Specifically, modules.alias, modules.dep and modules.symbol can differ
along with their .bin counterparts.

Related to fix for [YOCTO #5392].

(From OE-Core master rev: 0a315804bf991664c0948e3024b8e8b9e9085808)

(From OE-Core rev: a2c026cf565897e4b0ba4c31c8762b41361649f4)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-11 12:02:50 +01:00
Paul Eggleton 337de046c8 classes/kernel: move module postinst commands to kernel-base
Since kernel-base is the package that contains the files that depmod
needs to run, we should be running depmod from the kernel-base
postinstall rather than kernel-image.

Fixes [YOCTO #5392].

(From OE-Core master rev: f7d2cb383281ec8dfa90950ba04d87dd29ffc676)

(From OE-Core rev: ac92a5ab25ddfd8462c43bac6f93730b1e454a4f)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-11 12:02:49 +01:00
Richard Purdie 8d0f411fdb sstatesig.py: Fix image regeneration issue
With the "ABI safe" recipes, we've been excluding those from signatures. This
is fine in the general case but in the specific case of image recipes it breaks.

A good test case is the interfaces file. Editting this causes init-ifupdown
to rebuild but not an image containing it (e.g. core-image-minimal).

We need to ensure the checksums are added to the image recipes and this change
does that.

(From OE-Core master rev: fd085f15e7cd093953f974f69277e130174d551d)

(From OE-Core rev: 946ec90c5de1faa18c899e9b45efedc3d47b93bd)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-11 12:02:49 +01:00
Paul Eggleton 609ae39284 openssl: backport fix for CVE-2014-0160
Fixes the "heartbleed" TLS vulnerability (CVE-2014-0160). More
information here:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160

Patch borrowed from Debian; this is just a tweaked version of the
upstream commit (without patching the CHANGES file which otherwise
would fail to apply on top of this version).

(From OE-Core rev: c3acfdfe0c0c3579c5f469f10b87a2926214ba5d)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-09 09:00:40 +01:00
Yue Tao 7f9dd3ff42 Security Advisory - openssl - CVE-2013-6449
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2
obtains a certain version number from an incorrect data structure, which
allows remote attackers to cause a denial of service (daemon crash) via
crafted traffic from a TLS 1.2 client.

(From OE-Core master rev: 3e0ac7357a962e3ef6595d21ec4843b078a764dd)

(From OE-Core rev: 33b6441429603b82cfca3d35e68e47e1ca021fd7)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-09 09:00:40 +01:00
Yue Tao 0cdc1147d3 Security Advisory - openssl - CVE-2013-6450
The DTLS retransmission implementation in OpenSSL through 0.9.8y and 1.x
through 1.0.1e does not properly maintain data structures for digest and
encryption contexts, which might allow man-in-the-middle attackers to
trigger the use of a different context by interfering with packet delivery,
related to ssl/d1_both.c and ssl/t1_enc.c.

(From OE-Core master rev: 94352e694cd828aa84abd846149712535f48ab0f)

(From OE-Core rev: 1e934529e501110a7bfe1cb09fe89dd0078bd426)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-09 09:00:40 +01:00
Yue Tao 2b09b26cb7 Security Advisory - openssl - CVE-2013-4353
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before
1.0.1f allows remote TLS servers to cause a denial of service (NULL
pointer dereference and application crash) via a crafted Next Protocol
Negotiation record in a TLS handshake.

(From OE-Core master rev: 35ccce7002188c8270d2fead35f9763b22776877)

(From OE-Core rev: a5060594208de172cb31ad406b34b25decd061e4)

Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-09 09:00:40 +01:00
Richard Purdie 98bd952a5b Revert "buildhistory_analysis: fix error when comparing image contents"
This reverts commit 5b616aa7b6.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-04 16:16:50 +01:00
Mats Kärrman 75c9f43129 eglibc 2.18: powerpc: Fix time related syscalls
Concatenated fix of PowerPC time related system calls in eglibc 2.18 taken
from upstream glibc. See credits in patch header.

The effect is that some time related system calls returns nothing or garbage.
Fix tested on PowerPC e300c3.

Eglibc 2.17 does not have this issue and the patches are already part of 2.19.

(From OE-Core rev: fae2f635e795d496228dd5d302e99d9ab7706900)

Signed-off-by: Mats Karrman <mats.karrman@tritech.se>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-04 11:54:34 +01:00
Valentin Popa d04d0c0735 mesa: build fix for gallium-egl
(*) add MESA_EGL_NO_X11_HEADERS to defines
(*) avoid altering eglplatform.h from {top_srcdir}/include
using an alternative to
0003-EGL-Mutate-NativeDisplayType-depending-on-config
patch.

[YOCTO #5882]

(From OE-Core rev: 4c6340dba65185acef7301762270fa1dc7e0afda)

Signed-off-by: Valentin Popa <valentin.popa@intel.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-04-04 11:54:34 +01:00
Holger Hans Peter Freyther 57e85e5c37 initscript: Make sure that the alignment script is ran by systemd
systemd does not look at links in rcS.d. Make sure that the script
is available in runlevel 2 as well so it will be used by systemd.
2014-03-31 23:00:24 +02:00
Robert Yang f1276b0662 image_types.bbclass: use 4096 instead of 8192 bytes-per-inode
The image not correctly created if 'ptest-pkgs' is in IMAGE_FEATURES,
this is because there is no free inode left. We can use 4096 instead of
8192 bytes-per-inode to fix the problem, and most of the distributions
us 4096, such as Ubuntu, Suse, Fedora and CentOS.

There are another problems:
* There are error message when there is no free inode left if we run the
  mke2fs command manually, but they are not in log.do_rootfs.

* The image generation doesn't stop when error happens because mke2fs
  doesn't return failed for this case.

Will fix them in other threads.

[YOCTO #5957]

(From OE-Core master rev: 09ab3a00598d06e3a1bf871811c2ac37359c74da)

(From OE-Core rev: ec8ae16e35fd7db6a5bb12412d50ab6f355b0f6e)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-26 17:46:56 +00:00
Hongxu Jia e44e75e576 license.bbclass: fix copying license directories failed
For each recipe, it populated license files to ${LICENSE_DIRECTORY}/${PN},
such as kernel's license dir was ${LICENSE_DIRECTORY}/kernel-3.10.17-yocto-standard;

In do_rootfs task, it copied license directories from ${LICENSE_DIRECTORY}/
${pkg}, and ${pkg} was listed in ${INSTALLED_PKGS};

We got ${INSTALLED_PKGS} by rpm query, such as the kernel were 'kernel-*',
but the kernel's PN was linux-yocto, so searching ${LICENSE_DIRECTORY}/
kernel-* failed.

Copied license directories from ${LICENSE_DIRECTORY}/${PN} fixed this
issue.

[YOCTO #5572]

(From OE-Core rev: 4e00554dfc68b1aad07e161921c27807511420b1)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-25 11:17:20 +00:00
Stefan Stanacar 023c35795f lsbtest: fix comparison bashism
== is a bashism use = instead.

(Based on OE-Core master rev: c90d1047c41148cbd57f26b5a34563346602a71b)

(From OE-Core rev: 9981f760ac890d01a07db8faa24ceee2bea78b62)

Signed-off-by: Stefan Stanacar <stefanx.stanacar@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-13 15:38:08 -07:00
Chen Qi 8d326e6728 iproute2: de-bash its scripts to remove the bash dependency
If we build a minimal image with iproute2 installed, the following
error will appear during rootfs.

error: Can't install iproute2-3.10.0-r0.0@i586: no package provides /bin/bash

The problem is that iproute2 has an implicit dependency on 'bash'.
This dependency is from per-file dependency checking.

Patch two scripts, ifcfg and rtpr, from iproute2 to remove the bash
specific syntax.

[YOCTO #5415]

(From OE-Core master rev: 1132c4210eddd59b22b2640935ab0bb8f48c0124)

(From OE-Core rev: ca55e7321f0c52fbe13d301d0dfe3adff5435639)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-11 07:56:39 -07:00
Sébastien Mennetrier 6c9133d887 libomxil: Fix link issue for gst-omx
gst-omx element can not load due to a missing symbol.
Missing symbol RM_Deinit.

(From OE-Core master rev: 56301698a55bcbab4272b273fd98ce4de84cbfac)

(From OE-Core rev: a77984aef1ef9f351a9ee0a30893e24034ed0aed)

Signed-off-by: Sébastien Mennetrier <s.mennetrier@innotis.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-11 07:56:39 -07:00
Ming Liu a43f60cdea grub: move xz to DEPENDS list from RDEPENDS list
liblzma5 is really requiring by grub, setting RDEPENDS to xz would pull
unneeded xz binaries into rootfs.

(From OE-Core master rev: 78526905999fa38047ae8f3491127cc03de3e3f6)

(From OE-Core rev: 33a352f45ab05f4c81b860b1b369bde429dbff1d)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-11 07:56:39 -07:00