libarchive: Updated libarchive packages fix security vulnerability
Alexander Cherepanov discovered that bsdcpio, an implementation of the "cpio"
program part of the libarchive project, is susceptible to a directory
traversal vulnerability via absolute paths.
(From OE-Core rev: e64a961e9c5e94e643896e4b68b85bd5b4c27470)
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An out of bounds read access in the UTF-8 decoding can be triggered with
a malformed file in the tool less. The access happens in the function
is_utf8_well_formed due to a truncated multibyte character in the sample
file.
The bug does not crash less, it can only be made visible by running less
with valgrind or compiling it with Address Sanitizer.
Version 475 of less contains a fix for this issue. The file version.c
contains some entry mentioning this issue (without any credit):
- v475 3/2/15 Fix possible buffer overrun with invalid UTF-8
The fix is in the file line.c. We derive this patch from:
https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html
Thank Claire Robinson for validating it on Mageia 4 i586. Refer to:
https://bugs.mageia.org/show_bug.cgi?id=15567
(From OE-Core rev: 68994284f3c059b737bfc5afc2600ebd09bdf47f)
Signed-off-by: Junling Zheng <zhengjunling@huawei.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes affecting future time stamps
Egypt will not observe DST in 2015 and will consider canceling it
permanently. For now, assume no DST indefinitely.
(Thanks to Ahmed Nazmy and Tim Parenti.)
Changes affecting past time stamps
America/Whitehorse switched from UTC-9 to UTC-8 on 1967-05-28, not
1966-07-01. Also, Yukon's time zone history is documented better.
(Thanks to Brian Inglis and Dennis Ferguson.)
Change affecting past and future time zone abbreviations
The abbreviations for Hawaii-Aleutian standard and daylight times
have been changed from HAST/HADT to HST/HDT, as per US Government
Printing Office style. This affects only America/Adak since 1983,
as America/Honolulu was already using the new style.
(From OE-Core rev: b9f366ab4e0a9cad69b631f402b9afa02d40f667)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With gcc-5 defaulting to gnu11 C we need to follow
c99 inline semantics
Change-Id: I397520c36c81634556b3f3782aebc532e4a79aed
(From OE-Core rev: 944f94a32577969ee1fc197ab285b0abd9e541fa)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Make skipping expression simpler to check for given libc
Make sure glibc specific items are covered with right override
Change-Id: I8b4a0b7cbfe38ffdc9320f798038c79c7220552b
(From OE-Core rev: 6f4be55ca66b4470aa46c0ae356070ed166f44ce)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Using PERLHOSTLIB as possible, which is same as
${STAGING_LIBDIR_NATIVE}/perl-native/perl/${@get_perl_version(d)}
(From OE-Core rev: 981a054eb352bcdcc2b9450dc24718e6695ac99f)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If NON_INTERACTIVE_LOGIN_SHELLS is defined, all login shells read the
startup files, even if they are not interactive.
This is the behaviour of other major distros like Ubuntu and Fedora.
We also need to set it so that when executing `su -l xxx -c env' command,
/etc/profile is parsed.
[YOCTO #5359]
[YOCTO #7137]
(From OE-Core rev: 33af68d62bb427c588f5eeecb75fbc31b55f8459)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
0001-su.c-fix-to-exec-command-correctly.patch is removed. Below is the reason.
This patch is introduced to solve the 'su: applet not found' problem when
executing `su -l xxx -c env'. The patch references codes of previous release
of shadow. However, this patch introduces bug#5359. So it's not correct.
Let's first look at the root cause of 'su: applet not found' problem.
This problem appears when /bin/sh is provided by busybox.
When executing `su -l xxx -c env' command, the following function is invoked.
execve("/bin/sh", ["-su", "-c", "env"], [/* 6 vars */])
Note that the argv[0] provided to new executable file (/bin/sh) is "-su".
As /bin/sh is a symlink to /bin/busybox. It's /bin/busybox that is executed.
In busybox's appletlib.c, it would examine argv[0], try to find an applet
that has the same name, and then try to execute the main function of the
applet. This logic results in `su' applet from busybox to be executed.
However, we default to set 'BUSYBOX_SPLIT_SUID' to "1", so 'su' is not found.
Further more, even if we set 'BUSYBOX_SPLIT_SUID' to "0", so that 'su' applet
is found. The whole behaviour is still not correct. Because 'su' from shadow
takes higher priority than that from busybox, so 'su' from busybox should never
be executed on such system unless it's specified clearly by the end user.
The logic of busybox's appletlib.c is totally correct from the point of busybox
itself. It's an integration problem.
To solve the above problem, this patch comment out SU_NAME in /etc/login.defs
so that the final function executed in shadow's su is as below.
execve("/bin/sh", ["-sh", "-c", "env"], [/* 6 vars */])
[YOCTO #5359]
[YOCTO #7137]
(From OE-Core rev: 6820f05dad0b4f9b9bbcf7c2a0af8c34f66199ae)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ghostscript application fails to fetch objarch.h file while building for armeb.
The fetch failure is due to absence of this file in the default set of
directories that the OpenEmbedded build system searches (i.e FILESPATH)
for patches and files. This patch adds the required objarch.h file for
armeb in one of the default locations where OpenEmbedded build system searches.
(From OE-Core rev: c520165f8fe7c01865ddb2565908211c0cfd2185)
Signed-off-by: Krishnanjanappa, Jagadeesh <jagadeesh.krishnanjanappa@caviumnetworks.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes affecting future time stamps
Egypt's spring-forward transition is at 24:00 on April's last Thursday,
not 00:00 on April's last Friday. 2015's transition will therefore be on
Thursday, April 30 at 24:00, not Friday, April 24 at 00:00. Similar fixes
apply to 2026, 2037, 2043, etc. (Thanks to Steffen Thorsen.)
Changes affecting past time stamps
The following changes affect some pre-1991 Chile-related time stamps
in America/Santiago, Antarctica/Palmer, and Pacific/Easter.
The 1910 transition was January 10, not January 1.
The 1918 transition was September 10, not September 1.
The UTC-4 time observed from 1932 to 1942 is now considered to be
standard time, not year-round DST.
Santiago observed DST (UTC-3) from 1946-07-15 through 1946-08-31,
then reverted to standard time, then switched its time zone to
UTC-5 on 1947-04-01.
Assume transitions before 1968 were at 00:00, since we have no data
saying otherwise.
The spring 1988 transition was 1988-10-09, not 1988-10-02.
The fall 1990 transition was 1990-03-11, not 1990-03-18.
Assume no UTC offset change for Pacific/Easter on 1890-01-01,
and omit all transitions on Pacific/Easter from 1942 through 1946
since we have no data suggesting that they existed.
One more zone has been turned into a link, as it differed
from an existing zone only for older time stamps. As usual,
this change affects UTC offsets in pre-1970 time stamps only.
The zone's old contents have been moved to the 'backzone' file.
The affected zone is America/Montreal.
(From OE-Core rev: fb45d5079235873c364639c43a15dcb56e075f14)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There should be only one dev and dbg package.
(From OE-Core rev: bc443f009bb34129fb9c092bb9e5ae538e472f66)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is same gnulib fix replicated across needed recipes
Change-Id: I756713407111a726eae98e26c9c1ff64981371c0
(From OE-Core rev: fbe6d2c12aa9f7956bc87efeb68cb64b26b60c7a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: ab45988308bee91c7d600c6adf308fc55858e715)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some lsb packages depend on correct lsb-core-ARCH package being
installed (or rather provided) on the target file system. Provide this
package name by main lsb package.
(From OE-Core rev: 981109b7388dcd0de9fd2e9cdfe2a920b9f8facb)
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
RDEPENDS_${PN} is appended with "sed" and on the following line it's fixed
to just "perl". Merge both lines to have correct RDEPENDS.
(From OE-Core rev: 5519d245dcf698b57949d29fc777928952a3f992)
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It had been disabled because of installed-vs-shipped:
WARNING: /usr/lib/python2.7
WARNING: /usr/lib/python2.7/site-packages
Now we fix it and add cracklib-python back.
(From OE-Core rev: fafa6b8f4444da3c0fc911d3a11eef2cd6ed825c)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Added needed headers and resuffled existing ones to get it portable
Added defined for missing TCOPTS*
Change-Id: I74977dd052c5569b00631379d7f4bacfb86cf381
(From OE-Core rev: d30fba63286dc8f5ac72ac65fae6af6001e58ec2)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is to suppress the following QA warning:
groff-1.22.2: groff requires /bin/sed, but no providers in its RDEPENDS [file-rdeps]
(From OE-Core rev: 1763ff614d11c78bf36d80d27dd6a4f45cbea070)
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There should be only one dev and dbg package.
(From OE-Core rev: 29136f21d33f211fc93c01c06ef636e2f8cdf909)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There should be only one dev and dbg package.
(From OE-Core rev: 8a8e8bf374a7c41a9056f446f11889992fec3448)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 9b2e9a08f3e77b1df604f3d283cac91e7ff7c602)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The rootfs creator automatically removes shadow for read-only
root filesystems, which breaks use of PAM plugins for login and
other process identity management utilities. Package those programs
and config files separately, so they don't get removed.
(From OE-Core rev: a7d8eaef04c9dd6ede8d4efd8c4b776efbe3c767)
Signed-off-by: Matt Madison <matt@madison.systems>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
add more packageconfigs so we can disable
certain features on demand
Add patches to make it more portable
by making posix compliant and libc agnostic code
Change-Id: Ifa1c7f7923322fd22368538310685cd5c440516d
(From OE-Core rev: 6da9a5269782923fe5807b07217ffe19b9fb633e)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If shadow is installed, sulogin from busybox cannot work correctly because
it still assumes that /etc/shadow is not there. This leads to the problem
when booting into rescue mode in an image with shadow installed but not
sulogin from util-linux.
To fix this problem, we add 'util-linux-sulogin' to RDEPENDS of shadow.
This runtime dependency is specific to OE, because we have to ensure
that sulogin can work correctly and sulogin from busybox cannot because
FEATURE_SHADOWPASSWORDS is not enabled by default. And we cannot enable
it by default for busybox, because that would lead to utilities in busybox
to assume the existence of /etc/shadow which is not always true in OE.
[YOCTO #6698]
(From OE-Core rev: 9b45b990d2fc870df556f05908dcb48b9ebcfc02)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* add quotes around possibly empty tz variable
* use exit instead of return, because we're not in function and postinst
fails:
line 9: return: can only `return' from a function or sourced script"
(From OE-Core rev: 87429d37e72b1fd2f329d693b4d1b1229a90e0a2)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The do_configure_prepend is deleted because it doesn't seem to have any
positive effect and it causes the following error.
| aclocal: error: acinclude.m4:133: file 'm4/ax_sys_weak_alias.m4' does not exist
| autoreconf: aclocal failed with exit status: 1
| ERROR: autoreconf execution failed.
(From OE-Core rev: a31d05f7bb60d5431a6e1cd370d7106ae785b0ca)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
most patches are just removing glibc'ism e.g. using sys/queue.h
of cdefs.h the one patch which is specific to musl
is housed with overrides
Change-Id: Ia15bf6c9c4b562c9392a704ef92e9090aa5f6381
(From OE-Core rev: 5ed97aeeb603506d772d252f97b9b6e02d84ae9a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: fd05945ac11a0eea9302e4fba13b6411cf2137fc)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Removed fixsepbuild.patch since it is not needed any more.
(From OE-Core rev: 18c0022628dda83eb2cd73a702df7e277d31211f)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Deliberately simple workload generator for POSIX systems. It imposes
a configurable amount of CPU, memory, I/O, and disk stress on the system.
Moving the package from meta-linaro as a dependency for rt-tests ptest
(From OE-Core rev: ae3d6524f27cc7efad62e7ca3f4a95942a725b28)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update fix_makefile.patch:
* The patch for po/Makefile.in.in is not needed any more since fixed.
* Update the patch for configure.ac
(From OE-Core rev: 2cc2ea51c131f75739470cb8384d931a525bb627)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The installed unpigz is a hardlink to pigz.
(From OE-Core rev: 5017ff434130c62fabb42f8224fb246801f13d0c)
Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes affecting future time stamps
Mongolia will start observing DST again this year, from the last
Saturday in March at 02:00 to the last Saturday in September at 00:00.
(Thanks to Ganbold Tsagaankhuu.)
Palestine will start DST on March 28, not March 27. Also,
correct the fall 2014 transition from September 26 to October 24.
Adjust future predictions accordingly. (Thanks to Steffen Thorsen.)
Changes affecting past time stamps
The 1982 zone shift in Pacific/Easter has been corrected, fixing a 2015a
regression. (Thanks to Stuart Bishop for reporting the problem.)
Some more zones have been turned into links, when they differed
from existing zones only for older time stamps. As usual,
these changes affect UTC offsets in pre-1970 time stamps only.
Their old contents have been moved to the 'backzone' file.
The affected zones are: America/Antigua, America/Cayman,
Pacific/Midway, and Pacific/Saipan.
Changes affecting time zone abbreviations
Correct the 1992-2010 DST abbreviation in Volgograd from "MSK" to "MSD".
(Thanks to Hank W.)
(From OE-Core rev: b00539285ffce0b7d954bc0610c986aa53c8255f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changes affecting code
Fix integer overflow bug in reference 'mktime' implementation.
(Problem reported by Jörg Richter.)
Allow -Dtime_tz=time_t compilations, and allow -Dtime_tz=... libraries
to be used in the same executable as standard-library time_t functions.
(Problems reported by Bradley White.)
Changes affecting commentary
Cite the recent Mexican decree changing Quintana Roo's time zone.
(Thanks to Carlos Raúl Perasso.)
Likewise for the recent Chilean decree. (Thanks to Eduardo Romero Urra.)
Update info about Mars time.
(From OE-Core rev: fbd98e677dcf6324cf713d888aa85c4264f42ec9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There would be an error when the TMPDIR is long/deep, for example when
len(TMPDIR) = 410 while our supported longest value is 410:
aclocal: error: cannot open xxx
autoreconf: aclocal failed with exit status: 1
ERROR: autoreconf execution failed.
Let aclocal use the relative path for the m4 file rather than the
absolute would fix the problem.
[YOCTO #6138]
(From OE-Core rev: 747333764231d0320bdefbcf192b2589e70c58a1)
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Provide and install an initscript for the watchdog package.
In particular:
- watchdog-init.patch adapts redhat initscript to be compatibile with
OpenEmbedded;
- watchdog-conf.patch selects /dev/watchdog as default device;
- changes to the recipe install and configure the initscript.
(From OE-Core rev: 415be16794dfe9122e6eedff950bede2070008ed)
Signed-off-by: Diego Rondini <diego.ml@zoho.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 7efed4d963bd8424af0ddebc3a09226182232759)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 55d0a51a683e00eb129521c74c1d8adc27ce2dea)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Li Zhou
Junling Zheng
Chen Qi
Armin Kuster
Khem Raj
Roy Li
Krishnanjanappa, Jagadeesh
Robert Yang
Dmitry Eremin-Solenikov
Matt Madison
Martin Jansa
Maxin B. John
Andreas Oberritter
Chong Lu
Diego Rondini