This vulnerability is also called "rpcbomb".
Backport upstream patch to fix this vulnerability.
CVE: CVE-2017-8779
(From OE-Core rev: 7936c9451eb4c376a78a0ac7461d1b2430c7f1f3)
(From OE-Core rev: bab6667d44df185b4433bcd1c283105966383844)
Signed-off-by: Fan Xin<fan.xin@jp.fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The currnet patches in OE-core doesn't have the "CVE:"
tag, now part of the policy of the patches.
This is patch add this tag to several patches. There might
be patches that I miss; the tag can be added in the future.
(From OE-Core rev: 065ebeb3e15311d0d45385e15bf557b1c95b1669)
Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libtirpc 1.0.1 uses the SVC_XP_AUTH macro to access xp_auth.
Update rpcbind to follow the same way.
(From OE-Core rev: 53176113f7c149279af5b30dd5b48d2fe5fdea07)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
rpcbind: Fix memory corruption in PMAP_CALLIT code
Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in
rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of
service (daemon crash) via crafted packets, involving a PMAP_CALLIT
code.
The patch comes from
<http://www.openwall.com/lists/oss-security/2015/09/18/7>, and it hasn't
been in rpcbind upstream yet.
(From OE-Core rev: cc4f62f3627f3804907e8ff9c68d9321979df32b)
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
While runing:
$ systemctl restart rpcbind
$ systemctl status rpcbind
There are errors like below:
rpcbind[1722]: Cannot open '/tmp/rpcbind.xdr' file for reading, \
errno 2 (No such file or directory)
rpcbind[1722]: Cannot open '/tmp/portmap.xdr' file for reading, \
errno 2 (No such file or directory)
'-w' causes rpcbind to do a "warm start" by read a state file when
rpcbind starts up. The state file is created when rpcbind terminates.
The state file is not always there, the patch refers to:
https://bugs.launchpad.net/ubuntu/+source/rpcbind/+bug/835833
(From OE-Core rev: 3d32a8a1fd90ca68b0d74d86165c8f3668faedcd)
Signed-off-by: Li Wang <li.wang@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Where Signed-off-by statements have been added they were sourced from the
original commit where the author claims creation.
(From OE-Core rev: 3e6f57059d1a5343fe1432fba408ee3f33b4c2f7)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The 0001-uclibc-nss.patch has been applied upstream
in a bit different way but solves the issue at hand
Change-Id: I7312d109d01c08338d4673383e2eaccee219b7bd
(From OE-Core rev: 8b84e778fb481075d245e1d5cc1b3b81024681d5)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Updated 0001-Avoid-use-of-glibc-sys-cdefs.h-header.patch
* Removed 0002-uclibc-rpcsvc-defines.patch since it is already in the
source.
(From OE-Core rev: 713ac3bfbc95e58ce3332409bae838053fdeced8)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
most patches are just removing glibc'ism e.g. using sys/queue.h
of cdefs.h the one patch which is specific to musl
is housed with overrides
Change-Id: Ia15bf6c9c4b562c9392a704ef92e9090aa5f6381
(From OE-Core rev: 5ed97aeeb603506d772d252f97b9b6e02d84ae9a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rpcbind.service requires rpcbind.socket and systemctl tries to add it twice
* see log.do_rootfs:
Started /OE/build/shr-core/tmp-glibc/sysroots/x86_64-linux/usr/bin/systemctl --root=/OE/build/shr-core/tmp-glibc/work/nokia900-oe-linux-gnueabi/shr-image/2.0-r20/rootfs enable rpcbind.service rpcbind.socket
Try to find location of rpcbind.service...
Found rpcbind.service in /lib/systemd/system/rpcbind.service
Also=rpcbind.socket found in rpcbind.service
Started /OE/build/shr-core/tmp-glibc/sysroots/x86_64-linux/usr/bin/systemctl --root=/OE/build/shr-core/tmp-glibc/work/nokia900-oe-linux-gnueabi/shr-image/2.0-r20/rootfs enable rpcbind.socket
Try to find location of rpcbind.socket...
Found rpcbind.socket in /lib/systemd/system/rpcbind.socket
WantedBy=sockets.target found in rpcbind.socket
Enabled rpcbind.socket for sockets.target.
Try to find location of rpcbind.socket...
Found rpcbind.socket in /lib/systemd/system/rpcbind.socket
WantedBy=sockets.target found in rpcbind.socket
ln: failed to create symbolic link '/OE/build/shr-core/tmp-glibc/work/nokia900-oe-linux-gnueabi/shr-image/2.0-r20/rootfs/etc/systemd/system/sockets.target.wants/rpcbind.socket': File exists
Enabled rpcbind.socket for sockets.target.
(From OE-Core rev: 8fe9a735584c7ad458eb000c2008d85ad36ada57)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-rpcbind-rpcuser-not-being-set-in-Makefile.am.patch
which has been merged to 0.2.2
(From OE-Core rev: 07a3ae994b293053c57f38b176e428322fb816bc)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of setting 'Restart=always' in the service file, we should
make the service socket activated, just like what Fedora does.
(From OE-Core rev: 176e91ef28800adb6295b29c455b2efb91a01876)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Exiting with '2' is actually expected with rpcbind, because it catches
SIGTERM and exits with '2' explicitly.
The related code is as follows.
(void) signal(SIGTERM, terminate);
/*
* Catch the signal and die
*/
static void
terminate(int dummy /*__unused*/)
{
close(rpcbindlockfd);
unlink(_PATH_RPCBINDSOCK);
unlink(RPCBINDDLOCK);
syslog(LOG_ERR,
"rpcbind terminating on signal. Restart with \"rpcbind -w\"");
write_warmstart(); /* Dump yourself */
exit(2);
}
(From OE-Core rev: 1bfc6a45e7ba81d3537ea3ae8b176f5a9c206eaa)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These recipes all use pkg-config in some way but were missing
dependencies on the tool, this patch adds them.
(From OE-Core rev: 2543b14dd0ca13005be0df027543431fc8e882ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For security policy, change to run rpcbind daemon with rpc user
just like Redhat does, so set the --with-rpcuser to rpc and add rpc user.
(From OE-Core rev: 52f7a1b403eabc52ca104f752484ec1572f2d9dd)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Instead of manually adding initscripts to RDEPENDS of each package,
we should make it automatically handled by the update-rc.d.bbclass.
This solution would have the benefit of backward compatibility. In
other words, users need not modify their recipes.
This reverts commit 16080a3485.
(From OE-Core rev: f9f193219bd510160b6b09bae652a9dc8ea01e7b)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fix integrates a patch released
after rpcbind 0.2.1 distribution.
0001-rpcbind-rpcuser-not-being-set-in-Makefile.am.patch
fixes the issue of rpcuser not being set in Makefile.am,
which causes rpcbind to immediately exit.
Fixes [YOCTO #5733].
(From OE-Core rev: 68e87652ae4865a52705f8b87b4ae0f99cbc7428)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Now that the initscripts-functions has been packaged separately,
packages which may use the functions script should have a runtime
dependency on it.
(From OE-Core rev: 6690c12cb1977f6bf93f3eb6d471dbd7db81bf28)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Print status messages and exit with proper code. This also allows debian
service script to get rpcbind status correctly.
(From OE-Core rev: f07c2519c4ccfc847d7184d7eada6d7620950277)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
"rpcbind restart" executes stop and then start function. However, if
rpcbind is not started, "exit 0" shall be run in stop function, so start
function will not be run at all. This patch changes "exit 0" to "return 0".
(From OE-Core rev: ce17144b736b364175ab76e19e720292edfd2d81)
Signed-off-by: Zhangle Yang <zhangle.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously, if we switch to runlevel 1 and then switch back to runlevel
5, the network interface will be brought down and the NFS service will
not be restarted correctly.
The problem is that the networking and rpcbind services are brought down
in runlevel 1 but not brought up in runlevel 5.
This patch fixes the above problem. It's based on the assumption that
in sysvinit-based system, runlevel 1 does not have networking support.
This patch adjusts some init script parameters used by update-rc.d. It
makes sure that networking starts before rpcbind which in turn starts
before mountnfs.sh. When switching to runlevel 0, 1 and 6, the umountnfs.sh
is run first before stopping rpcbind service, and the network is brought
down afterwards.
[YOCTO #5513]
(From OE-Core rev: f12e1291b51ba6692b6809570d6a9b73c70a7fe9)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As per OE-Core convention, indentation should be TAB for shell.
(From OE-Core rev: a92376f2daf10baf45d99a3de9502b52cbce8b7e)
Signed-off-by: Muhammad Shakeel <muhammad_shakeel@mentor.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add obsolete_automake_macros.patch that replaces automake macros
no longer supported by automake-1.13 with modern constructs.
(From OE-Core rev: 0f8583e6fe729f8cacc8fec8c66a5c7f7c944947)
Signed-off-by: Marko Lindqvist <cazfi74@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Add init script from debian, tweaked for us
- Move binaries from bindir to sbindir, as debian does
(From OE-Core rev: 8576575ce9a1be8f7bec4e7c018d9be5c3b247df)
Signed-off-by: Christopher Larson <kergoth@gmail.com>
Signed-off-by: Elizabeth Flanagan <elizabeth.flanagan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As discussed on the mailing list, this variable isn't useful and if wanted
would be better implemented by distros using pn-X overrides.
This patch executes:
find . -regex ".*\.\(bb\|inc\)$" | xargs sed -i '/^PRIORITY = ".*"$/d'
against the tree removing the referenced. Thanks to Phil Blundell for
the command.
(From OE-Core rev: d122343362669c683acc4af295971a62cbc823fc)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
hostap: add upstream status for hostap-fw-load.patch
lrzsz: add upstream status for lrzsz's patches
bluez: add upstream status for bluez's patches
bluez-dtl1-workaround: add upstream status for COPYING.patch
libgsmd: add upstream status for gsm's patches.
gypsy: add upstream status for gypsy's patch
libpcap: add upstream status for libpcap's patches
ppp: add upstream status for ppp's patches
libtelepathy: add upstream status for libtelepathy's patches
telepathy-python: add upstream status for telepahty-python's patches
wireless-tools: add upstream status for wireless-tools's patches
wpa-supplicant: add upstream status for wpa-supplicant
zeroconf: add upstream status for zeroconf's patch
glibc: add upstream status for glibc's patches
dpkg: add upstream status for dpkg's patches
makedevs: add upstream status for makedevs's patch
opkg: add upstream status for opkg's patches
opkg-utils: add upstream status for opkg-utils's patch
minicom: add upstream status for minicom patches
rpcbind: add upstream status for rpcbind's patch
which: add upstream status for which's patch
clutter-gst: add upstream status for clutter-gst's patches
flac: add upstream status for flac's patches
gst-ffmpeg: add upstream status for gst-ffmpeg's patch
liba52: add upstream status for liba52's patch
libid3tag: add upstream status for libid3tag
libmusicbrainz: add upstream status for libmusicbrainz's patch
pulseaudio: add upstream status for pulseaudio patches
db: add upstream status for db's patch
neon: add upstream status for neon's patch
taglib: add upstream status for taglib's patches
libetpan: add upstream status for libetpan's patch
libopensync: add upstream status for libopensync's patches
libopensync-plugin-evolution2: add upstream status for its patch
libopensync-plugin-syncml: add upstream status for its patch
libsyncml: add upstream status for libsyncml's patch
empathy: add upstream status for empathy's patch
wv: add upstream status for wv's patch
xournal: add upstream status for xournal's patch
(From OE-Core rev: 0f9f0518ac46c2f2beb0224e881ff136f1603d33)
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Introduce rpcbind utility into poky which is a server that converts
RPC program numbers into universal addresses.
Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Fan Xin
Peter Kjellerstedt
Hongxu Jia
Mariano Lopez
Maxin B. John
Li Zhou
Li Wang
Ross Burton
Khem Raj
Robert Yang
Martin Jansa
Chen Qi
Dan McGregor
Richard Purdie
Jackie Huang
Cristian Iorga
Wenzong Fan
Zhangle Yang
Muhammad Shakeel
Christopher Larson
Marko Lindqvist
Christopher Larson
Saul Wold
Dongxiao Xu
Mark Hatle
Saul Wold