summaryrefslogtreecommitdiffstats
path: root/package/samba4
Commit message (Collapse)AuthorAgeFilesLines
* package/samba4: security bump to version 4.9.5Bernd Kuhls2019-03-252-3/+3
| | | | | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.9.5.html Fixes CVE-2019-3824: ldb: Out of bound read in ldb_wildcard_compare Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> (cherry picked from commit e7d67faac5be820b1c8019eb249adf8765d4cf42) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: security bump to version 4.9.4Bernd Kuhls2019-01-272-3/+3
| | | | | | | | | | | | | | | Fixes the following security issues: - CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression - CVE-2018-16853: Fix S4U2Self crash with MIT KDC build - CVE-2018-16853: Do not segfault if client is not set For more info, see the release notes: https://www.samba.org/samba/history/samba-4.9.4.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Peter: mention security impact, add CVE info] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.9.3Peter Korsgaard2018-11-292-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security vulnerabilities: - CVE-2018-14629: All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue. - CVE-2018-16841: When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. There is no further vulnerability associated with this issue, merely a denial of service. - CVE-2018-16851: During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service. - CVE-2018-16852: During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service. - CVE-2018-16853: A user in a Samba AD domain can crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory we clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. - CVE-2018-16857: AD DC Configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. For more details, see the release notes: https://www.samba.org/samba/history/samba-4.9.3.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: fix install of systemd filesFabrice Fontaine2018-11-251-6/+5
| | | | | | | | | | | | | | | | | Since version 4.8.0 and https://github.com/samba-team/samba/commit/080d590de1ff9f8ebc55aeffaea8d41991466549, the systemd files (nmd.service, ...) are not available in packaging/systemd Indeed, they are built in bin/default/packaging/systemd So use the new --systemd-install-services configure option to install these files Fixes: - http://autobuild.buildroot.org/results/a09a065c523931c1892e81a99c57521fbe095d8b Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: bump version to 4.9.2Bernd Kuhls2018-11-082-3/+3
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.9.2.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: Fix uClibc build on 64bit platforms by including stdint.h, ↵Bernd Kuhls2018-10-031-5/+71
| | | | | | | | | | updated for 4.9.1 Fixes http://autobuild.buildroot.net/results/68f/68f3fb75ba8a2f138e9c3f37b2681b81441e2cd9/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: bump version to 4.9.1Bernd Kuhls2018-09-302-3/+3
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.9.1.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: bump version to 4.9.0Bernd Kuhls2018-09-164-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.9.0.html Added optional dependency to libarchive to fix configure error: Checking for libarchive existence Checking for header archive.h : no /home/buildroot/br5/output/build/samba4-4.9.0/source3/wscript:225: error: libarchive support not found. Try installing libarchive-dev or libarchive-devel. Otherwise, use --without-libarchive to build without libarchive support. libarchive support is required for the smbclient tar-file mode Disabled gpgme support to fix configure error: Checking for program gpgme-config : not found Checking for library gpgme : not found Checking for gpgme_new : not found /home/buildroot/br5/output/build/samba4-4.9.0/source4/dsdb/samdb/ldb_modules/wscript:40: error: GPGME support not found. Try installing libgpgme11-dev or gpgme-devel and python-gpgme. Otherwise, use --without-gpgme to build without GPGME support or --without-ad-dc to build without the Samba AD DC. GPGME support is required for the GPG encrypted password sync feature Buildroot has no python-gpgme package atm so we disable this option for now. Disabled experimental LMDB LDB backend as well, this also needed an addition to samba4-cache.txt. AD DC support needs jansson, for details see release notes. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: bump version to 4.8.5Bernd Kuhls2018-08-244-15/+22
| | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.8.5.html Rebased patches 0001 & 0004. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: Fix uClibc build on 64bit platforms by including stdint.hBernd Kuhls2018-08-241-4/+20
| | | | | | | | | | Patch needed to be updated for samba-4.8.4 Fixes http://autobuild.buildroot.net/results/140/1404a594583ff192d70086ef590f924472465c89/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: security bump to version 4.8.4Bernd Kuhls2018-08-242-3/+3
| | | | | | | | | | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.8.4.html Fixes o CVE-2018-1139 (Weak authentication protocol allowed.) o CVE-2018-1140 (Denial of Service Attack on DNS and LDAP server.) o CVE-2018-10858 (Insufficient input validation on client directory listing in libsmbclient.) o CVE-2018-10918 (Denial of Service Attack on AD DC DRSUAPI server.) o CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP server.) Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: disable build of manpages and documentationBernd Kuhls2018-08-141-0/+116
| | | | | | | | | | Fixes http://autobuild.buildroot.net/results/3f214cbb1fe2dc2c2cbfb630032e13eba81c1b5a/ and many others Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: reformat patch as Git formatted] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: drop patch numbering in patch 0003Thomas Petazzoni2018-08-141-1/+1
| | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: reformat patch 0002 as Git-formatted patchThomas Petazzoni2018-08-141-5/+15
| | | | | | | | This commit reformats 0002-patch-source3__libads__kerberos_keytab.c.patch as a Git-formatted patch. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: bump version to 4.8.3Bernd Kuhls2018-06-303-52/+3
| | | | | | | | | Removed patch applied upstream. Release notes: https://www.samba.org/samba/history/samba-4.8.3.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: bump version to 4.8.2Bernd Kuhls2018-06-092-3/+3
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.8.2.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: depend on host-nfs-utilsBaruch Siach2018-05-271-1/+1
| | | | | | | | | | | | | | host-nfs-utils provides the host rpcgen utility. This fixes the build on recent Fedora systems that removed rpcgen from the glibc package. Fixes: http://autobuild.buildroot.net/results/6f8/6f869b8c7c182dfe7f1a291b5952320504540ebf/ http://autobuild.buildroot.net/results/4c2/4c228dd6369e4fc11b798af6ab2abe06d7473b78/ http://autobuild.buildroot.net/results/489/489be441abd19fba2b0c39357e64a6adcf773b60/ Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: bump version to 4.8.1Bernd Kuhls2018-04-282-3/+3
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.8.1.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* package/samba4: bump version to 4.8.0Bernd Kuhls2018-03-244-5/+56
| | | | | | | Changelog: https://www.samba.org/samba/history/samba-4.8.0.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.7.6Baruch Siach2018-03-133-3/+5
| | | | | | | | | | | | | | | | | | | CVE-2018-1050: Vulnerability to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. https://www.samba.org/samba/security/CVE-2018-1050.html CVE-2018-1057: Authenticated users might change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers). https://www.samba.org/samba/security/CVE-2018-1057.html Add clnt_create() test result to cache to fix cross configure breakage. Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: Fix uClibc build on 64bit platforms by including stdint.hBernd Kuhls2018-01-301-0/+67
| | | | | | | | Fixes http://autobuild.buildroot.net/results/fdd/fdd9bb5bea4488fc9e16746222051156224317a6/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.7.4Bernd Kuhls2018-01-073-2/+33
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.7.4.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* Merge branch 'next'Thomas Petazzoni2017-12-014-6/+10
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This merges the next branch accumulated during the 2017.11 release cycle back into the master branch. A few conflicts had to be resolved: - In the DEVELOPERS file, because Fabrice Fontaine was added as a developer for libupnp in master, and for libupnp18 in next. Resolution is simple: add him for both. - linux/Config.in, because we updated the 4.13.x release used by default in master, while we moved to 4.14 in next. Resolution: use 4.14. - package/libupnp/libupnp.hash: a hash for the license file was added in master, while the package was bumped into next. Resolution: keep the hash for the license file, and keep the hash for the newest version of libupnp. - package/linux-headers/Config.in.host: default version of the kernel headers for 4.13 was bumped to the latest 4.13.x in master, but was changed to 4.14 in next. Resolution: use 4.14. - package/samba4/: samba was bumped to 4.6.11 in master for security reasons, but was bumped to 4.7.3 in next. Resolution: keep 4.7.3. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
| * package/samba4: bump version to 4.7.3Bernd Kuhls2017-11-274-6/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rebased 0001-libreplace-disable-libbsd-support.patch. Added iconv-related entry to samba4-cache.txt to fix configure error: Cross answers file /home/buildroot/test-samba4/armv5-ctng-linux-gnueabi/build/samba4-4.7.3/cache.txt is incomplete with this defconfig BR2_TOOLCHAIN_BUILDROOT_WCHAR=y BR2_PACKAGE_LIBICONV=y BR2_PACKAGE_SAMBA4=y BR2_PACKAGE_SAMBA4_AD_DC=y BR2_PACKAGE_SAMBA4_ADS=y BR2_PACKAGE_SAMBA4_SMBTORTURE=y Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | samba4: ensure that copied cache.txt is writableDanomi Manchego2017-11-291-1/+1
| | | | | | | | | | | | | | | | | | | | If the Buildroot tree is read-only, then cache.txt is copied read-only into the build directory, and the configuration step fails. Fix this in the same way we do in other places, by opening permissions as we copy the file using $(INSTALL). Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | samba4: security bump to version 4.6.11Peter Korsgaard2017-11-222-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: - CVE-2017-14746: All versions of Samba from 4.0.0 onwards are vulnerable to a use after free vulnerability, where a malicious SMB1 request can be used to control the contents of heap memory via a deallocated heap pointer. It is possible this may be used to compromise the SMB server. - CVE-2017-15275: All versions of Samba from 3.6.0 onwards are vulnerable to a heap memory information leak, where server allocated heap memory may be returned to the client without being cleared. There is no known vulnerability associated with this error, but uncleared heap memory may contain previously used data that may help an attacker compromise the server via other methods. Uncleared heap memory may potentially contain password hashes or other high-value data. For more details, see the release notes: https://www.samba.org/samba/history/samba-4.6.11.html Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* | package/samba4: bump version to 4.6.10Bernd Kuhls2017-11-152-2/+2
|/ | | | | | | | | | | | | | | Quoting release notes https://www.samba.org/samba/history/samba-4.6.10.html "This is an additional bugfix release to address a possible data corruption issue. Please update immediately! For details, please see https://bugzilla.samba.org/show_bug.cgi?id=13130 Samba 4.6.0 and newer is affected by this issue." Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.6.9Bernd Kuhls2017-10-282-2/+3
| | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.9.html Added license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: security bump to version 4.6.8Bernd Kuhls2017-09-212-2/+2
| | | | | | | | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.8.html Fixes - CVE-2017-12150 (SMB1/2/3 connections may not require signing where they should) - CVE-2017-12151 (SMB3 connections don't keep encryption across DFS redirects) - CVE-2017-12163 (Server memory information leak over SMB1) Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: bump version to 4.6.7Bernd Kuhls2017-08-192-2/+2
| | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.7.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.6.6Bernd Kuhls2017-08-022-2/+2
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: add optional dependency to dbusBernd Kuhls2017-08-021-0/+4
| | | | | | | | | | | | | | samba4 picks up dbus as dependency if it was built before: Checking for dbus : yes Checking for header dbus/dbus.h : yes Checking for library dbus-1 : yes There is no configure option to control dbus support so we just make sure dbus is built before samba4 to have reproducible builds. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: allow to use libtirpc instead of internal C implementationBernd Kuhls2017-08-022-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows building samba4 with uClibc again after rpc support was removed from uClibc. Building with musl is still broken: The first error ../nsswitch/wins.c: In function ‘_nss_wins_gethostbyname_r’: ../nsswitch/wins.c:272:15: error: ‘NETDB_INTERNAL’ undeclared (first use in this function) *h_errnop = NETDB_INTERNAL; ^~~~~~~~~~~~~~ ../nsswitch/wins.c:272:15: note: each undeclared identifier is reported only once for each function it appears in ../nsswitch/wins.c:349:14: error: ‘NETDB_SUCCESS’ undeclared (first use in this function) *h_errnop = NETDB_SUCCESS; ^~~~~~~~~~~~~ could be solved by applying https://git.alpinelinux.org/cgit/aports/tree/main/samba/netdb-defines.patch but then the build fails at ../ctdb/tests/src/test_mutex_raw.c: In function ‘main’: ../ctdb/tests/src/test_mutex_raw.c:170:28: error: ‘pthread_mutex_t {aka struct <anonymous>}’ has no member named ‘__data’ printf("pid=%u\n", mutex->__data.__owner); ^~ Therefore we disable musl support until a fix can be found. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: - instead of setting SAMBA4_CONF_ENV within the libtirpc condition, introduce SAMBA4_CFLAGS and SAMBA4_LDFLAGS variables and use them - add missing dependency on host-pkgconf, needed because we call pkg-config to get the flags from libtirpc] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: security bump to version 4.5.12Bernd Kuhls2017-07-132-2/+2
| | | | | | | | | | | | | | | | | Fixes CVE-2017-11103: All versions of Samba from 4.0.0 onwards using embedded Heimdal Kerberos are vulnerable to a man-in-the-middle attack impersonating a trusted server, who may gain elevated access to the domain by returning malicious replication or authorization data. Samba binaries built against MIT Kerberos are not vulnerable. https://www.samba.org/samba/history/samba-4.5.12.html [Peter: add CVE info] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: use the new gettext logicThomas Petazzoni2017-07-051-7/+2
| | | | | | | | This commit switches to use the new gettext logic, which involves using TARGET_NLS_DEPENDENCIES instead of hand-encoded dependencies on gettext/host-gettext. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: security bump to version 4.5.10Bernd Kuhls2017-05-292-2/+2
| | | | | | | | Fixes CVE-2017-7494: https://www.samba.org/samba/history/samba-4.5.10.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/gnutls: disable for static buildBernd Kuhls2017-05-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The gnutils code uses __attribute__((constructor)) and __attribute__((destructor)) to call constructor/desctructor when a shared library is loaded. Constructor/desctructor are not used when a static library is used (except when if -Wl,--whole-archive -lgnutls -Wno-whole-archive is used, not tested). Even if gnutls initialization (_gnutls_global_init()) may be called manually, the gnutls maintainer said it's not supported [1]. "Note that static linking applications with gnutls is not something supported. gnutls relies on library constructors and destructors which are not loaded when linking statically." Now the gnutls script warns about static linking [2]. So disable gnutls statically by adding "depends on !BR2_STATIC_LIBS" at Kconfig level and --disable-static in GNUTLS_CONF_OPTS. Fixes: [taskd] http://autobuild.buildroot.net/results/c2d/c2dd5c1c9dc87d2943c15e58ee56e67d7375368c [ffmpeg] http://autobuild.buildroot.net/results/892/8926d319d6d1cd1ee72239ad7d9ca869d2355628 [sngrep] http://autobuild.buildroot.net/results/f7f/f7fb42d3742f6f01000a0d181e0c785640284405 [1] https://gitlab.com/gnutls/gnutls/issues/203 [2] https://gitlab.com/gnutls/gnutls/commit/6b748886799f88ddee9721dba4fc4d52854832ae Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Romain: merge our two patches together add some option comment disable static libgnutls.a add sngrep autobuilder reference] Signed-off-by: Romain Naour <romain.naour@gmail.com> Tested-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: do not disable libgnutls.a] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/samba4: bump version to 4.5.8Bernd Kuhls2017-04-292-2/+2
| | | | | | | | Version bump includes a regression fix: https://www.samba.org/samba/history/samba-4.5.8.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boot, package: use SPDX short identifier for GPLv3/GPLv3+Rahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | | We want to use SPDX identifier for license string as much as possible. SPDX short identifier for GPLv3/GPLv3+ is GPL-3.0/GPL-3.0+. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv3\>/GPL-3.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: security bump to version 4.5.7Peter Korsgaard2017-03-282-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2017-2619: All versions of Samba prior to 4.6.1, 4.5.7, 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition. Samba uses the realpath() system call to ensure when a client requests access to a pathname that it is under the exported share path on the server file system. Clients that have write access to the exported part of the file system via SMB1 unix extensions or NFS to create symlinks can race the server by renaming a realpath() checked path and then creating a symlink. If the client wins the race it can cause the server to access the new symlink target after the exported share path check has been done. This new symlink target can point to anywhere on the server file system. This is a difficult race to win, but theoretically possible. Note that the proof of concept code supplied wins the race reliably only when the server is slowed down using the strace utility running on the server. Exploitation of this bug has not been seen in the wild. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* ncurses: remove BR2_PACKAGE_NCURSES_TARGET_{FORM, MENU, PANEL} optionsThomas Petazzoni2017-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ncurses sub-options BR2_PACKAGE_NCURSES_TARGET_{FORM,MENU,PANEL} are currently very badly broken: they only control whether the libform, libmenu and libpanel libraries are installed in $(TARGET_DIR), but do absolutely nothing about their installation in $(STAGING_DIR). This means that when one of those options is disabled, the corresponding library is indeed not installed in the target, but is available in staging. It can therefore be detected by the configure script of another package and used... even though the library will not be in the target, causing a runtime failure. Internally, ncurses.mk uses the "make install" logic of ncurses for the staging installation, but uses a completely hand-written logic for the target installation, which is the reason for this desynchronization between what's installed in staging and target. When BR2_PACKAGE_NCURSES_WCHAR=y, this also causes some build failures. Indeed, when BR2_PACKAGE_NCURSES_WCHAR=y, Buildroot creates some symbolic links lib<foo>.so -> lib<foo>w.so in staging and target, but only for the lib<foo> that have been enabled by BR2_PACKAGE_NCURSES_TARGET_{FORM,MENU,PANEL}. Due to this, a package that for example needed the libmenu library but forgot to select BR2_PACKAGE_NCURSES_TARGET_MENU was: - Building fine with BR2_PACKAGE_NCURSES_WCHAR disabled (because libmenu.so exists in staging), but would fail to run at runtime because libmenu.so is not in the target. - Fail to build with BR2_PACKAGE_NCURSES_WCHAR=y because only libmenuw.so exists, and not the libmenu.so symbolic link. Since those libraries are small (43K for libform, 21K for libmenu and 8.2K for libpanel), this commit takes the very simple approach of removing those options, and installing the libraries unconditionally. It therefore uses the "make install" logic for both the staging *and* target installation. In detail, this commit: - Removes the NCURSES_PROGS variable, not needed since --without-progs already allows to disable the build and installation of programs. - Removes the NCURSES_LIBS-y variable, and replaces it with a single unconditional assignement to NCURSES_LIBS, only used to create the lib<foo>w.so -> lib<foo>.so symbolic links when wchar support is enabled. - Removes NCURSES_INSTALL_TARGET_CMDS and the functions it was calling: NCURSES_INSTALL_TARGET_LIBS and NCURSES_INSTALL_TARGET_PROGS. - Adds a NCURSES_TARGET_SYMLINK_RESET hook to create the reset -> tset symbolic link, as was done before. - Adds a NCURSES_TARGET_CLEANUP_TERMINFO to cleanup the terminfo files in the target, so that we stay in the same situation in terms of installed terminfo files. - Removes the BR2_PACKAGE_NCURSES_TARGET_{FORM,MENU,PANEL} options from the Config.in files: both their definition and usage. - Simplifies all the symlink dance for lib<foo> -> lib<foo>w, because as Yann E. Morin suggested, this dance is only needed in staging, not in the target. Once binaries have been built, they refer to the SONAME of the library, which is the lib<foo>w variant (for shared linking). For static linking and .pc files, it's obvious that we don't care about them on the target. Therefore the NCURSES_LINK_LIBS_STATIC, NCURSES_LINK_LIBS_SHARED and NCURSES_LINK_PC functions no longer take any argument: they always apply to STAGING_DIR only. NCURSES_LINK_TARGET_LIBS is removed. It is worth mentioning that adding Config.in.legacy support is *NOT* necessary. Indeed: - If they were disabled before this patch, having them in Config.in.legacy would not trigger the legacy warning. - If they were enabled before this patch, then the behavior is unchanged: all libraries are now unconditionally installed. So there is no point in warning the user. We double-checked the installed size of a filesystem containing just ncurses before and after this patch, and the only folder that has its size changed is /usr/lib, growing from 852 KB to 932 KB in the wchar enabled case. That's a 80 KB system size increase. This commit fixes the sngrep build failure and potentially numerous runtime issues with ncurses. Fixes: http://autobuild.buildroot.net/results/7b5db21a6c568e6c6c8fe2b5d5a2f5ca24df510c/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: requires NPTLWaldemar Brodkorb2017-02-181-3/+3
| | | | | | | | | | | | | With OpenRISC there is a uClibc-ng based toolchain for an architecture with MMU support, but with only Linuxthreads and no NPTL. Samba4 uses pthread_mutexattr_setrobust which is not implemented in uClibc-ng Linuxthreads. Fixes: http://autobuild.buildroot.net/results/ec8f078046c92ae23dc973c88ac0fef136ad1535 Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.5.5Gustavo Zacarias2017-01-302-3/+3
| | | | | | | Switch download URL to match the website and avoid issues. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: update comments for reverse dependencies of util-linuxRahul Bedarkar2017-01-281-1/+1
| | | | | | | | | | | | | | | | | | Commit 006a328ad6be ("util-linux: fix build with ncurses") removed dependency on BR2_USE_WCHAR, but failed to update the reverse dependencies of util-linux. This commit updates comments in Config.in for BR2_USE_WCHAR for reverse dependencies of util-linux which directly uses wchar now or when it is pulled from other dependencies. eudev doesn't use wchar directly, but needs C99 compiler. Autotools generate code with wchar_t for checking C99 compiler. Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* samba4: update answer cacheGustavo Zacarias2017-01-271-0/+1
| | | | | | | | | Some toolchain/package combinations require an additional touch (answer) in the cache file. Fixes: http://autobuild.buildroot.net/results/426/4266a1690b85bde8da130a84845d1985128bda63/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.5.4Gustavo Zacarias2017-01-243-11/+25
| | | | | | | | Drop libbsd support, it's problematic and doesn't bring in any greater benefit. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.9Gustavo Zacarias2017-01-042-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.4.8Gustavo Zacarias2016-12-192-2/+2
| | | | | | | | | | | | | Fixes: CVE-2016-2123 - Samba NDR Parsing ndr_pull_dnsp_name Heap-based Buffer Overflow Remote Code Execution Vulnerability. CVE-2016-2125 - Unconditional privilege delegation to Kerberos servers in trusted realms. CVE-2016-2126 - Flaws in Kerberos PAC validation can trigger privilege elevation. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.7Gustavo Zacarias2016-10-272-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: bump to version 4.4.6Gustavo Zacarias2016-09-242-2/+2
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud