summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Update for 2017.02.12017.02.1Peter Korsgaard2017-04-052-2/+41
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libselinux: query for python site-packages dir directlyMatt Weber2017-04-041-4/+1
| | | | | | | | | | | | | | | | | | | With the bump to version 2.6, the following commit needs to be taken into consideration for overloading paths. https://github.com/SELinuxProject/selinux/commit/8162f10e670da963eb65ccf1e7de69ea85aba30d The PYLIBVER is no longer used and the PYTHONLIBDIR is renamed to PYSITEDIR with slightly different pathing. More details can be found in the issue ticket which was marked as a non-issue after analysis that a Buildroot fix was the resolution. https://github.com/SELinuxProject/selinux/issues/51 Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 6a6ce10eba24d43412aada7df7de2ab78e8ffee2) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* gst-ffmpeg: work-around bogus configure logic on SPARCThomas Petazzoni2017-04-041-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The libav version built into the gst-ffmpeg code produces a bogus binary on SPARC, which causes the following error of the check-bin-arch script: ERROR: architecture for ./usr/lib/gstreamer-0.10/libgstffmpeg.so is Sparc v8+, should be Sparc ERROR: architecture for ./usr/lib/gstreamer-0.10/libgstpostproc.so is Sparc v8+, should be Sparc ERROR: architecture for ./usr/lib/gstreamer-0.10/libgstffmpegscale.so is Sparc v8+, should be Sparc The problem is the following bit of code in gst-lib/ext/libav/configure: elif enabled sparc; then enabled vis && check_asm vis '"pdist %f0, %f0, %f0"' -mcpu=ultrasparc && add_cflags -mcpu=ultrasparc -mtune=ultrasparc I.e, it checks if the architecture supports the pdist instruction... but forces -mcpu to ultrasparc while doing so. So it's like "let's see if this Ultrasparc instruction exists when I force the compiler to think I'm using Ultrasparc", which is non-sensical. This has been fixed later on in libav upstream: https://git.libav.org/?p=libav.git;a=commit;h=6aa93689abe8c095cec9fa828c2dee3131008995 However, this commit cannot be backported as-is since the shell function check_inline_asm did not exist in the old libav version bundled in gst-ffmpeg. Therefore, we take the simpler route of disabling the VIS optimizations on SPARCv8 and Leon3. Fixes: http://autobuild.buildroot.net/results/e82d179c3d4f92ad7423693a4b1d42379a3f5411/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit d2b73875c3b8a6ec518c1424eaf92c1257fa40aa) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/tyrian: fixes compilation with static libsJulien BOIBESSOT2017-04-041-1/+1
| | | | | | | | | | | | | Has been tested with: "./support/scripts/test-pkg -c tyrian.cfg -p opentyrian" Fixes: http://autobuild.buildroot.net/results/0e2345db82b33f591958fc0f72ad914adafe0522 and some similar previous build failure. Thanks Thomas for the tip ;-). Signed-off-by: Julien BOIBESSOT <julien.boibessot@armadeus.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit dd99f2cb7d10f20568cab22c498a9e1831b5a351) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libsoc: add host-pkgconf dependencyYegor Yefremov2017-04-041-0/+1
| | | | | | | | | | | | | | | | | Without pkg-config PKG_CHECK_MODULES won't be expanded and ./configure script produces following error message: ./configure: line 12237: syntax error near unexpected token `PYTHON,' ./configure: line 12237: ` PKG_CHECK_MODULES(PYTHON, python-"$PYTHON_VERSION")' Fixes: http://autobuild.buildroot.net/results/86e/86e04bd2b10527130306451e56a7693ed4b4befd Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 8975e9f2c77c6861964906e6b5ebd894cdccf45f) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 10}.x seriesFabio Estevam2017-04-031-2/+2
| | | | | | | | [Peter: drop 4.10.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 69356afc81cee7a1b1c749274b26db507133b8d6) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* audiofile: add security patch for CVE-2017-6839Peter Korsgaard2017-04-031-0/+122
| | | | | | | | | | | | | Integer overflow in modules/MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-multiple-ubsan-crashes/ https://github.com/mpruett/audiofile/issues/41 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 844a7c6281eb442881330a5d36d5a0719f2870bf) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* audiofile: add security patch for CVE-2017-6831Peter Korsgaard2017-04-031-0/+42
| | | | | | | | | | | | | Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-imadecodeblockwave-ima-cpp https://github.com/mpruett/audiofile/issues/35 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit bd5f84d301c4e74ca200a9336eca88468ec0e1f3) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* audiofile: add security patch for CVE-2017-6830 / CVE-2017-6834 / ↵Peter Korsgaard2017-04-031-0/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2017-6836 / CVE-2017-6838 CVE-2017-6830: A heap-based buffer overflow in the alaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-alaw2linear_buf-g711-cpp https://github.com/mpruett/audiofile/issues/34 CVE-2017-6834: A heap-based buffer overflow in the ulaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-ulaw2linear_buf-g711-cpp https://github.com/mpruett/audiofile/issues/38 CVE-2017-6836: A heap-based buffer overflow in the Expand3To4Module::run function in libaudiofile/modules/SimpleModule.h in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-expand3to4modulerun-simplemodule-h https://github.com/mpruett/audiofile/issues/40 CVE-2017-6838: Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-multiple-ubsan-crashes/ https://github.com/mpruett/audiofile/issues/41 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 4a1a8277bba490d227f413e218138e39f1fe1203) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* audiofile: add security patch for CVE-2017-6829Peter Korsgaard2017-04-031-0/+39
| | | | | | | | | | | | | The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp https://github.com/mpruett/audiofile/issues/33 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 434890df2a7c131b40fec1c49e6239972ab299d2) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* audiofile: add security patch for CVE-2017-6827 / CVE-2017-6828 / ↵Peter Korsgaard2017-04-031-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2017-6832 / CVE-2017-6833 / CVE-2017-6835 / CVE-2017-6837 CVE-2017-6827: A heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted audio file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-msadpcminitializecoefficients-msadpcm-cpp https://github.com/mpruett/audiofile/issues/32 CVE-2017-6828: A Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-readvalue-filehandle-cpp https://github.com/mpruett/audiofile/issues/31 CVE-2017-6832: A Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-msadpcmdecodeblock-msadpcm-cpp https://github.com/mpruett/audiofile/issues/36 CVE-2017-6833: The runPull function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-divide-by-zero-in-blockcodecrunpull-blockcodec-cpp https://github.com/mpruett/audiofile/issues/37 CVE-2017-6835: The reset1 function in libaudiofile/modules/BlockCodec.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted file. https://blogs.gentoo.org/ago/2017/02/20/audiofile-divide-by-zero-in-blockcodecreset1-blockcodec-cpp https://github.com/mpruett/audiofile/issues/39 CVE-2017-6837: WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients. http://blogs.gentoo.org/ago/2017/02/20/audiofile-multiple-ubsan-crashes/ https://github.com/mpruett/audiofile/issues/41 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit cc00bde57fc20d11f8fa4e8ec5f193c091714c55) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* pcre: add upstream security fixesBaruch Siach2017-04-032-0/+81
| | | | | | | | | | | | | | | Take Debian adapted patches of upstream. Fixes: CVE-2017-6004: crafted regular expression may cause denial of service CVE-2017-7186: invalid Unicode property lookup may cause denial of service Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 3143910eec12a5b23e853b3177bf316ac186b87a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 10}.x seriesFabio Estevam2017-03-311-2/+2
| | | | | | | | [Peter: drop 4.10.x bump] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit c720701c4d3b23e35908319e6ade082c9e5a1433) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* system: do not overwrite /bin/sh Busybox symlinkThomas Petazzoni2017-03-312-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | The BR2_SYSTEM_BIN_SH hidden option defines to what binary the /bin/sh symlinks should point to. If busybox is chosen, then /bin/sh is created to point to /bin/busybox. This works fine with the default installation mode of Busybox, but it fails with the upcoming "individual binaries" mode, in which each applet is installed as its own binary, and /bin/busybox doesn't exist: we get /bin/sh as a broken symlink to /bin/busybox. Since Busybox already installs its own /bin/sh symlink, properly pointing to /bin/ash or /bin/hush depending on the selected shell, it doesn't make sense for the BR2_SYSTEM_BIN_SH logic to override this. Just let Busybox install its own /bin/sh by making BR2_SYSTEM_BIN_SH empty when Busybox shell is selected as /bin/sh. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: Matthew Weber <matthew.weber@rockwellcollins.com> Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit fc91501e6b32ef1b015ac9b0fbf6d64aa1ce0162) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* syslog-ng: Bump version header in conf file to 3.9Pawel Sikora2017-03-311-1/+1
| | | | | | | | | | | | Package version of syslog-ng is 3.9.1. Bumping version number in syslog-ng.conf to 3.9 Fixing warning message about configuration file being too old. Signed-off-by: Pawel Sikora <sikor6@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 3dad25466d2931eeecde23867bed79b1d7213887) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* samba4: security bump to version 4.5.7Peter Korsgaard2017-03-312-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2017-2619: All versions of Samba prior to 4.6.1, 4.5.7, 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition. Samba uses the realpath() system call to ensure when a client requests access to a pathname that it is under the exported share path on the server file system. Clients that have write access to the exported part of the file system via SMB1 unix extensions or NFS to create symlinks can race the server by renaming a realpath() checked path and then creating a symlink. If the client wins the race it can cause the server to access the new symlink target after the exported share path check has been done. This new symlink target can point to anywhere on the server file system. This is a difficult race to win, but theoretically possible. Note that the proof of concept code supplied wins the race reliably only when the server is slowed down using the strace utility running on the server. Exploitation of this bug has not been seen in the wild. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 493cedf3af061b90a899826e0c184c2f484414f6) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* core/br2-external: properly report unexpected errorsYann E. MORIN2017-03-311-0/+3
| | | | | | | | | | | | | | | | | | | | | Unextected error in the br2-external script are properly caught, but they are not reported properly, and we end up in either of two situations: - the .br2-external.mk file is not generated, in which case make will try to find a rule to generate it (because the 'include' directive tries to generate missing files); - the .br-external.mk file is generated but does not contain the error variable, and thus the build might not get interrupted. We fix that by using a trap on the pseudo ERR signal, to emit the error variable on unexpected errors. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit c5fa9308ea4e3810a7f7d9d0df75cbf090c414c4) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* taglib: fix legal infoRahul Bedarkar2017-03-311-1/+1
| | | | | | | | | | | | | taglib is dual licensed under LGPLv2.1 or MPLv1.1. Almost all source files have license text mentioning LGPLv2.1 or alternatively MPLv1.1. Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> [Thomas: use MPL-1.1 instead of MPLv1.1, since MPL-1.1 is the SPDX license code for this license.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit f30a3940c8dc5fc9bbe3a0ace457201808142183) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dbus-triggerd: add license fileRahul Bedarkar2017-03-311-0/+1
| | | | | | | | | | In absence of license file, use source file as a license file since it has license header in comments. Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 50284570fbefa37c8874b47cd5998bd890e54632) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* dbus-glib: fix legal infoRahul Bedarkar2017-03-311-1/+1
| | | | | | | | | | dbus glib bindings are dual licensed under AFLv2.1 or GPLv2+. Separate licenses using 'or' keyword. Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit f70f0b497f8a072eb22aff0bd934467b706cffd8) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 10}.x seriesFabio Estevam2017-03-311-2/+2
| | | | | | | | [Peter: drop 4.10.x update] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b718c776ca1a5d204f2ae9a765331a32e87e9560) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* htop: use correct ncurses config script nameRodrigo Rebello2017-03-311-1/+1
| | | | | | | | | | | | The ncurses config script can have different names depending on the configuration (e.g. wchar support enabled/disabled). So, use $(NCURSES_CONFIG_SCRIPTS) from the ncurses package as it contains the proper name. Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 8cd1554ee162f6344dab078233f4f6c0d93e7c24) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* slang: use correct ncurses config script nameRodrigo Rebello2017-03-311-2/+2
| | | | | | | | | | | | | | | | | | | The ncurses config script can have different names depending on the configuration (e.g. wchar support enabled/disabled). So, use $(NCURSES_CONFIG_SCRIPTS) from the ncurses package as it contains the proper name. Fixes: http://autobuild.buildroot.net/results/c97554c05e121c76407be53ba37924cfcb658e9d/ http://autobuild.buildroot.net/results/b0a31a3491a30ee0d6e6e7dbba68a86f0e00943d/ http://autobuild.buildroot.net/results/a77241141cf8710fa945523ef62327798e3c4824/ [...] Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b3e4ed92380080334d3d09bb4a53dc6102edd8aa) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/ntp: fix build for toolchains without sspBernd Kuhls2017-03-311-0/+6
| | | | | | | | | | | | | | | | | | | ntp defaults to use ssp support http://bk1.ntp.org/ntp-stable/sntp/harden/README by using these flags http://bk1.ntp.org/ntp-stable/sntp/harden/linux If the toolchain lacks SSP support this patch forces ntp to use an empty set of flags: http://bk1.ntp.org/ntp-stable/sntp/harden/default Fixes http://autobuild.buildroot.net/results/1d5/1d58bd8745b22c8eb71fea4c7255d3ace69f6f7a/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 00968bcac0674250956e99b6fafbf9b373446488) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* busybox: fix mdev.confJörg Krause2017-03-311-9/+9
| | | | | | | | | | | | | | | | | | | | mdev does not set "/dev/snd" and "/dev/input" group and permission propery, because with commit c3cf1e30a3022453311a7e9fe11d94c7a381640e (May 2013!) the behavior of mdev has changed. The device name is now taken directly from the uevent file and does no longer match the old rule. Fix the rules for "/dev/snd" and "/dev/input" according to the example given in [1]. [1] http://lists.busybox.net/pipermail/busybox/2015-February/082297.html Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit afb585468b33c76d41686cb92e7f56565fe150e4) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* upmpdcli: add user to the audio groupJörg Krause2017-03-311-1/+1
| | | | | | | | | | upmpdcli runs as user and group upmpdcli. In order to allow it to access the ALSA devices add it to the audio group. Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit ab9842e360ae08954b07504a20cd053fe146f383) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 3.{2, 12}.x and 4.{1, 4, 9, 10}.x seriesVicente Olivert Riera2017-03-311-5/+5
| | | | | | | | [Peter: drop 4.10.x update] Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 0d70d1dbf054f4a0609ba1076bc7e097305013d2) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/ntp: security bump to 4.2.8p10Bernd Kuhls2017-03-312-5/+5
| | | | | | | | | | | | | | Changed NTP_SITE to https to circumvent "URL transformed to HTTPS due to an HSTS policy" during download. For details about the bugs fixed see: http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities http://www.kb.cert.org/vuls/id/633847 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b47aec79d2e19ef7e3f04d2758c3a2930d47cebe) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* squashfs: correct hashArnout Vandecappelle2017-03-311-1/+1
| | | | | | | | | | | | When squashfs was bumped to 3de1687d in commit ee90313c64, the hash file was not updated. This wasn't noticed before since hashes are not checked for git downloads. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 85c832247e40f00f48ac328970bb39ab7851f042) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-firmware: correct hashArnout Vandecappelle2017-03-311-1/+1
| | | | | | | | | | | | When linux-firmware was bumped to 6d3bc8886 in commit 3ff5896ff, a hash file was added but the hash was wrong. This wasn't noticed before since hashes are not checked for git downloads. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Adam Duskett <aduskett@codeblue.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 0409b136985ff582d561076f03685da9890fa325) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* fmc: correct hash fileArnout Vandecappelle2017-03-311-2/+2
| | | | | | | | | | | | It had sha256sum instead of sha256. This wasn't noticed before since hashes for git downloads are not checked. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Matthew Weber <matthew.weber@rockwellcollins.com> Reviewed-by: Matthew Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit ba717fde72c862a283a035b3b44377bb48d08284) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* download/git: create GNU format tar filesArnout Vandecappelle2017-03-311-1/+3
| | | | | | | | | | | | | | | | | | | | | | | On most distros, the tar format defaults to GNU. However, at build time the default format may be changed to posix. Also, future versions of tar will default to posix. Since we want the tarballs created by the git download method to be reproducible (so their hash can be checked), we should explicitly specify the format. Since existing tarballs on sources.buildroot.org use the GNU format, and also the existing hashes in the *.hash files are based on GNU format tarballs, we use the GNU format. In addition, the Posix format encodes atime and ctime as well as mtime, but tar offers no option like --mtime to override them. In the GNU format, atime and ctime are only encoded if the --incremental option is given. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 0f369a9231b2c67748f4f0c2dbb33ebdc2890478) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* graph-depends: rename pkgutil.py to brpkgutil.pyYegor Yefremov2017-03-312-4/+4
| | | | | | | | | | | | | | pkgutil.py is also part of Python itself. Placing pkgutil.py as is in a folder with other scripts that require original pkgutil will break them. This is the case with scanpypi. So rename pkgutil.py to brpkgutil.py to avoid naming collision. Fixes: https://bugs.busybox.net/show_bug.cgi?id=9766 Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 3b627c89dc8adf8c60efd773935bf66004e8433d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* ltp-testsuite: disable Open POSIX testsuiteThomas Petazzoni2017-03-311-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Open POSIX testsuite builds and installs to the target directory a program called 't0' that isn't cross-compiled, which is bad. Since the LTP build system is autoconf but not automake based, and the Open POSIX testsuite is a sort of sub-project inside it, fixing the issue is not trivial. Therefore, we simply disable the Open POSIX testsuite entirely. Oddly enough, --without-open-posix-testsuite doesn't work due to another bug, so we simply have to remove --with-open-posix-testsuite. Open POSIX testsuite cross-compilation issue reported at https://github.com/linux-test-project/ltp/issues/144. Configure script bug reported at https://github.com/linux-test-project/ltp/issues/143. Fixes: http://autobuild.buildroot.net/results/8326ba9eb257dfc92c1ad282ba6d3565e8250def/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit b57e1355a72da407c19315cb4187767d28e4d064) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/dbus-cpp: fix cross-compilationYann E. MORIN2017-03-312-32/+34
| | | | | | | | | | | | | | | | | | | | | | dbus-cpp has an ugly hack to not cross-build the tools when it detects cross-compilation. However, we already have a host variant that builds those tools (and we anyway don't seem to need them to begin with). Drop our patch that propagates the CXXFLAGS/LDFLAGS_FOR_BUILD. Replace with a patch to cross-compile the tools. Fixes: http://autobuild.buildroot.org/results/110/1100539caae6ef62c61a3b96bc54f7c0a215cc62/ and many, many more. Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Gustavo Zacarias <gustavo@zacarias.com.ar> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit f5dbd0dea159393e779f6a1f5fa53b9fa07ff34a) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* apr: fix size of pid_tJulien Beraud2017-03-311-0/+1
| | | | | | | | | | | | pid_t is a signed 32bits integer on both 32bits and 64bits architectures. This fixes an issue with apache server which causes bad pid to be written in PidFile Signed-off-by: Julien Beraud <julien.beraud@spectracom.orolia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit ee8cbc5fca779ff054a50ed8e6271952367147c7) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* memcached: bump version to 1.4.36Vicente Olivert Riera2017-03-312-4/+4
| | | | | | | | | | | | | | | From the release notes (https://github.com/memcached/memcached/wiki/ReleaseNotes1436): Important bug fix that could lead to a hung slab mover. Also improves memory efficiency of chunked items. [Peter: add release notes link / mention important bug fix] Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit adfe049d85b09a2ce780ce49f8e53d9cfaf90e2d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* memcached: bump version to 1.4.35Vicente Olivert Riera2017-03-312-4/+4
| | | | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 36cabc5a744d97090784a29a4001a994728e0539) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* openssh: security bump to version 7.5Baruch Siach2017-03-312-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | From the release notes (https://www.openssh.com/txt/release-7.5): Security -------- * ssh(1), sshd(8): Fix weakness in CBC padding oracle countermeasures that allowed a variant of the attack fixed in OpenSSH 7.3 to proceed. Note that the OpenSSH client disables CBC ciphers by default, sshd offers them as lowest-preference options and will remove them by default entriely in the next release. Reported by Jean Paul Degabriele, Kenny Paterson, Martin Albrecht and Torben Hansen of Royal Holloway, University of London. * sftp-client(1): [portable OpenSSH only] On Cygwin, a client making a recursive file transfer could be maniuplated by a hostile server to perform a path-traversal attack. creating or modifying files outside of the intended target directory. Reported by Jann Horn of Google Project Zero. [Peter: mention security fixes] Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 2204f4deb1c6c6ff4accd84b5aa2d42f5930b730) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* gst1-plugins-bad: waylandsink needs wayland-protocolsPeter Seiderer2017-03-312-1/+3
| | | | | | | | | | | | | | Signed-off-by: Peter Seiderer <ps.report@gmx.net> ---- Changes v1 -> v2: - use select instead of depends for BR2_PACKAGE_WAYLAND_PROTOCOLS (suggested by Thomas Petazzoni) - add select BR2_PACKAGE_WAYLAND_PROTOCOLS to missing second place (BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_WAYLAND) Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 5a2d37ca125c1742864af0e9324234f8f3ecc071) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* libxkbcommon: disable wayland supportPeter Seiderer2017-03-311-0/+1
| | | | | | | | | | | | | | | | | | | | | Disable wayland support (only needed for the interactive-wayland test program). This fixes a compile failure in case wayland support is autodetected: GEN xdg-shell-unstable-v5-protocol.c /bin/sh: /usr/bin/wayland-scanner: No such file or directory Makefile:2426: recipe for target 'xdg-shell-unstable-v5-protocol.c' failed make[3]: *** [xdg-shell-unstable-v5-protocol.c] Error 127 make[3]: *** Waiting for unfinished jobs.... GEN xdg-shell-unstable-v5-client-protocol.h /bin/sh: /usr/bin/wayland-scanner: No such file or directory Makefile:2428: recipe for target 'xdg-shell-unstable-v5-client-protocol.h' failed make[3]: *** [xdg-shell-unstable-v5-client-protocol.h] Error 127 Signed-off-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 7665b5870995ef059d1654c35557b53c04a71d1d) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/mesa3d: add lm-sensors optional dependencyRomain Naour2017-03-311-0/+7
| | | | | | | | | | | | radeon-pci-0008 Adapter: PCI adapter temp1: +56.0 C (crit = +120.0 C, hyst = +90.0 C) Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 73401587e5984397bedddab61ad6c89712041267) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* filemq: correct licenseRahul Bedarkar2017-03-311-2/+2
| | | | | | | | | | | | | | | All source files, except src/filemq_client.c and src/filemq_server.c, has MPL Version 2.0 license text in file header. As confirmed with upstream [1] (L)GPLv3 license texts COPYING and COPYING.LESSER are leftover from previous implementation. [1] - https://github.com/zeromq/filemq/issues/74 Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 205a0289d4a0aefc76b0c937c2f725517114c658) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* skalibs: fix endianness detection on x86Eric Le Bihan2017-03-311-7/+10
| | | | | | | | | | | | | | | Update the patch for compile time endianness detection so it works on x86 platforms using GCC <= 4.4. Fixes: http://autobuild.buildroot.net/results/c2e8e1180571976b412cbba729c45a3698aea0b2 http://autobuild.buildroot.net/results/2ee47107d8a67470f7bc3e10cf763202d5455d17 Signed-off-by: Eric Le Bihan <eric.le.bihan.dev@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 8eecaf2d122f7da6f59964f5eb00139a32373d06) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* wget: add upstream security fixBaruch Siach2017-03-311-0/+40
| | | | | | | | | | | Fixes CVE-2017-6508: CRLF injection in the url_parse function in url.c http://lists.gnu.org/archive/html/bug-wget/2017-03/msg00018.html Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 7132fc9c11573a460243895c85e66b514b71c041) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 10}.x seriesFabio Estevam2017-03-311-2/+2
| | | | | | | | [Peter: drop 4.10.x update] Signed-off-by: Fabio Estevam <festevam@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit f4978bf018d4f03834f879f3dfc4e8237846742e) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* skeleton: fix permissions on /dev/pts/ptmxJan Kundrát2017-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this patch, it is not possible to allocate PTYs when a generated rootfs image with a recent glibc and systemd is launched as a container on an RHEL7 system via machinectl/systemd-nspawn. The container boots, but `machinectl login mycontainer` fails. The culprit is /dev/pts/ptmx with 0000 perms. On a typical system, there are two `ptmx` devices. One is provided by the devpts at /dev/pts/ptmx and it is typically not directly accessed from userspace. The other one which actually *is* opened by processes is /dev/ptmx. Kernel's documentation says these days that /dev/ptmx should be either a symlink, or a bind mount of the /dev/pts/ptmx from devpts. When a container is launched via machinectl/machined/systemd-nspawn, the container manager prepares a root filesystem so that the container can live in an appropriate namespace (this is similar to what initramfs is doing on x86 desktops). During these preparations, systemd-nspawn mounts a devpts instance using a correct ptmxmode=0666 within the container-to-be's /dev/pts, and it adds a compatibility symlink at /dev/ptmx. However, once systemd takes over as an init in the container, /lib/systemd/systemd-remount-fs applies mount options from /etc/fstab to all fileystems. Because the buildroot's template used to not include the ptmxmode=... option, a default value of 0000 was taking an effect which in turn led to not being able to allocate any pseudo-terminals. The relevant kernel option was introduced upstream in commit 1f8f1e29 back in 2009. The oldest linux-headers referenced from buildroot's config is 3.0, and that version definitely has that commit. Mount options that are not understood by the system are anyway ignored, so backward compatibility is preserved. Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz> Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Thomas: fix commit title, adjust commit log.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 8196b299ba12bd6741bf7f4462cad180dab77fb0) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* fakeroot: depend on aclArnout Vandecappelle2017-03-311-0/+2
| | | | | | | | | | | | | | | | | | | Recent versions of fakeroot have grown support for acl. We don't really need this since we don't use acls in Buildroot. However, it turns out that "cp -a" does something funky with acls, with the result that fakeroot without acl support looses the ownership and permissions on the copied file. "cp -a" may be (is even likely to be) used in a BR2_ROOTFS_POST_FAKEROOT_SCRIPT, so we need to support this. Note that host-acl itself depends on host-attr, so this pulls in two extra packages in each build. The impact on build time is about 10s. Cc: Andreas Naumann <dev@andin.de> Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 2a222446b4614a38b4042df54b68b69b96939708) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* acl: add host variantArnout Vandecappelle2017-03-311-0/+11
| | | | | | | | | | | | | We need host-acl to fix issues with fakeroot. Unfortunately, all the hacks (except the .la fixup) have to be repeated. Cc: Yegor Yefremov <yegorslists@googlemail.com> Cc: Andreas Naumann <dev@andin.de> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit c83446fccace19694e20b1d0a730680244d724fe) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* acl: make sure build picks up TARGET_CFLAGSArnout Vandecappelle2017-03-311-1/+7
| | | | | | | | | | | | | | | | | The acl build system doesn't use automake, therefore it is broken. It doesn't use the CFLAGS passed by configure. Work around this by passing CFLAGS in the environment. The makefiles append to CFLAGS, so this works. This issue hasn't led to build failures, but it is visible e.g. when stack protector is enabled: the stack protector options are not applied to acl. Also debug and optimisation options aren't applied. Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 99c9b0affde4fcc3270425319b98a0e5e32f5964) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
OpenPOWER on IntegriCloud