summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-11-10file: fix CVE-2019-18218Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-10pseudo: Drop static linking to sqlite3Richard Purdie
Back in 2010[1] we made pseudo statically link against sqlite3. Since then the world has changed, pseudo now has separate processes for the database in the server and the client and they have separate linking commands. Also, whilst there were concerns about needing specific versions of sqlite3, in the OE environment, this is always the case. [1] http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=ad0ac0ecd38fc77daf42485489fccc10a5e1e3e7 The static sqlite3-native is causing us problems, in particular: tmp/work/x86_64-linux/pseudo-native/1.9.0+gitAUTOINC+060058bb29-r0/recipe-sysroot-native/usr/lib/libsqlite3.a(sqlite3.o):(.data.rel+0xb0): undefined reference to `fcntl64' which occurs if sqlite3-native was built on a machine with glibc 2.28 or later and pseudo-native is being built on glibc before that. With dyanmical linking, libc is backwards compatible and works but with static linking it does not. There appears to be no easy way to avoid this other than adding a copy of sqlite3 into the pseudo recipe. Given the static linking doesn't seem to be required any longer due to the separate processes, drop that to fix those issues. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-10libsdl2: fix race when building in parallelAnuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libgcrypt: fix CVE-2019-13627Trevor Gamblin
Backport two fixes for CVE-2019-13627 from upstream to zeus. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libpam: set CVE_PRODUCTRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libsndfile1: whitelist CVE-2018-13419Ross Burton
This is a memory leak that nobody else can replicate and has been rejected by upstream. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10procps: whitelist CVE-2018-1121Ross Burton
This CVE is about race conditions in 'ps' which make it unsuitable for security audits. As these race conditions are unavoidable ps shouldn't be used for security auditing, so this isn't a valid CVE. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libpng: whitelist CVE-2019-17371Ross Burton
This is actually a memory leak in gif2png 2.x, so whitelist it in the libpng recipe. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10python3: Upgrade 3.7.4 -> 3.7.5Adrian Bunk
Backported patch removed. 3.7.5 also includes the fix for CVE-2019-16935. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libxslt: fix CVE-2019-18197Joe Slater
Use patch from upstream after 1.1.33 release. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10libtiff: fix CVE-2019-17546Joe Slater
Apply unmodified patch from upstream. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-11-10e2fsprogs: fix CVE-2019-5094Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2019-10-29connman: mark connman-wait-online as SYSTEMD_PACKAGEAndré Draszik
The connman-wait-online package currently isn't marked as systemd-enabled package. This means it is impossible to auto-enable the service during image creation or package installation, as no preset files and no pkg_postinst() snippet is being created. This change should have been done as part of the upgrade to v1.31 Note: connman-wait-online is needed when connman is in use in more complex network/interface setups for systemd's network-online.target to report success. systemd-networkd's systemd-networkd-wait-online.service alone doesn't work in such scenarios and simply times out, as it know nothing about the expected network/ interface configuration, meaning the target doesn't boot successfully (systemctl list-units --failed), and long delays are seen, caused by waiting for the systemd-networkd-wait-online.service timeout. Signed-off-by: André Draszik <git@andred.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1a8d18eeee6dc188d8becc778bfa933031490781) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29wic/engine: use 'linux-swap' for swap file systemChee Yang Lee
[YOCTO #13312] see https://bugzilla.yoctoproject.org/show_bug.cgi?id=13312 wic/engine.Disk._get_part_image was looking at variable fstypes for supported fstype which is 'swap' but image build with 'linux-swap'. supported fstype should be 'linux-swap'. Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7e6da22fe4faf841bcec02e55f376b4dae04d6a8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29util-linux: fix PKNAME name is NULL when use lsblk [LIN1019-2963]Liwei Song
PKNAME is NULL when run "lsblk -o+PKNAME /dev/sda1" backport an upstream patch to fix it. Signed-off-by: Liwei Song <liwei.song@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a5a987ff5e5e333e28be44a12e729907272ea3cb) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29go: fix CVE-2019-16276Chen Qi
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e31f87e289dfd3bbca961e927447a9c7ba816d3f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29sudo: fix CVE-2019-14287Changqing Li
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29dbus: update dbus-1.init to reflect new PID fileTom Benn
The PID file referenced in dbus-1.init script was out of date and no longer existed. This meant that dbus could not be restarted via init.d without force removing the old PID file. Signed-off-by: fridgecow <fridgecow@fb.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 2ed6f06f30cb54b9c70f1a92d93c920ec4d01ffe) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29libgcrypt: fix CVE-2019-12904Yi Zhao
In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12904 Patches from: https://github.com/gpg/libgcrypt/commit/1374254c2904ab5b18ba4a890856824a102d4705 https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762 https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 37e390ff05b6a4509019db358ed496731d80cc51) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29python: Fix CVE-2019-10160Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit b4240b585d7fcac2fdbf33a8e72d48cb732eb696) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29icecc: Export ICECC_CC and friends via wrapper-scriptDouglas Royds via Openembedded-core
By exporting ICECC_CC, ICECC_CXX, and ICECC_VERSION in a wrapper-script, and putting this wrapper-script in the PATH, the Makefiles generated by CMake or the autotools are able to function correctly outside of bitbake. This provides a convenient developer workflow in which the modify-compile-unittest cycle can happen directly in the ${B} directory. The `rm -f $ICE_PATH/$compiler` line is transitional, and can go at some later date (October 2020 or later, perhaps). Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 40d74cb1d0ddce930267e49764cacb263b244091) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-29openssl: make OPENSSL_ENGINES match install pathGeorge McCollister
Set OPENSSL_ENGINES to the path where engines are actually installed. Signed-off-by: George McCollister <george.mccollister@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 59565fec0b3f3e24eb01c03b671913599cd3134d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25qemu: Fix CVE-2019-12068Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 81b375ac7851088a671317468a8e2eed69d4a827) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25python3: -dev should depend on distutilsRoss Burton
python3-config uses distutils: Traceback (most recent call last): File "/usr/bin/python3-config", line 9, in <module> from distutils import sysconfig ModuleNotFoundError: No module named 'distutils' Add the dependency so that distutils is always present. [ YOCTO #13592 ] Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 04136dbac48986dce5b2b872b2c0b46c673c44f2) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25i2c-tools: Add missing RDEPENDRicardo Ribalda Delgado
Fixes: # decode-dimms Can't locate Carp.pm in @INC (you may need to install the Carp module) (@INC contains: /usr/lib/perl5/site_perl/5.28.1/x86_64-linux /usr/lib/perl5/site_perl/5.28.1 /usr/lib/perl5/vendor_perl/5.28.1/x86_64-linux /usr/lib/perl5/vendor_perl/5.28.1 /usr/lib/perl5/5.28.1/x86_64-linux /usr/lib/perl5/5.28.1 .) at /usr/lib/perl5/5.28.1/Tie/Hash.pm line 190. BEGIN failed--compilation aborted at /usr/lib/perl5/5.28.1/Tie/Hash.pm line 190. Compilation failed in require at /usr/lib/perl5/5.28.1/x86_64-linux/POSIX.pm line 505. Compilation failed in require at /usr/bin/decode-dimms line 41. BEGIN failed--compilation aborted at /usr/bin/decode-dimms line 41. root@qt5222:~# apt-get install perl-module-carp Signed-off-by: Ricardo Ribalda Delgado <ricardo@ribalda.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c73d2a2c0ecc99f0d6d7e6a1861ecce7a2312a57) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25file: explicitly disable seccompRoss Burton
file will automatically enable seccomp if the seccomp headers are available, but the build will fail on Opensuse Tumbleweed because the include paths are wrong. Enabling seccomp is a bad idea because it interacts badly with pseudo (causing build failures), so explicitly and globally disable seccomp. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a752faa152df031df5acaa40491299ac115109a4) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25wic/rawcopy: Support files in sub-directoriesEugene Smirnov
If the source file is located in a subdirectory of DEPLOY_DIR rawcopy will currently fail in sparse_copy function on open(dst_fname, 'wb'), as the parent directory for destination file does not exist. This patch helps to avoid that by recursively creating parent directories. Signed-off-by: Eugene Smirnov <evgenii.smirnov@here.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 073c435644091c2801e45c6d02afa917de575082) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25openssh: fix CVE-2019-16905Hongxu Jia
Backport a patch from upstream to fix CVE-2019-16905 https://github.com/openssh/openssh-portable/commit/a546b17bbaeb12beac4c9aeed56f74a42b18a93a Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8bd4b87071c073a0e4d265bc00df34684a355eff) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25uninative: check .done file instead of tarballStefan Agner
In case multiple builds share UNINATIVE_DLDIR's location, one build might be in the process of downloading the tarball while another is just checking whether the tarball exists. Check for the done file instead and rely on the fetchers lockfile mechanism in case two builds are running. Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a1c95580549cb4f77601e62c7f026b19c752d853) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25sanity: check the format of SDK_VENDORRoss Burton
If SDK_VENDOR isn't formatted as -foosdk and is instead for example -foo-sdk then the triple that are constructed are not in fact triples, which results in mysterious compile errors. Check in sanity.bbclass so this failure is detected early. [ YOCTO #13573 ] Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b0efd8d4d0dbc30e6505b42f5603f18fa764d732) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25libsdl2: fix CVE-2019-13616Yi Zhao
Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-13616 Patch from: https://hg.libsdl.org/SDL/rev/e7ba650a643a Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 70b9cdf86b9c5ed14937500619387a890a57ef20) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25sysstat: fix CVE-2019-16167Wenlin Kang
This commit is another part of CVE-2019-16167, please see https://github.com/sysstat/sysstat/issues/232. Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 586c045eb81b79200b46bf743f5d3fdb5f68c12d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25ncurses: fix CVE-2019-17594, CVE-2019-17595Trevor Gamblin
Backport changes to tinfo/comp_hash.c, tinfo/parse_entry.c, and progs/dump_entry.c from upstream to fix CVEs. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25runqemu: Remove disabling of high resolution timerJoerg Vehlow
The option 'highres=off' sneaked itself into the runqemu script for all configurations, where the root filesystem type is not 'cpio' or 'cpio.gz'. See: https://bugzilla.yoctoproject.org/show_bug.cgi?id=13590 Signed-off-by: Joerg Vehlow <joerg.vehlow@aox-tech.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25runqemu: unset another environment variable for 'egl-headless'Alexander Kanavin
Some host distributions (opensuse for example) are using 'pkgconf', which, unlike the original pkg-config, appends PKG_CONFIG_SYSROOT_DIR to every directory from the .pc file. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25python3: CVE-2019-16056Chen Qi
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25python: CVE-2019-16056Chen Qi
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25aspell: fix CVE-2019-17544Trevor Gamblin
Backport CVE-2019-17544 fix to zeus. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-25sqlite3: fix CVE-2019-16168Qi.Chen@windriver.com
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-10-09build-appliance-image: Update to master head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-09readline-native: Fix builds on tumbleweedRichard Purdie
OpenSuse's libreadline has extra symbol information which upsets our uninative loader as our libreadline is missing symbols with the appropriate versions. The simplest solution is to add the version information as they're harmless. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-09scripts/gen-lockedsig-cache: Don't list paths which don't existRichard Purdie
This avoids failures seen on the autobuilder when generating eSDKs and release sstate copies. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-09build-appliance-image: Update to master head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-09libpcap:upgrade 1.9.0 -> 1.9.1Zang Ruochen
-libpcap/0001-pcap-usb-linux.c-add-missing-limits.h-for-musl-syste.patch Removed since this is included in 1.9.1. Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-09oeqa/selftest/imagefeatures: improve test_hypervisor_fmtsRoss Burton
If this test fails then the output doesn't help in any meaningful way, so improve the test to output the unparsable JSON and display unexpected output. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-08bluez5: add needed character encoding for ptestsRoss Burton
The test-gobject-header test suite needs UTF-16 encoding: test_decode_header_name_ascii: assertion failed (err == NULL): Unicode conversion failed: Conversion from character set ?UTF-16BE? to ?UTF-8? is not supported (g-obex-error-quark, 256) Add gconv-utf-16 to the bluez5-ptest RDEPENDS. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-08gdb: Bump from 8.3 to 8.3.1Alistair Francis
Signed-off-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-08llvm: remove -mlongcall from CXXFLAGS for powerpcChangqing Li
after gcc upgrade to 9.1.0, with this flags will make below error: collect2: fatal error: ld terminated with signal 11 [Segmentation fault] remove it as workaround, after remove it, powerpc can compile successfully Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-08perl: Handle PACKAGES_DYNAMIC for perl-nativeKhem Raj
A perl module recipe extending to provide native version causes target perl dependencies to be pulled into native build if the module recipe has RDEPENDS_${PN} = "perl-module-XXXX" e.g. libxml-sax-base-perl recipe. The reason is that native bbclass empties out PACKAGES_DYNAMIC and perl's PACKAGES_DYNAMIC_class-target is greedy enough to usurp native modules as well. Eventually we end up with errors like when sstate is used across machines * ERROR: libxml-sax-base-perl-native different signature for task do_populate_sysroot.sigdata between qemux86copy and qemuarm Therefore, to fix this native case needs to handled specially when re-assigning module dependencies in split_perl_packages(), where the modules are named correctly for native case and have a single dependency on perl-native, secondly, PACKAGES_DYNAMIC for target case needs to be reined in to spare, -native modules, thirdly, let perl-native take over the case for providing native modules This will fix several sstate signature errors like above with external perl modules providing native variants and having runtime dependencies on modules which are provided by perl proper Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-08dnf.py: check busybox for case test_dnf_installrootKai Kang
Check package busybox which is required by cases test_dnf_installroot and test_dnf_installroot_usrmerge. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-23 01:41:47 +0000