three security fixes.
CVE-2015-6563 (Low) openssh: Privilege separation weakness related to PAM support
CVE-2015-6564 (medium) openssh: Use-after-free bug related to PAM support
CVE-2015-6565 (High) openssh: Incorrectly set TTYs to be world-writable
(From OE-Core rev: 259df232b513367a0a18b17e3e377260a770288f)
(From OE-Core rev: ddfe191355a042e6995f7b4b725b108c5bb4d36e)
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Conflicts:
meta/recipes-connectivity/openssh/openssh_6.6p1.bb
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* add leading space so that it works even with some .bbappend adding
additional files to SRC_URI without trailing space
(From OE-Core rev: 0f282f1d4946ac6e81959c66172c115405632a26)
(From OE-Core rev: 55b183aa476754b050779d36dfbb03eb936443ad)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3310
Buffer overflow in the rc_mksid function in plugins/radius/util.c in
Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is
greater than 65535, allows remote attackers to cause a denial of
service (crash) via a start accounting message to the RADIUS server.
oe-core is using ppp 2.4.7, and this CVE say ppp 2.4.7 was not
effected, but I found this buggy codes are same between 2.4.6 and
2.4.7, and 2.4.7 should have this issue.
(From OE-Core rev: 5b549c6d73e91fdbd0b618a752d618deb1449ef9)
(From OE-Core rev: d2f15f2ec2d9e8ecdb9aa69a413663f3615d7e0c)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The neard make scripts will place the daemon executable
in /usr/lib/neard/nfc/neard. Change the path accordingly
in init scripts.
Fixes [YOCTO #7390].
(From OE-Core rev: bd277f3a46e7fc764cc55c5354d2136fcfddc3c1)
(From OE-Core rev: d86fd6190b9ffd5012f229f319520615176c27ee)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This upgrade fixes CVE-2015-1793
Removed openssl-fix-link.patch. The linking issue has been fixed in openssl.
(From OE-Core rev: 208d1d72b0d248b12f800e566cb011aec9a1a084)
Signed-off-by: Tudor Florea <tudor.florea@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
x32 builds where broken due to patch rebase not having been done correctly for
this patch
(From OE-Core rev: 8e46230fe94c44ab81a0ca9cb8b2c9f7b605e226)
Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Security update, some patches modified to apply correctly mostly due to
upstream changing indentation/styling
* configure-targets.patch updated
* fix-cipher-des-ede3-cfb1.patch updated
* openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch updated
* openssl-avoid-NULL-pointer-dereference-in-dh_pub_encode.patch removed as no
merged with 3942e7d9ebc262fa5c5c42aba0167e06d981f004 in upstream
(From OE-Core rev: 03739bcc1672df8f55c6428184670f1a8c8f80b2)
Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There might be no src dir if the src/builtin.h runs earlier, create it
to fix the race issue:
src/genbuiltin nfctype1 nfctype2 nfctype3 nfctype4 p2p > src/builtin.h
/bin/sh: src/builtin.h: No such file or directory
(From OE-Core rev: 4b6762b924a561febede13b85330309dbf75da19)
(From OE-Core rev: 3d0f678cb5796066798394238be4b12b09d2a983)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Socat will look for openpty() in BSD headers before Linux headers, so if libbsd
is present at configure time then that will be used. We don't need to depend on
libbsd though, and leaving it floating can cause build errors, so tell configure
that the libbsd header isn't present.
(From OE-Core rev: 7defa2bb5b28ea69f749363a607a114cfa4ba4ed)
(From OE-Core rev: eab55e22c685f9192ed1abd7a559aeb13eab41fd)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Deliver script ssh-copy-id from openssh which is useful to add an
authorized ssh key.
(From OE-Core rev: 16562034a2c28cbfc6c90f9324c42c08e0655b7d)
(From OE-Core rev: 00638cc0ca8213f6aac154eccf29ee0213c0a7e9)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This causes the package to not be relocateable from sstate
The OpenSSL binaries respect a few environment variables for determining
locations of files, so we now use these to point the binaries to the
relocated locations.
[YOCTO #6827]
(From OE-Core rev: 771d3123331fbfab1eb9ce47e3013eabcb2248f5)
(From OE-Core rev: 4d8b1f51d5910e12c0189b7b3df31f4d8fd7bffb)
Signed-off-by: André Draszik <adraszik@digisoft.tv>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Using the export LD in the recipe does not allow for secodnary toolchain
overriding LD later, by setting it in the do_configure_append the export
is used by autotools setting LD based on the env, but would allow for
override later.
[YOCTO #6997]
(From OE-Core rev: 9b37e630f5f6e37e928f825c4f67481cf58c98a1)
(From OE-Core rev: 9dd9d23096e73fa7b6f865241cdd9eff77e5b208)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
bluez-hcidump was a separate package in bluez4, but was integrated into
bluez5.
(From OE-Core rev: 0dcaea0fcf38f0e382eda11e74ded1daeb98a8ac)
(From OE-Core rev: 0c18fdd44accbcc04731e1e3f1ce1faa5e350db9)
Signed-off-by: Peter A. Bigot <pab@pabigot.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Currently, we install our own ssh_config and sshd_config into ${S} in
do_compile_append() task. So when finishing compiling, their .out files
are generated by the original files, rather than by our own files.
In most cases, installing "$(CONFIGFILES)" in Makefile will generate .out
files again, and then installing "install-sysconf", which will install
these two files into $(DESTDIR), thus we get what we expect.
However, when parallel installing, "install-sysconf" may be installed
before "$(CONFIGFILES)" sometimes. In this rare case, the .out files
generated in the first time rather than those in the second time will be
installed into $(DESTDIR), and thus we get an unexpect result.
This patch fixes this bug through transfering the installing of our own
files from do_compile_append() into do_configure_prepend().
(From OE-Core rev: 6a60a4ba8d8e529882daa33140c9a2fc08714fb2)
(From OE-Core rev: af1096b7e1e9c15d83fb44739d449fcbaf70c220)
Signed-off-by: Zheng Junling <zhengjunling@huawei.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
resolvconf was missing a script and needed readlink which was in
/usr/bin. Also the /etc/resolv.conf was not being correctly linked
to /etc/resolvconf/run/resolv.conf, which is fixed by the volaties
change which is now a file as opposed to created in do_install.
Ensure that the correct scripts for ifup/ifdown get installed and that
resolvconf is correctly enabled at startup
[YOCTO #5361]
(From OE-Core rev: 853e8d2c7aff6dddc1d555af22f54c4ecef13df1)
(From OE-Core rev: 10a1ae28ecee10695efb6a5bc08de4f04e0acac1)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch resolves following error:
"connman-dbus.xml": "connman" is not a valid D-Bus interface name
(From OE-Core rev: 964bcac02bb182340e44dc8a07b5d308f0a4a719)
(From OE-Core rev: f9398787975c6e9468e1d58974f070571e9c664c)
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Appending or prepending to PACKAGES breaks when the package is built natively,
so use PACKAGE_BEFORE_PN instead.
(From OE-Core rev: 23d7223a21582edefc4e30d76f94f8e81a543af9)
(From OE-Core rev: 0475d37cde09d62667b3edf0a928c563ed7efc50)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously, the owners/groups of directories like /var/lib/nfs/statd
are changed in the init script, /etc/init.d/nfscommon. This is actually
a workaround. We need to change them at do_install time.
This patch fixes the above problem by changing owners/groups at do_install
time.
Besides, configuration option '--with-staduser=nobody' is changed to be
'--with-statduser=rpcuser'. And /var/lib/nfs/statd/state is modified to have
permission 0644, just like other distros (ubuntu, fedora, etc.) do.
(From OE-Core rev: 8c27a1e25ae42a435ab7d290cab40f94f9286243)
(From OE-Core rev: 10b5adcc6d3d3ae1ffe64de72777da091ba98274)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If without this patch:
$ ip link add vxlan0 type vxlan id 51 group 238.1.1.1 dev eth0
Error: argument "vxlan0" is wrong: Unknown device
$
With this patch;
$ ip link add vxlan0 type vxlan id 51 group 238.1.1.1 dev eth0
$ ifconfig -a |grep vxlan0
vxlan0 Link encap:Ethernet HWaddr da:61:56:2e:c2:20
$
(From OE-Core rev: 4f2873c8567738310f7e86c633c6da759554b21a)
(From OE-Core rev: 2d90e1e01d4a732a52d50c654022a4dbd508e084)
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tell systemd just to kill the sshd process when the ssh connection drops
instead of the entire cgroup for sshd, so that any screen sessions (and
more to the point, processes within them) do not get killed.
(This is what the Fedora sshd service file does, and what we're already
doing in the dropbear service file).
(From OE-Core rev: 3c238dff41fbd3687457989c7b17d22b2cc844be)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed when rebuild:
make: *** No rule to make target `/path/to/old//sysroots/qemux86-64/usr/lib/dbus-1.0/include/dbus/dbus-arch-deps.h', needed by `dbus/dbus_old.o'. Stop.
The .d files save the path of the dependencies files which may not exist
when rebuild, we can remove them to make the rebuild work.
(From OE-Core rev: e336102e59dbbd01fe67121738203563476f9456)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed:
MACHINE = "qemux86-64"
VIRTUAL-RUNTIME_init_manager = " systemd "
DISTRO_FEATURES_append = " systemd"
DISTRO_FEATURES_BACKFILL_CONSIDERED += " sysvinit "
require conf/multilib.conf
MULTILIBS = "multilib:lib32"
DEFAULTTUNE_virtclass-multilib-lib32 = "x86"
$ bitbake avahi avahi-ui
ERROR: QA Issue: avahi-ui: Files/directories were installed but not shipped
/lib
/lib/systemd
/lib/systemd/system
/lib/systemd/system/avahi-daemon.socket
/lib/systemd/system/avahi-dnsconfd.service
/lib/systemd/system/avahi-daemon.service [installed-vs-shipped]
ERROR: The recipe avahi-ui is trying to install files into a sharedarea when those files already exist. Those files and their manifestlocation are:
/path/to/sysroots/qemux86-64/lib/systemd/system/avahi-daemon.socket
Matched in manifest-qemux86-64-avahi.populate_sysroot
/path/to/sysroots/qemux86-64/lib/systemd/system/avahi-dnsconfd.service
Matched in manifest-qemux86-64-avahi.populate_sysroot
/path/to/sysroots/qemux86-64/lib/systemd/system/avahi-daemon.service
Matched in manifest-qemux86-64-avahi.populate_sysroot
Please verify which recipe should provide theabove files.
And remove the duplicated line:
rm ${D}${base_libdir} -rf
(From OE-Core rev: 1e6ec39d4996d2812b01c4452c579e476e70e85d)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update the service file to more closely match the service file that has been
committed upstream.
In particular we don't want to restart neard on failure (this results in it
restarting repeatedly if no NFC hardware is found), redirecting stdout to
/dev/null means that any messages are lost instead of being sent to the journal,
and the DBus alias is required for bus activation to work correctly.
(From OE-Core rev: b6afd8e5abcd412c17e14c59379b9583b95fd517)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We should use ${PN} instead of hardcoding 'dhcp' for SYSTEMD_SERVICES,
otherwise we would have 'installed-not-shipped' QA error if we are building
lib32-dhcp.
(From OE-Core rev: c3a152f946f7cb1666384fd7a214f883cbaecb56)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
irda-utils doesn't use autotools, so don't inherit it.
(From OE-Core rev: d5e2a59ab59e3d67d09c5f25b8623186af855e17)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
While we're at it, also switch to explicit variable passing rather than
relying on make -e, and pass V=1 so the actual commands hit the logs.
(From OE-Core rev: 7106f840b7d2a71171131c3c3e5fc311718ca718)
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch changes the dbus policy settings in order to allow
calling methods over dbus. bluez5 and pulseaudio rely on this
mechanism to configure media end points. Previously bluetoothd
was failing to configure the media end points with error
org.freedesktop.DBus.Error.AccessDenied, due to which bluetooth
headset and smartphone were unable to connect in A2DP mode.
(From OE-Core rev: eb3a380301b8f7ec34d3649c386214d39355eaa0)
Signed-off-by: Yasir-Khan <yasir_khan@mentor.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add dhcpd.service and dhcrelay.service to support systemd systems.
(From OE-Core rev: 5f40081b0b9867bc167057712b04b3c1afb8a20d)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Still BSD licensed, some changes into
pcap triggered a checksum change;
- ieee80215-arphrd.patch removed, obsolete.
- switched to ${BP} variable;
Changelog from previous version:
Saturday Jul. 19, 2014 mcr@sandelman.ca
Summary for 1.6.1 libpcap release
some fixes for the any device
changes for how --enable-XXX works
Wednesday Jul. 2, 2014 mcr@sandelman.ca
Summary for 1.6.0 libpcap release
Don't support D-Bus sniffing on OS X
fixes for byte order issues with NFLOG captures
Handle using cooked mode for DLT_NETLINK in activate_new().
on platforms where you can not capture on down interfaces, do not list them
but: do list interfaces which are down, if you can capture on them!
(From OE-Core rev: ff962963de4dea9143f11ded480d0cca79a66d99)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Bug fixes;
Add support for Handsfree subscriber number feature;
Add support for Handsfree multiple DTMF characters;
Add support for PAP authentication.
- Added patch to revert tests to work with Python2.x.
(From OE-Core rev: 21f95b2db0f22dcb4d9cd59a90f291f72982f2a1)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Several fixes to HID over GATT (HoG) and for AVRCP.
Notable additions with the Linux kernel 3.17:
- BR/EDR whitelist support;
- Proper LE passive scanning support.
(From OE-Core rev: 4284b449a9a7a08935f99fecdd1de7c481d4a9b7)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
build-libppp-plugin-without-versioning-info.patch
no longer needed, removed.
Changelog:
Fix issue with handling rebind timer for DHCPv6.
Fix issue with handling DHCP renew transaction.
Fix issue with user supplied proxy settings and DHCP.
Fix issue with extra status codes from captive portals.
Fix issue with service idle state reset on failure.
Fix issue with DNS label compression handling.
Add support for experimental P2P Peer service.
(From OE-Core rev: f53c5e7914ea37338817fcb7efbd42414045e07c)
Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With last restructuring for musl, some of uclibc targets got ignored
fsl/ppc and ARM worked ok since they use special target triplets which
were already considered but other like mips, x86 and so on failed
(From OE-Core rev: 63ab0ce2103bcf3a42ce5812a22409779126e114)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
'make rehash' used the compiled openssl to get hash value
for files, it always failed when cross compiling:
/path/to/openssl/1.0.1i-r0/openssl-1.0.1i/util/shlib_wrap.sh:
line 96: /path/to/openssl/1.0.1i-r0/openssl-1.0.1i/util/../apps/openssl:
cannot execute binary file
so add DEPENDS on openssl-native for target package and use it
instead of the one compiled from target package.
(From OE-Core rev: 9705586b6eca157e8f8fd6071f489a49bf1db181)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The original patch was submitted on ISC's mailing list but it didn't get merged
for some reason, it can be found here;
https://lists.isc.org/pipermail/dhcp-users/2011-January/012910.html
"The ISC DHCP's dhclient-script for Linux still uses the legacy commands
'ifconfig' & 'route' to manage IPv4 network addresses & routes,
while it uses iproute2's new "ip" command to manage IPv6 network data.
This requires users & distributions to have both types of commands installed
The attached patch tries to improve the situation by replacing the
old "ifconfig" resp. "route" commands with their "ip" counterparts.
It even improves the logic a bit by only flushing the IPv4 addresses
instead of taking down the whole interface, which may still have active IPv6
connections."
(From OE-Core rev: afcaccd283e590294335f38d86635cf99db39e3f)
Signed-off-by: Fahad Usman <fahad.usman@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since ${PN} is empty, we need to specify the ${PN}-dev RDEPENDS.
(From OE-Core rev: cc8e2137f82289a580a7fd58114e0a9e51b6d61a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
