Widely accepted certificates for IP addresses are expensive and only
affordable for larger organizations. Therefore if the user provides
the hostname in the DNS= option, we should use it instead of the IP
address.
This fixes https://nvd.nist.gov/vuln/detail/CVE-2018-21029 per
suggestion https://github.com/systemd/systemd-stable/issues/72 .
CVE: CVE-2018-21029
(From OE-Core rev: 6b4a583169ae40a8d51e7ffa33785409b5111a81)
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Below patch files to fix CVE-2023-26604
CVE-2023-26604-1.patch, CVE-2023-26604-2.patch and
CVE-2023-26604-3.patch and CVE-2023-26604-4.patch
make pager secure when under euid is changed or explicitly
requested
Reference:
CVE-2023-26604-1.patch:
612ebf6c91
CVE-2023-26604-2.patch:
1b5b507cd2
CVE-2023-26604-3.patch:
0a42426d79
CVE-2023-26604-4.patch:
b8f736b30e
(From OE-Core rev: 7880eb801dcee44a9e8920d249057492d1de6b12)
Signed-off-by: rajmohan r <rajmohan.r@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Per default systemd use a pager for the output of most of its tools
and it expect this pager to be color capable. But that is not the case
when the busybox `less` is used, which lead to output garbled by color
escape sequences.
To fix this issue add a profile frament that disable the systemd pager
when busybox `less` is detected.
(From OE-Core rev: 06271fd8d26bc34448524157077c23eb1ea29c52)
Signed-off-by: Alban Bedel <alban.bedel@aerq.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit de7e36a7858ebca4615975967fcad1c399eacdb0)
Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since RRECOMMENDS declaration implictly induces building the recipes
that provide the runtime recommended packages, conditionalize adding
such values according to associated PACKAGECONFIG settings in order
to avoid redundant building.
(From OE-Core rev: a1989add927f7805378fe4d5afbde780b747ba77)
(From OE-Core rev: a35444fa035d551b6a4dcb9609ab8de960258618)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An off-by-one Error issue was discovered in Systemd in format_timespan()
function of time-util.c. An attacker could supply specific values for
time and accuracy that leads to buffer overrun in format_timespan(),
leading to a Denial of Service.
Add a patch to solve above CVE issue
Link: 9102c625a6
(From OE-Core rev: e2db40ca49b8ed217f14c7f861087837e8b3f389)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
systemd defines a default set of fallback DNS servers in
https://github.com/systemd/systemd/blob/v251/meson_options.txt#L328-L330
By adding a PACKAGECONFIG knob providing a convenient way to opt out,
and then adding that value to systemd's PACKAGECONFIG, the output from
runtime 'resolvectl status' command no longer contains the following
line:
Fallback DNS Servers: 1.1.1.1#cloudflare-dns.com 8.8.8.8#dns.google 1.0.0.1#cloudflare-dns.com 8.8.4.4#dns.google 2606:4700:4700::1111#cloudflare-dns.com 2001:4860:4860::8888#dns.google 2606:4700:4700::1001#cloudflare-dns.com 2001:4860:4860::8844#dns.google
(From OE-Core rev: 2b300d6b9ec6288a99d9dacb24a86949caf99e55)
(From OE-Core rev: 834ccad676b3d8d58d1a66bbe813a331599435b4)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
meson.build will fall back to greping /etc/login.defs for values of these
if they're not set. Different distros set them (Centos 7/8 does, Ubuntu
does not) so output was not deterministic. Avoid this by setting to the
default values. We now match the vaules from login.defs from shadow.
(From OE-Core rev: 56f57c70fb87beb9a7181df8cb5e7a4a0b5a184a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 77a6ac0ac266d71e4fe67fd332662081f30cd7bf)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If the distro does not include the group 'wheel' systemd will
complain when trying to parse ACL rules for tmpfiles.d.
systemd-tmpfiles[273]: Failed to parse ACL "d:group:adm:r-x,d:group:wheel:r-x": Invalid argument. Ignoring
Systemd has a configuration parameter to avoid using 'wheel'
group in the standard config files for tmpfiles. Add this as
a PACKAGECONFIG and enable it by default to keep default.
(From OE-Core rev: 1b5648e6aeb9837cb807ce086c26fbfaa16f6f8b)
(From OE-Core rev: 88d2c3d807a5f6bdd858de39506762aaca834aa9)
Signed-off-by: Peter Bergin <peter@berginkonsult.se>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 457cc45f51)
Upstream-Status: Backport
Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Sana Kazi <sanakazisk19@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We are observing systemd-network service crash during link down
while freeing link->ifname pointer
Backtrace:
(gdb) bt
0 __GI_abort () at abort.c:107
1 0x0000007f861d32b4 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f8628d500 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
2 0x0000007f861da51c in malloc_printerr (str=str@entry=0x7f86289070 "free(): invalid next size (fast)") at malloc.c:5347
3 0x0000007f861dbd58 in _int_free (av=0x7f862c9a28 <main_arena>, p=0x558aa28eb0, have_lock=0) at malloc.c:4249
4 0x0000005569249cf0 in link_free (link=0x558aa1c0d0) at ../git/src/network/networkd-link.c:715
5 link_unref (p=0x558aa1c0d0) at ../git/src/network/networkd-link.c:734
6 0x000000556920f34c in manager_rtnl_process_link (rtnl=<optimized out>, message=0x558aa2a430, userdata=0x558a9fc630)
While checking upstream code change with regards to link->ifname
memory allocation and free, we found below PR which also fixes
random systemd-networkd crash:
https://github.com/systemd/systemd/pull/19631https://github.com/systemd/systemd/issues/19629
(From OE-Core rev: adca61c61d84f022fdedd2d616e7c2df00661af8)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Brings in a number of fixes from upstream stable tree:
$ git log --format="%h %s" v244.3..v244.5
3ceaa81c61 kernel-install/90-loaderentry: fix when /boot is not mountpoint
ecbb5a4f67 nspawn: fix fd leak on failure path
a09947ddd4 nspawn: check return of setsid()
334f8e2e8f dissect: is_loop_device() returns negative on error, don't mistake that is true
b6efbbfb00 dissect: always invalidate secondary arch partitions if we found primary arch
dc5c5cd5c8 util: wireguard is merged into upstream kernel
6349956dda fstab-generator: add 'nofail' when NFS 'bg' option is used
f4777883f9 busctl: add missing shortopt -l
9f6249eb7f bootctl: handle if LoaderSystemToken is invalid for some reason
bda316cc0a hashmap: make sure to initialize shared hash key atomically
b80ea9e3da backlight: do not claim that ID_BACKLIGHT_CLAMP= property is not set
c829f6e7ca coredump: don't convert s → µs twice
bb9d872398 firstboot: fill empty color if ansi_color unavailable from os-release
156570cc77 resolved: make sure we initialize t->answer_errno before completing the transaction
02bba02fa6 src/shared/dissect-image.c: fix build without blkdid (#16901)
13cb598631 analyze: fix error handling in one case
6ab20e9f3b units: add missing usb-gadget.target
9ef259dd4d login/logind: Include sys/stat.h for struct stat usage
7762e59fd4 partition/makefs: Include missing sys/file.h header
3528ace8fb networkctl: label command does not take any argument
34b4dc64c6 missing: Add new Linux capability
ba28e6fc45 tty-ask-pw-agent: properly propagate error
7b6e0f74f2 tty-ask-pw-agent: the message string might not be set
0bfe4bd39b tty-ask-pw-agent: make sure "--list" works correctly
0783b4f8ce path: Improve $PATH search directory case
d0735d81d4 path: Skip directories when finalising $PATH search
436872f995 rules: don't install 80-drivers.rules when kmod is disabled
342dc4c15f zsh: correct journalctl command completion parsing
fec0bb6df4 basic/missing_syscall: fix syscall numbers for arm64 :(
bea900bb31 shared/install: fix preset operations for non-service instantiated units
677fb2b663 user-runtime-dir: deal gracefully with missing logind properties
11a97bc230 shared/seccomp: do not use ifdef guards around textual syscall names
d411a4d6a6 machine-id-setup: don't use KVM or container manager supplied uuid if in chroot env
9b078df0ba analyze-security: do not assign badness to filtered-out syscalls
da0cc77b52 load-fragment: fix grammar in error messages
74d7c53e5f test: accept that char device 0/0 can now be created witout privileges
5c35bcf329 tools/make-man-index: fix purpose text that contains tags
da1eb548fb Newer Glibc use faccessat2 to implement faccessat
b44e86ef76 bless-boot: add missing verb to --help
88b6379bcd fix typo in systemctl help
d091e19bbd _sd-common.h: avoid parsing errors with Coverity
d56055f47f nspawn: Fix incorrect usage of putenv
674a2beff0 udev: fix codesonar warnings
16477684d2 sd-boot: fix -Wpointer-sign warning
cc8aeb9916 network: fix static assertion on IPPROTO_MAX range
f047b0706c sd-boot: fix menu ordering with boot counting
896de33984 tests: add a testcase for https://github.com/systemd/systemd/issues/15885
bbc6ff960a network: Fix crash when SendOption= is invalid
1599741b55 kernel-install: strip BOOT_IMAGE= from kernel options
1d1f5006cb basic/user-util: always use base 10 for user/group numbers
b07d782047 parse-util: backport safe_atou32_full()
7bc54463ce Fix build with µhttpd 0.9.71
b074499894 random-seed: add missing header for GRND_NONBLOCK (#14988)
ec9fd71358 makefs: strdup arguments to mkfs
efd5b1d443 network-generator: allow empty hostname
c188248371 network: DHCP lease load SIP copy paste error
cd7d8bb962 davfs is a network file system
6aae7f596a logind: log a more accurate error when we failed at session creation
f4d5928122 docs: Add syntax for templated units to systemd.preset man page
148f7b147a man: add a tiny bit of markup
dbe16df9cd test: wait a bit after starting the test service
a713f52ddb fix journalctl regression (#15099)
49e7c3b617 core: transition to FINAL_SIGTERM state after ExecStopPost=
d25598854d journalctl: show duplicate entries if they are from the same file (#14898)
037a0fa5d0 udev: fix SECLABEL{selinux} issue (#15064)
9de06cd65a dissect-image: avoid scanning partitions
fa65938017 test: ignore IAB capabilities in `test-execute`
16cac70094 Support compiling with clang and gnu11 standard
1ea52d91c8 Typo fix
869614a551 boot: Ensure ARM UEFI binary does not contain FP/SIMD instructions
Patches CVE-2020-13776.patch and systemd-udev-seclabel-options-crash-fix.patch
can be dropped as they are already applied in 244.5 upstream release.
Not needed on master branch or gatesgarth as they run newer systemd version 246.
Tested on an ARM64 target with automatic tests which are passing on our side.
(From OE-Core rev: 0c5151a7ec6ac0aaed1bc56ebb89f17442683072)
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
