Backport patch to fix CVE-2023-39810.
Note that the patch adds a config option which is disabled by
default. So users wanting this feature needs to enable that option.
(From OE-Core rev: b16c9a295d5d2c5d2100bce11fffeae6beb766c5)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Commit 6238ee3ecd (recipes-core/busybox: fixup licensing information)
claims that there is no applicable license identifier in SPDX, so a
bzip2-1.0.4 is made up.
There is no bzip2-1.0.4 license defined in SPDX. However, bzip2-1.0.6 is
the same license.
License-Update: wrong SPDX identifier
(From OE-Core rev: 1b51a0cbfbb64d85756ef231c81aeff02b74bd52)
Signed-off-by: Bastian Germann <bage@debian.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
busybox syslog.service file contains:
Also=busybox-klogd.service
That's why busybox-klog.service got automatically added to
FILES:busybox-syslog. Since this incorrect auto adding feature gets
dropped from systemd.bbclass this needs to be added explicitly.
(From OE-Core rev: 60f1a82e25bd422fb1c380cd5b397718ab6dae13)
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Accidentally enabled in
6a6c6442 ("busybox: refresh the defconfig from 1.33.0").
With this, also CONFIG_FEATURE_VOLUMEID_EROFS was enabled accidentally.
To not break possible existing use cases, we add it to the existing
fragment manually.
(From OE-Core rev: 166c255b9294edc878977d7b214929d6e83b4d67)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These are activated by the longopts.cfg fragment, thus there should be
no need to set them in the defconfig.
The individual long options where enabled without mentioning a specific
need, mostly while adding the corresponding command, thus it should be
safe to disable them.
Note that we cannot disable the general 'LONG_OPTS' feature in the
defconfig since this is e.g. required by CONFIG_HWCLOCK (since v1.37).
(From OE-Core rev: 8cf9c7bd40e58fd363bfbeaf448de399e2e16c71)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This disables getopts.cfg fragment options in the defconfig which were
accidentally enabled in 4335cd24 ("busybox: refresh the defconfig from
1.33.0").
Since there is longopts.cfg for long options, move
CONFIG_FEATURE_GETOPT_LONG there. It was probably not placed there
originally since it does not match the naming scheme of the other long
options.
Note that CONFIG_LONG_OPTS will just be dropped since it is enabled in
defconfig anyway.
(From OE-Core rev: 9022cff09c78fa1e0ac8e2b94c1992caa40074c4)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Accidentally enabled in
4335cd24 ("busybox: refresh the defconfig from 1.33.0").
Since this would also enforce wrong ID ranges due to busbox kconfig's
bad handling of 'inactive' options, manually add them to the
login-utilities.cfg fragment.
(From OE-Core rev: 4f58193b8ecad12945e8b06d270b04d89ecbf2cd)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This disables options from the defconfig file that are enabled by
explicit config fragments.
Having them enabled in the defconfig renders the fragments useless and
takes away the ability to disable options with
SRC_URI:remove = "<fragment>.cfg".
The respective options were all deactivated once but got accidentally
enabled in 4335cd24 ("busybox: refresh the defconfig from 1.33.0").
This commit disables the features for:
- sha1sum.cfg
- sha256sum.cfg
- resize.cfg
- pgrep.cfg
- rev.cfg
(From OE-Core rev: ad4bd190836d2de4bda6a7e59b55bcf8d118fd14)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Done by disabling all current cfg fragments in SRC_URI, running
bitbake -c configure busybox
and copying the generated .config back to the defconfig file.
Changes to CONFIG_EXTRA_CFLAGS were omitted.
CONFIG_SHA1_HWACCEL and CONFIG_SHA256_HWACCEL are disabled explicitly in
the respective fragments (sha1sum.cfg, sha256sum.cfg), thus it makes
sense they've been enabled by default.
(From OE-Core rev: e68e47722514f550c27d877959f16b2e5a1f475e)
Signed-off-by: Enrico Jörns <ejo@pengutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- update to next stable version 1.37.0
- refresh defconfig
- disable new applets (ip_link_can)
- enable new applets (time64, find_exec_ok, getfattr, udhcpd_bootp)
- disable sha acceleration by default
- enable it just for x86-64, other possible option (x86) is broken
- submitted to mailing list
- fix problem with syslogd when nothing was logged
- fix problem with start-stop-daemon tests
- remove and refresh already merged patches
(From OE-Core rev: 21753f16a364e32050cf8d79bfa7e0f89be52ce7)
Signed-off-by: Andrej Valek <andrej.v@skyrain.eu>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes and issue that allows blank lines to be incorrectly output
when the "-s" flag is included. This issue propogates into the
populate-volatile.sh script in initscripts. If a volatiles drop file
contains blank lines, a blank line will be included in combined users,
which will incorrectly result in a difference in the number of combined
users versus defined users. If this happens, the volatiles file will not
be executed.
(From OE-Core rev: dfbcf0581ab3dd47037726a7b8aa06f777792473)
Signed-off-by: Colin McAllister <colinmca242@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We now have 6.9 kernel headers in master which means
busybox builds with CONFIG_TC will fail to build due
to CBQ being dropped in kernel 6.8+
Apply a fix which is reported upstream
(From OE-Core rev: 3afbeb1ea418a69a452e82cbce00c36452b75f1e)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Backport patch for CVE-2021-42380.
Additionally backport clang regression fix caused by this patch.
(From OE-Core rev: 66543769ff79d81508bb703bd2fc34871a16e2c7)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The default busybox wget https support is suboptimal, it silently ignores
checking certificate validity which isn't great for security.
Switch our defaults to disable the internal busybox tls code and the
https support using it and configure the openssl backend instead.
This this is done by spawning an openssl command, we don't need
dependencies on openssl for build. For runtime, we can assume
people would install openssl if they need/want this.
These changes put our default busybox configuration in a more secure
initial set of settings.
[YOCTO #14125]
(From OE-Core rev: 5d4ad13462f12355ff0f2bc1773ab4b1814b165a)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Where recipes use S = ${WORKDIR}, change them to set UNPACKDIR to
a subdir of WORKDIR and make S point at this instead.
I've chosen not to force S into any standard UNPACKDIR we may pick in
future just so the S = UNPACKDIR case is clearly visible by the
directory naming under WORKDIR as that should aid usability.
(From OE-Core rev: d9328e3b0b062f0621de3d114584b44f384a1c02)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since we want to be able to stop unpacking to WORKDIR, correct the WORKDIR
references in recipe do_compile/do_install tasks to use UNPACKDIR in the
appropraite places instead.
(From OE-Core rev: d73595df69667fe9d12ecd407b77a0b8dae2109c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Where recipes use S = ${WORKDIR}, ensure they are referencing ${S} correctly
to access files as soon we want to stop doing this in WORKDIR at which point
they would break unless corrected.
(From OE-Core rev: f25dd633fffe6560f191526d1869e657e129bad9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Description: In case of two or more consoles are in inittab,
and not specified tty device for first one, some keys works improperly,
ex: arrows, backspace, pgup/pgdown; The patch is fixes this issue.
(From OE-Core rev: 7eea4ef84d74e618fb00fa73c773acdf775d052a)
Signed-off-by: Aleksey Smirnov <aleksey.smirnov@yadro.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
runlevel misc applet is enabled when using init feature from busybox
however this applet does not build right now because it depends on utmp
feature and its disabled for musl systems. runlevel is used by
update-rd.d tool during system maintenance e.g. opkg upgrade etc.
(From OE-Core rev: de62069c32fedd094c279b99b2ff389c7e0012aa)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A testing failure meant that the inittab changes made in 6c65544 didn't
actually work.
A copy-paste problems meant that start_getty was being invoked instead
of getty, but start_getty is sysvinit-inittab-specific. Revert this
inittab to calling getty directly.
Remove the terminal type, this wasn't specified in the original inittab.
Busybox's init has non-standard behaviour for the inittab's ID field.
With SysV this is a four-character identifier and nothing more, but with
busybox init this is the controlling terminal (minus /dev). If the
terminal doesn't exist then busybox doesn't gracefully handle the
failure but instead repeatedly fails to spawn.
As getty will immediately issue a setsid() this isn't needed for getty
entries, so the ID can be empty and ttyrun does the terminal detection.
(From OE-Core rev: 71202782a06ed1f0a17e00072b74b21195f2f5f9)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wrap calls to start_getty with ttyrun, so that getty isn't started if
the device doesn't exist. As we know start_getty is only called when
the device exists we can remove the partial workaround for this problem
in that scripts too.
This neatly obsoletes SERIAL_CONSOLES_CHECK, whose sole purpose was to
check what terminals are present at boot and rewrite inittab. Notably,
this meant that SERIAL_CONSOLES_CHECK made using a read-only rootfs
impossible.
(From OE-Core rev: 950ecaabc04836efc346be0ac7e0331e2378872b)
(From OE-Core rev: 6c655441ff5cd0d8877891ff37f8cfa983363a2a)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This script is not always called with /sbin and /usr/sbin in the PATH
already, for example when called via ssh. Explicitly set PATH to make
sure it includes /sbin and /usr/sbin since that's where start-stop-daemon
is located.
(From OE-Core rev: fa53f898eaba15dff030f9eadf86e5bca7d954fa)
Signed-off-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This matters on 32 bit systems where otherwise timestamp manipulation
in shell scripts would overflow after 2038. One of the scripts in
strace test suite exposed the issue.
(From OE-Core rev: 8165c980338d4719004bf62644e0fe24ef309fe0)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A dependency on coreutils was added to busybox-ptest in oe-core 658c5ed
to fix a test failure.
The failure is because one of the start-stop-daemon tests is known to
fail if /bin/false is busybox. Instead of failing, we can check if
/bin/false is a symlink to busybox and skip the test if so.
[ YOCTO #15068 ]
(From OE-Core rev: 37482e404cf4dcf9360c29986ced8db78baf249b)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
hwclock.sh had default update-rc parameters which made it run after
other tasks that work with the clock such as connman. This causes a
time obtained by NTP to be clobbered by a potentially incorrect time
in the RTC.
Provide non-default INITSCRIPT_PARAMS to have hwclock.sh run during
the rc startup before runlevel initscripts start.
(From OE-Core rev: 3012bac35ada9a9f66d9e6e2fecaee09527b9d44)
Signed-off-by: Chris Elledge <celledge@siteworx.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ironically, busybox ptests don't all work without coreutils being present. This
dependency fixes execution in minimal images but the failing start-stop-daemon
test case should probably be investigated in due course and the dependency
removed when possible.
(From OE-Core rev: 658c5ed34e279983b1827abfe4e439524b72d4a9)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The original patch was actually allowing .debug modules
though which was in-correct. This change blocks the
parsing of .debug modules (which is correct). As noted in
[YOCTO #15022] this should address the empty modules.dep
when using the BusyBox depmod.
(From OE-Core rev: 339c3c3abe8d405cfe7b3f34db9b3547bcaaf878)
Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- update to next (un)stable version 1.36.0
- refresh defconfig
- disable new applets (tree, tsort, seedrng)
- use hw-accel for sha1/256 sums when available
- remove and refresh already merged patches
(From OE-Core rev: 2e9989a8f8b5b93476e551475df010add32aac31)
Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
To avoid working with undeterministic config files, remove all the
temporary files to start from scratch.
(From OE-Core rev: 74cd440c4e3df0ed3b81cf5c60a3f92e0dd3fe6c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
When compiling busybox a second time (e.g. with `compile -f`), busybox
can use an altered autoconf.h file for compiling, which can ultimately
produces different and unwanted binaries.
This can produce errors like this one:
ERROR: busybox-1.35.0-r0 do_package: Error executing a python function in exec_func_python() autogenerated:
The stack trace of python calls that resulted in this exception/failure was:
File: 'exec_func_python() autogenerated', lineno: 2, function: <module>
0001:
*** 0002:ptest_update_alternatives(d)
0003:
File: '…/poky/meta/classes/ptest.bbclass', lineno: 100, function: ptest_update_alternatives
0096: for alt_name, alt_link, alt_target, _ in alternatives:
0097: # Some alternatives are for man pages,
0098: # check if the alternative is in PATH
0099: if os.path.dirname(alt_link) in bin_paths:
*** 0100: os.symlink(alt_target, os.path.join(ptest_bindir, alt_name))
0101:}
0102:
0103:do_configure_ptest_base[dirs] = "${B}"
0104:do_compile_ptest_base[dirs] = "${B}"
Exception: FileExistsError: [Errno 17] File exists: '/bin/busybox.suid' -> '…/busybox/1.35.0-r0/package/usr/lib/busybox/ptest/bin/login'
This happens because ALTERNATIVE:busybox contains `/bin/login` twice,
initially that's because `/bin/login` is present in both
busybox.links.suid and busybox.links.nosuid. The reason for that is
because of the altered autoconf.h.
Steps to reproduce above error:
<add ptest to distro configs>
bitbake busybox -c clean
bitbake busybox -c package -f
bitbake busybox -c compile -f
bitbake busybox -c package -f
This patch guards against potential bugs by:
- making a backup of .config and autoconf.h that have matching
timestamps.
- make sure do_compile always starts with these files.
- restore .config and autoconf.h at the end of do_compile.
(From OE-Core rev: 6b4a0f063edcfe0a5a4f418842e86ac0c46d9cad)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This symlink is not valid when using usrmerge and ptest packaging would fail
Exception: FileExistsError: [Errno 17] File exists: '/usr/bin/busybox.suid' -> '/mnt/b/yoe/master/build/tmp/work/ppc64p9le-yoe-linux-musl/busybox/1.35.0-r0/package/usr/lib/busybox/ptest/bin/login'
(From OE-Core rev: 238fd30689054c7b44176dce7180fb6dac4e1b6f)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code
if netstat is used to print a DNS PTR record's value to a VT compatible
terminal. Alternatively, the attacker could choose to change the terminal's colors.
https://nvd.nist.gov/vuln/detail/CVE-2022-28391
(From OE-Core rev: 3e17df4cd17c132dc7732ebd3d1c80c81c85bcc4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As with the kmod version of depmod, exclude .debug from being
searched. Since busybox does not use the depmod.d and any
configuration file option is ignored we just hardcode it.
(From OE-Core rev: c082752c06d5723433886cbf7ce2d88a51fb64f1)
Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.
(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
