Add a fix for CVE-2017-9445: In systemd through 233, certain sizes passed to
dns_packet_new in systemd-resolved can cause it to allocate a buffer that's
too small. A malicious DNS server can exploit this via a response with a
specially crafted TCP payload to trick systemd-resolved into allocating a
buffer that's too small, and subsequently write arbitrary data beyond the
end of it.
The other patch fixes an issue with the security fix.
[Peter: use CVE description from MITRE]
Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6da327adb2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
systemd's configure is looking in $PATH to find utilities that will be
needed at runtime.
Usually, those utilties, when installed on the host, will be found in
the same path they would be present on the target. For example,
/usr/bin/mount on the host would also be /usr/bin/mount on the target,
and all is find.
Except when we need to install a host variant of util-linux, which will
install mount in $(HOST_DIR), in which case systemd's configure would
find that one.
Of course, it is also very well possible that those utilities are not
installed on the host in the same location they would be on the target,
in case a user has manually installed some of those (e.g. in /usr/local/
or in /opt/)
Forcibly set the path to those utilities, as they are expected to be on
the target.
For kexec, we can set it even though we do not depend on it (yet).
systemd will appropriately test it at runtime.
For quota, we point to non-existing files, so as to catch errors at
runtime. It is to be noted that quotacheck is optional, while quotaon
does not seem to be (a service file is always installed, that uses it).
Note: utilties listed in the order they appear in configure.ac
Reported-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Cc: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 68986ea301)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Select the fsck required by systemd provided by util-linux. This
prevents ending up with fsck from busybox, which is incompatible
with systemd.
Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
(cherry picked from commit 3fddb73ffd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Allow automatic network configuration via systemd-networkd if selected.
If systemd-networkd is enabled and $BR2_SYSTEM_DHCP is set, then create
a .network file to configure the selected network interface via DHCP.
Signed-off-by: Eric Le Bihan <eric.le.bihan.dev@free.fr>
[Thomas:
- merge the two patches from Eric into just one
- instead of generating the dhcp.network file completely from the .mk
file, use a template file, and "sed" it with the right network
interface]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Commit 006a328ad6 ("util-linux: fix build with ncurses") removed
dependency on BR2_USE_WCHAR, but failed to update the reverse
dependencies of util-linux.
This commit fixes all such reverse dependencies by removing dependency
on BR2_USE_WCHAR as it is not required by package itself.
Fixes: 006a328ad6 ("util-linux: fix build with ncurses")
Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
systemd currently has selinux disabled unconditionally. This prevents
/sys/fs/selinux from being mounted automatically at boot which causes
audit to no longer function. This patch fixes the problem by checking if
libselinux is enabled and enabling support for selinux in systemd if so.
Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
systemd-firstboot is never invoked since systemd's first boot detection
logic checks whether /etc/machine-id exists. Since the file is created
automatically by systemd.mk, systemd will never detect first boot and
therefore the systemd-firstboot.service unit file will never get run.
Additionally, if /etc/machine-id is removed to allow systemd-firstboot
to run, it interactively prompts for the system locale. This makes it
seem unlikely that an embedded system would want to use it.
Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
- 0002 patch tweaked. There is a hunk that has been removed upstream by
this commit:
082210c7a8
- Patches 0004, 0005 and 0006 were backported from upstream and now they
are included in this release, so drop them.
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Toolchains using glibc-2.18 or older do not define O_TMPFILE, which
causes build failures on some archs.
systemd has a definition for O_TMPFILE if it is missing, but only
defines it for i386 or x86_64. Furthermore, the header defining it is
not included everywhere O_TMPFILE is used.
Fix that with three patches backported from upstream:
- include the needed header where it is needed (he!),
- define O_TMPFILE for all archs, according to linux-4.8rc3,
- no longer guard against undefined O_TMPFILE in fileio.
Upstream merge commit:
4a13100c6a
Fixes:
http://autobuild.buildroot.net/results/b0067e72ffcbbe1db9ef49ab297cece951345aeb/
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This patch is based on a patch sent by Vicente Olivert Riera and commented by
Arnout Vandecappelle [1].
- Bump version to 1.23
- Add a hook to fix cross-compilation
- Fix license and license files
- Remove patch applied upstream
- Add a BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS variable
- Propagate the dependencies using that variable:
* package/cppcms
* package/crda
* package/gnupg2
- package/gcr
- package/midori
* package/kodi
* package/libaacs
* package/libassuan
* package/libgcrypt
* package/libgpgme
* package/libksba
* package/libmicrohttpd
- package/janus-gateway
- package/kodi
- package/ola
- package/systemd
* package/libssh
* package/libssh2
- package/php-ssh2
* package/netatalk
* package/network-manager
* package/ntfs-3g
* package/opkg
* package/php-gnupg
* package/rng-tools
* package/strongswan
* package/vpnc
[1] http://patchwork.ozlabs.org/patch/416427/
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
[Thomas:
- rebase on master
- changing systemd no longer needed, as it no longer selects
libgcrypt.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
[Maxime:
- rebase on master
- bump to new version
- propagate dependencies to missing packages]
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
[Thomas:
- fix hash file.
- change the way to handle the various arch so that it works properly
for uClibc.
- add nios2 arch support.
- Maxime Hadjinlian learned some basic Emacs-fu to do the final fixups
of this commit.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Since systemd v230, bootchart has been removed from the source of
systemd and now lives in its own repository.
A new package will be added in the next commit.
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Since v230 of systemd, the compat libraries have been fully removed.
4de282cf93
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
[Thomas: rewrap Config.in help text in Config.in.legacy and put the
option at the right place.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
It seems logical to enable a few options along with systemd when it's
the init system.
Also change the help as timesyncd is a daemon that implements an SNTP client.
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
We don't want to create a bunch of group and users that might not be
used, it's more elegant to create them when the associated features is
selected.
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The support of qrencode depends of the journal gateway feature as it is
used to display the key used to seal the journal.
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
systemd-journal is a group used for controlling user access to the
journal when used with tools like journalctl.
While we're at it, sort the users list to improve readability.
Signed-off-by: Gabe Evans <gabe@hashrabbit.co>
Signed-off-by: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
By default hwdb files are installed in /usr/lib/udev/hwdb.d
Currently they take about ~5MB. After first boot, systemd-hwdb tool
parses them and creates a binary in /etc/udev/hwdb.bin, which takes
another ~6.5MB.
In case of initramfs images, hwdb parsing is done every boot. This adds
about 2-3 seconds to boot time in case of rootfs on SDHC class 10
card (benchmarked with am335x board). NAND boot takes even longer.
Add config option to disable hwdb in systemd, for smaller images and
better boot performance.
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
