SELinux policies commonly contain "dontaudit" rules, which omit
certain denied actions from the audit logs to keep the log volume
manageable. When investigating issues this can become a problem in
itself because messages that could show the cause might be hidden.
The common advice is to use "semodule -DB" to temporarily disable the
dontaudit rules, but this is only possible with a modular policy,
while package/refpolicy builds a monolithic policy. Instead, the
Rules.monolithic makefile offers the "enableaudit" target, which
removes any dontaudit rules before compiling the policy.
This patch adds a config option to run the enableaudit target during
the configure stage, intended for debug builds.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Julien: remove unneeded "default n" in Config.in]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The previous URL [1] currently redirects to [2], which as of this
commit is about two months old and contains a readme that just says
"PoC by Callgh0st". When the package was added with commit [3]
the help text URL matched REFPOLICY_SITE, so presumably the help was
forgotten when the site URL was updated in [4], and there has been
some kind of hostile takeover of the former upstream repository since.
[1] https://github.com/TresysTechnology/refpolicy
[2] https://github.com/Exact-Realty/refpolicy
[3] bb442abdf1
[4] cfa018d9f3
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Julien: add commit ID which forgot to update the package homepage]
Signed-off-by: Julien Olivain <ju.o@free.fr>
$(PREFIX)/lib/python$(PYTHON3_VERSION_MAJOR) is for the standard
library, additional modules like this should go to site-packages.
This patch changes only the host package because Python bindings are
disabled for the target package.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
/usr/lib/python$(PYTHON3_VERSION_MAJOR) is for the standard library,
additional modules like this should go to site-packages.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Drop upstream patch.
Main change in this release is cmake 4 build fix.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Julien Olivain <ju.o@free.fr>
In 2016 buildroot commit b4c050e9af added
-std=gnu++98 also to CFLAGS knowing that it will cause warnings:
https://lists.nongnu.org/archive/html/gpsd-dev/2016-09/msg00082.html
'Although this leads to lots of warnings on every compilation with gcc:
"cc1: warning: command line option '-std=gnu++98' is valid for C++/ObjC++ but not for C"'
These warnings are still present but cause a misdetection in configure
Checking if strerror_r() returns int... no
because here warnings are treated as errors, quoting config.log:
cc1: error: command-line option ‘-std=gnu++98’ is valid for C++/ObjC++ but not for C [-Werror]
cc1: all warnings being treated as errors
In 2017 upstream committed
d287c76f4f
which added "std::" namespace prefixes and fixed the original problem.
-std=gnu++98 being removed from CFLAGS lets configure correctly detect
strerror_r():
Checking if strerror_r() returns int... yes
and no new build errors occur:
arm-aarch64 [ 1/35]: OK
bootlin-aarch64-glibc [ 2/35]: OK
bootlin-arcle-hs38-uclibc [ 3/35]: OK
bootlin-armv5-uclibc [ 4/35]: OK
bootlin-armv7-glibc [ 5/35]: OK
bootlin-armv7m-uclibc [ 6/35]: SKIPPED
bootlin-armv7-musl [ 7/35]: OK
bootlin-m68k-5208-uclibc [ 8/35]: SKIPPED
bootlin-m68k-68040-uclibc [ 9/35]: OK
bootlin-microblazeel-uclibc [10/35]: OK
bootlin-mipsel32r6-glibc [11/35]: OK
bootlin-mipsel-uclibc [12/35]: OK
bootlin-openrisc-uclibc [13/35]: OK
bootlin-powerpc64le-power8-glibc [14/35]: OK
bootlin-powerpc-e500mc-uclibc [15/35]: OK
bootlin-riscv32-glibc [16/35]: OK
bootlin-riscv64-glibc [17/35]: OK
bootlin-riscv64-musl [18/35]: OK
bootlin-s390x-z13-glibc [19/35]: OK
bootlin-sh4-uclibc [20/35]: OK
bootlin-sparc64-glibc [21/35]: OK
bootlin-sparc-uclibc [22/35]: OK
bootlin-x86-64-glibc [23/35]: OK
bootlin-x86-64-musl [24/35]: OK
bootlin-x86-64-uclibc [25/35]: OK
bootlin-x86-i686-musl [26/35]: OK
bootlin-xtensa-uclibc [27/35]: OK
br-arm-basic [28/35]: SKIPPED
br-arm-full-nothread [29/35]: SKIPPED
br-arm-full-static [30/35]: SKIPPED
br-i386-pentium4-full [31/35]: FAILED
br-mips64-n64-full [32/35]: OK
br-mips64r6-el-hf-glibc [33/35]: OK
br-powerpc-603e-basic-cpp [34/35]: SKIPPED
br-powerpc64-power7-glibc [35/35]: OK
35 builds, 6 skipped, 1 build failed, 0 legal-info failed, 0 show-info failed
The br-i386-pentium4-full error is not caused by gpsd:
package/python3/python3.mk:324: *** Python3 doesn't work with uClibc and
kernel headers < 5.1. Please use a different toolchain or unselect
Python3..
Fixes:
https://autobuild.buildroot.org/results/52d747d33d714ea10b9e7ee10adeadd9e4512c2d/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Tested-by: Yann E. MORIN <yann.morin@orange.com>
Reviewed-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following vulnerability:
- CVE-2018-13410
Info-ZIP Zip 3.0, when the -T and -TT command-line options are used,
allows attackers to cause a denial of service (invalid free and
application crash) or possibly have unspecified other impact because
of an off-by-one error. NOTE: it is unclear whether there are
realistic scenarios in which an untrusted party controls the -TT
value, given that the entire purpose of -TT is execution of
arbitrary commands
For more information, see:
- https://nvd.nist.gov//vuln/detail/CVE-2018-13410
This patch also includes the patch 0009 which address a buffer overflow
when passing unicode characters that doesn't have a CVE assigned.
Tested with `./support/testing/run-tests -d dl -o output_folder -k tests.package.test_zip`
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit [1] introduced an extra empty line in the hash file
which makes check-package to report the error:
package/rsyslog/rsyslog.hash:4: consecutive empty lines
This commit fixes that.
[1] b39d3d8f62
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes: https://chrony-project.org/news.html
Enhancements:
- Add maxunreach option to limit selection of unreachable sources
- Add -u option to chronyc to drop root privileges
(default chronyc user is set by configure script)
Bug fixes:
- Hide chronyc socket to mitigate unsafe permissions change
- Fix refclock extpps option to work on Linux >= 6.15
- Validate refclock samples for reachability updates
Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
/etc/audit/audit.rules is the path used by augenrules,
/etc/audit/rules.d/ should be used for snippets to be combined into
that file using augenrules.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
"mkdir -Z" tries to create the directory with the default type context
and does not accept any parameter, leading to mkdir creating a
directory by the name of "system_u:object_r:auditd_log_t" (or failing
to, with a read-only rootfs). Use "--context=" instead to specify the
context.
Letting start-stop-daemon create the auditd PID file leads to an
incorrect label, with type "initrc_runtime_t" instead of
"auditd_runtime_t", which would prevent auditd from writing or
deleting it. Auditd manages its own PID file and daemonizes by
default, so simply drop the --background and --make-pidfile options
from start-stop-daemon.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Cadence MHDP8546 DPTX IP used in TI J721E SoC needs the firmware to
work.
Signed-off-by: Andy Yan <andyshrk@163.com>
[Julien: move Config.in entry from "Wifi" to "Video" section]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes: https://www.php.net/releases/8.4/en.php
Changelog: https://www.php.net/ChangeLog-8.php#PHP_8_4
Removed patch 0006 which is included in this release, rebased remaining
patches.
php commit 1f847a0bdf
added a check on the httpd binary which requires STAGING_DIR being part
of SBINDIR as reported by apxs, adjust apache.mk accordingly.
Upstream commit
ea4e8d513c
causes a build error with older uclibc-based toolchains when detecting
copy_file_range, disable it by adding php_cv_func_copy_file_range=no to
_CONF_ENV for uclibc-toolchains.
Upstream commit
063213b1ae
changed the name of the cache variable ac_cv_have_pcre2_jit to
php_cv_have_pcre2_jit.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BOARD_DIR is not used, so drop it and quote $BINARIES_DIR to make shellcheck
happy.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Added optional support for gtk3 which was added upstream:
e87dcfdaf8
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
