When util-linux is compiled with the uuidd daemon and with systemd
init, the rootfs creation fails in fakeroot as follows:
printf 'host/bin/systemctl --root=build/buildroot-fs/ext2/target preset-all\n' >> build/buildroot-fs/ext2/fakeroot
[...]
FAKEROOTDONTTRYCHOWN=1 host/bin/fakeroot -- build/buildroot-fs/ext2/fakeroot
rootdir=build/buildroot-fs/ext2/target
table='build/buildroot-fs/full_devices_table.txt'
ignored spec: h /var/log/journal/%m - - - - +C
ignored spec: x /var/tmp/systemd-private-%b-*
ignored spec: X /var/tmp/systemd-private-%b-*/tmp
ignored spec: x /var/lib/systemd/coredump/.#core*.%b*
ignored spec: z /var/log/journal/%m 2755 root systemd-journal - -
ignored spec: z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
<stdin>:37: Failed to resolve user 'uuidd': No such process
make[1]: *** [fs/ext2/ext2.mk:66: images/rootfs.ext2] Error 65
make: *** [Makefile:83: _all] Error 2
This error can be reproduced with the commands:
cat <<EOF >.config
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_UTIL_LINUX=y
BR2_PACKAGE_UTIL_LINUX_UUIDD=y
BR2_INIT_SYSTEMD=y
BR2_TARGET_ROOTFS_EXT2=y
EOF
make olddefconfig
make
The error comes from systemctl, which cannot find the uuidd user in
the target rootfs, needed in the uuidd.service unit file [1].
This commit fixes the issue by adding the uuidd user and group in
support/scripts/mkusers syntax.
[1] https://web.git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/misc-utils/uuidd.service.in?h=v2.40.2
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
[Julien: add commands to reproduce the issue in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4809690d42)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cpe:2.3:o:linaro:op-tee:4.3.0:*:*:*:*:*:*:* is a valid CPE ID.
See:
https://nvd.nist.gov/products/cpe/detail/2754E8CF-9BD5-448D-9F32-CFAC92278CD9
Note: this commit needs to set _CPE_ID_PREFIX because optee-os CPE
"part" needs to be set to "o" (OS), while the default Buildroot prefix
is "a" (Application).
Signed-off-by: Daniel Lang <dalang@gmx.at>
[Julien:
- add extra info in commit log (and fix CVE to CPE)
- add a new line after OPTEE_OS_CPE_ID_PRODUCT for readability
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f2498258d4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
systemd automatically creates tmpfs mounts for /tmp, /run, /dev/shm, and
others. If tmpfs is not enabled in the kernel, systemd crashes with an
unknown filesystem error on boot. This hasn't manifested itself during
tests with defconfigs such as pc_x86_64_efi_defconfig for a few reasons:
- No defconfig uses systemd as the init system by default
- Even if a user does use pc_x86_64_efi_defconfig and changes to systemd,
the board/pc/linux.config file enables CONFIG_PCI, which selects
CONFIG_TMPFS.
- The systemd init tests use a prebuilt kernel with tmpfs enabled.
Enable tmpfs unconditionally to ensure that systemd always boots, even with
a minimal kernel built.
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b19976abc9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Typing-extensions has moved to a separate repository, the previous
link now leads to a 404 page. The top level README in the previous
repository points at the new one, see:
fafcdeb724/README.md (repository-content)
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a40ea829ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issue:
CVE-2023-46361: Artifex Software jbig2dec v0.20 was discovered to
contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.
https://www.cve.org/CVERecord?id=CVE-2023-46361
Note that jbig2dec version 0.19 (used in Buildroot 2024.02.11) is not
officially listed as affected, but it actually has the same bug.
Also note that this CVE is about a crash in the CLI tool only.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[Julien: add JBIG2DEC_IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 63c2dd2d40)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
PIDFILE was set incorrectly, watchdogd writes its PID file to
/var/run/watchdogd/pid (note the slash), which is not configurable
without patching.
Restructure the rest of the script to match current style while at it.
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51b848b534)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The bug could lead to incorrect "critical error" reports if that
uninitialized memory happened to contain a value that interpreted as
an int was above the critical threshold. It affected primarily scripts
running approximately one second or longer, because access happens by
timer.
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bfb87bafdb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following vulnerability:
** libgnutls: Fix potential DoS in handling certificates with numerous name
constraints, as a follow-up of CVE-2024-12133 in libtasn1. The
bundled copy of libtasn1 has also been updated to the latest 4.20.0
release to complete the fix. Reported by Bing Shi (#1553).
[GNUTLS-SA-2025-02-07, CVSS: medium] [CVE-2024-12243]
For more details, see the release announcement:
https://lists.gnupg.org/pipermail/gnutls-help/2025-February/004875.html
Update the license info for a move/rename of license files and a slight
rewording. The license clarification is now in README.md so also add that:
a8727cdb0775f5ea8073
Drop now upstreamed
0001-groups-represent-hybrid-groups-with-an-array-of-IDs.patch:
9cc9d5556d
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2461b34077)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes CVE-2024-6387: Unauthenticated root login because of signal
handler race condition.
Drop upstream patch and autoreconf.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 4ac2cc5bee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Previously, these tests had the potential for timing out with the
default 5 second timeout value if initializing /dev/urandom took too
long.
Now the tests use a 10 second timeout value.
Signed-off-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9bc3bbce38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Prior to b7d251293a, txaio would test both asyncio and twisted.
Add back the twisted sample and include the twisted package in the
config so both modes of the package are tested.
Fixes: b7d251293a ("package/python-txaio: drop python 2 support")
Signed-off-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 41b08a779b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-10573: An out-of-bounds write flaw was found in mpg123 when
handling crafted streams. When decoding PCM, the libmpg123 may write past
the end of a heap-located buffer. Consequently, heap corruption may happen,
and arbitrary code execution is not discarded. The complexity required to
exploit this flaw is considered high as the payload must be validated by the
MPEG decoder and the PCM synth before execution. Additionally, to
successfully execute the attack, the user must scan through the stream,
making web live stream content (such as web radios) a very unlikely attack
vector.
https://www.openwall.com/lists/oss-security/2024/10/30/2
Release notes:
https://sourceforge.net/p/mpg123/mailman/message/58834094/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 35d2880e33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-8508: A vulnerability has been discovered in Unbound when handling
replies with very large RRsets that Unbound needs to perform name
compression for.
https://nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: update pgp key id in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3f98b643fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerability:
CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET
https://lists.gnu.org/archive/html/help-libtasn1/2025-02/msg00001.html
Adjust the license files after upstream moved the license clarification to
README.md and moved the COPYING* files top the top level directory /
slightly updated the COPYING* files (http->https) with:
73cc886c3f
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2867f4be42)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The error was introduced by the libcurl bump to 8.12.0 with buildroot
commit 2da031c2e5.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e85cd58fc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 52154e5206 (package/zstd: build multithreaded library if
supported) added an override of a previously defined variable, so an
explicit check-package exception was added in 0f0e913f10
(package/zstd: rework build and install). Eventually, in 253a951c4f
(package/zstd: fix build without threads) the variable override was
removed.
However, the check-package exception was left out during the rework in
253a951c4f, so it now excludes nothing.
Drop this exception now.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad25dd6159)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As pointed out by shellcheck, the exit code of the start/stop/restart/reload
command is clobbered by the 'echo "FAIL'" statement:
In package/mdnsd/S50mdnsd line 52:
exit $?
^-- SC2320 (warning): This $? refers to echo/printf, not a previous command. Assign to variable to avoid it being overwritten.
So introduce a $status variable to keep track of it, similar to how it is
done in S40iwd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit be20c12e15)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As host-heimdal is only used by samba4, and samba4 already depends on
host-flex and host-bison, the build issue fixed by this commit is not
directly visible, but can be reproduced by doing "make host-heimdal"
for example in our official Buildroot Docker container:
/home/thomas/projets/buildroot/outputs/foo/build/host-heimdal-f4faaeaba371fff3f8d1bc14389f5e6d70ca8e17/missing: line 81: flex: command not found
WARNING: 'flex' is missing on your system.
You should only need it if you modified a '.l' file.
You may want to install the Fast Lexical Analyzer package:
<https://github.com/westes/flex>
make[4]: *** [Makefile:753: lex.c] Error 127
[...]
updating lex.yylex.c
../../ylwrap: line 176: -d: command not found
make[4]: *** [Makefile:756: parse.c] Error 127
Fix this by adding the missing dependencies.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44e739d031)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
