Development August 2022

development@lists.ipfire.org

13 participants
74 discussions

[RFC PATCH] linux: Disable tracers
by Peter Müller 06 Aug '22

06 Aug '22

Since these server no use on an IPFire machine in production, but may be leveraged by attackers (and sources such as KSPP recommend disabling them), drop all the tracers. Changes to configurations aside x86_64 have been simulated. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 58 +------------------- config/kernel/kernel.config.armv6l-ipfire | 58 +------------------- config/kernel/kernel.config.riscv64-ipfire | 58 +------------------- config/kernel/kernel.config.x86_64-ipfire | 64 +--------------------- 4 files changed, 4 insertions(+), 234 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 6a0ea681d..c994c0dd2 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -127,8 +127,6 @@ CONFIG_TREE_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y CONFIG_TREE_SRCU=y -CONFIG_TASKS_RCU_GENERIC=y -CONFIG_TASKS_RUDE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -254,7 +252,6 @@ CONFIG_SHUFFLE_PAGE_ALLOCATOR=y CONFIG_SLUB_CPU_PARTIAL=y CONFIG_SYSTEM_DATA_VERIFICATION=y # CONFIG_PROFILING is not set -CONFIG_TRACEPOINTS=y # end of General setup CONFIG_ARM64=y @@ -648,7 +645,6 @@ CONFIG_CRYPTO_AES_ARM64_BS=m # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_HAVE_KPROBES=y CONFIG_HAVE_KRETPROBES=y @@ -1634,7 +1630,6 @@ CONFIG_NET_FLOW_LIMIT=y # Network testing # # CONFIG_NET_PKTGEN is not set -# CONFIG_NET_DROP_MONITOR is not set # end of Network testing # end of Networking options @@ -2973,12 +2968,10 @@ CONFIG_ADM8211=m CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y CONFIG_ATH_DEBUG=y -# CONFIG_ATH_TRACEPOINTS is not set CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING=y CONFIG_ATH5K=m # CONFIG_ATH5K_DEBUG is not set -# CONFIG_ATH5K_TRACER is not set CONFIG_ATH5K_PCI=y # CONFIG_ATH5K_TEST_CHANNELS is not set CONFIG_ATH9K_HW=m @@ -3013,14 +3006,12 @@ CONFIG_ATH10K_SDIO=m CONFIG_ATH10K_USB=m CONFIG_ATH10K_DEBUG=y # CONFIG_ATH10K_DEBUGFS is not set -# CONFIG_ATH10K_TRACING is not set CONFIG_ATH10K_DFS_CERTIFIED=y CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set CONFIG_ATH11K=m CONFIG_ATH11K_PCI=m # CONFIG_ATH11K_DEBUG is not set -# CONFIG_ATH11K_TRACING is not set CONFIG_WLAN_VENDOR_ATMEL=y CONFIG_ATMEL=m CONFIG_PCI_ATMEL=m @@ -3099,7 +3090,6 @@ CONFIG_IWLWIFI_OPMODE_MODULAR=y # Debugging Options # # CONFIG_IWLWIFI_DEBUG is not set -# CONFIG_IWLWIFI_DEVICE_TRACING is not set # end of Debugging Options CONFIG_WLAN_VENDOR_INTERSIL=y @@ -7420,7 +7410,6 @@ CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" # CONFIG_PSTORE_CONSOLE is not set # CONFIG_PSTORE_PMSG is not set -# CONFIG_PSTORE_FTRACE is not set # CONFIG_PSTORE_RAM is not set # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set @@ -7814,8 +7803,6 @@ CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking -CONFIG_BINARY_PRINTF=y - # # Library routines # @@ -8036,7 +8023,6 @@ CONFIG_DEBUG_MISC=y # CONFIG_DEBUG_PAGEALLOC is not set # CONFIG_PAGE_OWNER is not set # CONFIG_PAGE_POISONING is not set -# CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set CONFIG_ARCH_HAS_DEBUG_WX=y CONFIG_DEBUG_WX=y @@ -8147,7 +8133,6 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=21 # CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set # CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set # CONFIG_LATENCYTOP is not set -CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y @@ -8155,49 +8140,8 @@ CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_C_RECORDMCOUNT=y -CONFIG_TRACER_MAX_TRACE=y -CONFIG_TRACE_CLOCK=y -CONFIG_RING_BUFFER=y -CONFIG_EVENT_TRACING=y -CONFIG_CONTEXT_SWITCH_TRACER=y -CONFIG_TRACING=y -CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y -CONFIG_FTRACE=y -# CONFIG_BOOTTIME_TRACING is not set -CONFIG_FUNCTION_TRACER=y -CONFIG_FUNCTION_GRAPH_TRACER=y -CONFIG_DYNAMIC_FTRACE=y -CONFIG_DYNAMIC_FTRACE_WITH_REGS=y -CONFIG_FUNCTION_PROFILER=y -CONFIG_STACK_TRACER=y -# CONFIG_IRQSOFF_TRACER is not set -CONFIG_SCHED_TRACER=y -# CONFIG_HWLAT_TRACER is not set -# CONFIG_OSNOISE_TRACER is not set -# CONFIG_TIMERLAT_TRACER is not set -# CONFIG_FTRACE_SYSCALLS is not set -CONFIG_TRACER_SNAPSHOT=y -# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set -CONFIG_BRANCH_PROFILE_NONE=y -# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -# CONFIG_BLK_DEV_IO_TRACE is not set -CONFIG_UPROBE_EVENTS=y -CONFIG_DYNAMIC_EVENTS=y -CONFIG_PROBE_EVENTS=y -CONFIG_FTRACE_MCOUNT_RECORD=y -CONFIG_FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY=y -# CONFIG_SYNTH_EVENTS is not set -# CONFIG_HIST_TRIGGERS is not set -# CONFIG_TRACE_EVENT_INJECT is not set -# CONFIG_TRACEPOINT_BENCHMARK is not set -CONFIG_RING_BUFFER_BENCHMARK=m -# CONFIG_TRACE_EVAL_MAP_FILE is not set -# CONFIG_FTRACE_RECORD_RECURSION is not set -# CONFIG_FTRACE_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set -# CONFIG_PREEMPTIRQ_DELAY_TEST is not set +# CONFIG_FTRACE is not set # CONFIG_SAMPLES is not set CONFIG_STRICT_DEVMEM=y CONFIG_IO_STRICT_DEVMEM=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index 9d2776bd2..5fe1bd0e2 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -134,8 +134,6 @@ CONFIG_TREE_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y CONFIG_TREE_SRCU=y -CONFIG_TASKS_RCU_GENERIC=y -CONFIG_TASKS_RUDE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -257,7 +255,6 @@ CONFIG_SHUFFLE_PAGE_ALLOCATOR=y CONFIG_SLUB_CPU_PARTIAL=y CONFIG_SYSTEM_DATA_VERIFICATION=y # CONFIG_PROFILING is not set -CONFIG_TRACEPOINTS=y # end of General setup CONFIG_ARM=y @@ -740,7 +737,6 @@ CONFIG_AS_VFP_VMRS_FPINST=y # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y CONFIG_HAVE_KPROBES=y @@ -1644,7 +1640,6 @@ CONFIG_NET_FLOW_LIMIT=y # Network testing # # CONFIG_NET_PKTGEN is not set -# CONFIG_NET_DROP_MONITOR is not set # end of Network testing # end of Networking options @@ -2968,7 +2963,6 @@ CONFIG_ADM8211=m CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y CONFIG_ATH_DEBUG=y -# CONFIG_ATH_TRACEPOINTS is not set CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING=y # CONFIG_ATH5K is not set @@ -3005,14 +2999,12 @@ CONFIG_ATH10K_SDIO=m CONFIG_ATH10K_USB=m CONFIG_ATH10K_DEBUG=y # CONFIG_ATH10K_DEBUGFS is not set -# CONFIG_ATH10K_TRACING is not set CONFIG_ATH10K_DFS_CERTIFIED=y CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set CONFIG_ATH11K=m CONFIG_ATH11K_PCI=m # CONFIG_ATH11K_DEBUG is not set -# CONFIG_ATH11K_TRACING is not set CONFIG_WLAN_VENDOR_ATMEL=y CONFIG_ATMEL=m CONFIG_PCI_ATMEL=m @@ -3091,7 +3083,6 @@ CONFIG_IWLWIFI_OPMODE_MODULAR=y # Debugging Options # # CONFIG_IWLWIFI_DEBUG is not set -# CONFIG_IWLWIFI_DEVICE_TRACING is not set # end of Debugging Options CONFIG_WLAN_VENDOR_INTERSIL=y @@ -7434,7 +7425,6 @@ CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" # CONFIG_PSTORE_CONSOLE is not set # CONFIG_PSTORE_PMSG is not set -# CONFIG_PSTORE_FTRACE is not set # CONFIG_PSTORE_RAM is not set # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set @@ -7824,8 +7814,6 @@ CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking -CONFIG_BINARY_PRINTF=y - # # Library routines # @@ -8026,7 +8014,6 @@ CONFIG_DEBUG_MISC=y # CONFIG_DEBUG_PAGEALLOC is not set # CONFIG_PAGE_OWNER is not set # CONFIG_PAGE_POISONING is not set -# CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set # CONFIG_DEBUG_WX is not set # CONFIG_DEBUG_OBJECTS is not set @@ -8122,7 +8109,6 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=21 # CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set # CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set # CONFIG_LATENCYTOP is not set -CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y @@ -8130,50 +8116,8 @@ CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_C_RECORDMCOUNT=y -CONFIG_TRACER_MAX_TRACE=y -CONFIG_TRACE_CLOCK=y -CONFIG_RING_BUFFER=y -CONFIG_EVENT_TRACING=y -CONFIG_CONTEXT_SWITCH_TRACER=y -CONFIG_TRACING=y -CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y -CONFIG_FTRACE=y -# CONFIG_BOOTTIME_TRACING is not set -CONFIG_FUNCTION_TRACER=y -CONFIG_FUNCTION_GRAPH_TRACER=y -CONFIG_DYNAMIC_FTRACE=y -CONFIG_DYNAMIC_FTRACE_WITH_REGS=y -CONFIG_FUNCTION_PROFILER=y -CONFIG_STACK_TRACER=y -# CONFIG_IRQSOFF_TRACER is not set -CONFIG_SCHED_TRACER=y -# CONFIG_HWLAT_TRACER is not set -# CONFIG_OSNOISE_TRACER is not set -# CONFIG_TIMERLAT_TRACER is not set -# CONFIG_FTRACE_SYSCALLS is not set -CONFIG_TRACER_SNAPSHOT=y -# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set -CONFIG_BRANCH_PROFILE_NONE=y -# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -# CONFIG_PROFILE_ALL_BRANCHES is not set -# CONFIG_BLK_DEV_IO_TRACE is not set -CONFIG_UPROBE_EVENTS=y -CONFIG_DYNAMIC_EVENTS=y -CONFIG_PROBE_EVENTS=y -CONFIG_FTRACE_MCOUNT_RECORD=y -CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT=y -# CONFIG_SYNTH_EVENTS is not set -# CONFIG_HIST_TRIGGERS is not set -# CONFIG_TRACE_EVENT_INJECT is not set -# CONFIG_TRACEPOINT_BENCHMARK is not set -CONFIG_RING_BUFFER_BENCHMARK=m -# CONFIG_TRACE_EVAL_MAP_FILE is not set -# CONFIG_FTRACE_RECORD_RECURSION is not set -# CONFIG_FTRACE_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set -# CONFIG_PREEMPTIRQ_DELAY_TEST is not set +# CONFIG_FTRACE is not set # CONFIG_SAMPLES is not set CONFIG_STRICT_DEVMEM=y CONFIG_IO_STRICT_DEVMEM=y diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index c379447e7..d1b8a4f78 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -119,8 +119,6 @@ CONFIG_TREE_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y CONFIG_TREE_SRCU=y -CONFIG_TASKS_RCU_GENERIC=y -CONFIG_TASKS_RUDE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -237,7 +235,6 @@ CONFIG_SHUFFLE_PAGE_ALLOCATOR=y CONFIG_SLUB_CPU_PARTIAL=y CONFIG_SYSTEM_DATA_VERIFICATION=y # CONFIG_PROFILING is not set -CONFIG_TRACEPOINTS=y # end of General setup CONFIG_64BIT=y @@ -346,7 +343,6 @@ CONFIG_PM_CLK=y # CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y -CONFIG_UPROBES=y CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y CONFIG_HAVE_KPROBES=y CONFIG_HAVE_KRETPROBES=y @@ -1239,7 +1235,6 @@ CONFIG_NET_FLOW_LIMIT=y # Network testing # # CONFIG_NET_PKTGEN is not set -# CONFIG_NET_DROP_MONITOR is not set # end of Network testing # end of Networking options @@ -2474,12 +2469,10 @@ CONFIG_ADM8211=m CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y CONFIG_ATH_DEBUG=y -# CONFIG_ATH_TRACEPOINTS is not set CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING=y CONFIG_ATH5K=m CONFIG_ATH5K_DEBUG=y -# CONFIG_ATH5K_TRACER is not set CONFIG_ATH5K_PCI=y # CONFIG_ATH5K_TEST_CHANNELS is not set CONFIG_ATH9K_HW=m @@ -2507,7 +2500,6 @@ CONFIG_CARL9170_HWRNG=y CONFIG_AR5523=m CONFIG_WIL6210=m CONFIG_WIL6210_ISR_COR=y -CONFIG_WIL6210_TRACING=y # CONFIG_WIL6210_DEBUGFS is not set CONFIG_ATH10K=m CONFIG_ATH10K_CE=y @@ -2517,14 +2509,12 @@ CONFIG_ATH10K_SDIO=m CONFIG_ATH10K_USB=m CONFIG_ATH10K_DEBUG=y # CONFIG_ATH10K_DEBUGFS is not set -# CONFIG_ATH10K_TRACING is not set CONFIG_ATH10K_DFS_CERTIFIED=y CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set CONFIG_ATH11K=m CONFIG_ATH11K_PCI=m # CONFIG_ATH11K_DEBUG is not set -# CONFIG_ATH11K_TRACING is not set CONFIG_WLAN_VENDOR_ATMEL=y CONFIG_ATMEL=m CONFIG_PCI_ATMEL=m @@ -2605,7 +2595,6 @@ CONFIG_IWLWIFI_OPMODE_MODULAR=y # Debugging Options # # CONFIG_IWLWIFI_DEBUG is not set -# CONFIG_IWLWIFI_DEVICE_TRACING is not set # end of Debugging Options CONFIG_WLAN_VENDOR_INTERSIL=y @@ -6058,7 +6047,6 @@ CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" # CONFIG_PSTORE_CONSOLE is not set # CONFIG_PSTORE_PMSG is not set -# CONFIG_PSTORE_FTRACE is not set # CONFIG_PSTORE_RAM is not set # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set @@ -6452,8 +6440,6 @@ CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking -CONFIG_BINARY_PRINTF=y - # # Library routines # @@ -6624,7 +6610,6 @@ CONFIG_DEBUG_MISC=y # CONFIG_DEBUG_PAGEALLOC is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_POISONING=y -# CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set CONFIG_ARCH_HAS_DEBUG_WX=y CONFIG_DEBUG_WX=y @@ -6735,55 +6720,14 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=60 # CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set # CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set # CONFIG_LATENCYTOP is not set -CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y CONFIG_HAVE_SYSCALL_TRACEPOINTS=y -CONFIG_TRACER_MAX_TRACE=y -CONFIG_TRACE_CLOCK=y -CONFIG_RING_BUFFER=y -CONFIG_EVENT_TRACING=y -CONFIG_CONTEXT_SWITCH_TRACER=y -CONFIG_TRACING=y -CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y -CONFIG_FTRACE=y -# CONFIG_BOOTTIME_TRACING is not set -CONFIG_FUNCTION_TRACER=y -CONFIG_FUNCTION_GRAPH_TRACER=y -CONFIG_DYNAMIC_FTRACE=y -CONFIG_DYNAMIC_FTRACE_WITH_REGS=y -CONFIG_FUNCTION_PROFILER=y -CONFIG_STACK_TRACER=y -# CONFIG_IRQSOFF_TRACER is not set -CONFIG_SCHED_TRACER=y -# CONFIG_HWLAT_TRACER is not set -# CONFIG_OSNOISE_TRACER is not set -# CONFIG_TIMERLAT_TRACER is not set -CONFIG_FTRACE_SYSCALLS=y -CONFIG_TRACER_SNAPSHOT=y -# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set -CONFIG_BRANCH_PROFILE_NONE=y -# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -# CONFIG_BLK_DEV_IO_TRACE is not set -CONFIG_UPROBE_EVENTS=y -CONFIG_DYNAMIC_EVENTS=y -CONFIG_PROBE_EVENTS=y -CONFIG_FTRACE_MCOUNT_RECORD=y -CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT=y -# CONFIG_SYNTH_EVENTS is not set -# CONFIG_TRACE_EVENT_INJECT is not set -# CONFIG_TRACEPOINT_BENCHMARK is not set -CONFIG_RING_BUFFER_BENCHMARK=m -# CONFIG_TRACE_EVAL_MAP_FILE is not set -# CONFIG_FTRACE_RECORD_RECURSION is not set -# CONFIG_FTRACE_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set -# CONFIG_PREEMPTIRQ_DELAY_TEST is not set +# CONFIG_FTRACE is not set # CONFIG_SAMPLES is not set CONFIG_STRICT_DEVMEM=y CONFIG_IO_STRICT_DEVMEM=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index f58bf4b2f..0b1e6b78a 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -147,8 +147,6 @@ CONFIG_TREE_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y CONFIG_TREE_SRCU=y -CONFIG_TASKS_RCU_GENERIC=y -CONFIG_TASKS_RUDE_RCU=y CONFIG_RCU_STALL_COMMON=y CONFIG_RCU_NEED_SEGCBLIST=y # end of RCU Subsystem @@ -277,7 +275,6 @@ CONFIG_SHUFFLE_PAGE_ALLOCATOR=y CONFIG_SLUB_CPU_PARTIAL=y CONFIG_SYSTEM_DATA_VERIFICATION=y # CONFIG_PROFILING is not set -CONFIG_TRACEPOINTS=y # end of General setup CONFIG_64BIT=y @@ -476,7 +473,6 @@ CONFIG_LEGACY_VSYSCALL_NONE=y # CONFIG_CMDLINE_BOOL is not set # CONFIG_MODIFY_LDT_SYSCALL is not set CONFIG_HAVE_LIVEPATCH=y -# CONFIG_LIVEPATCH is not set # end of Processor type and features CONFIG_CC_HAS_SLS=y @@ -664,7 +660,6 @@ CONFIG_KVM_INTEL=m CONFIG_KVM_AMD=m CONFIG_KVM_AMD_SEV=y # CONFIG_KVM_XEN is not set -CONFIG_KVM_MMU_AUDIT=y CONFIG_AS_AVX512=y CONFIG_AS_SHA1_NI=y CONFIG_AS_SHA256_NI=y @@ -679,7 +674,6 @@ CONFIG_GENERIC_ENTRY=y CONFIG_JUMP_LABEL=y CONFIG_STATIC_KEYS_SELFTEST=y # CONFIG_STATIC_CALL_SELFTEST is not set -CONFIG_UPROBES=y CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y CONFIG_ARCH_USE_BUILTIN_BSWAP=y CONFIG_USER_RETURN_NOTIFIER=y @@ -1650,7 +1644,6 @@ CONFIG_NET_FLOW_LIMIT=y # Network testing # # CONFIG_NET_PKTGEN is not set -# CONFIG_NET_DROP_MONITOR is not set # end of Network testing # end of Networking options @@ -2942,12 +2935,10 @@ CONFIG_ADM8211=m CONFIG_ATH_COMMON=m CONFIG_WLAN_VENDOR_ATH=y CONFIG_ATH_DEBUG=y -# CONFIG_ATH_TRACEPOINTS is not set CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING=y CONFIG_ATH5K=m CONFIG_ATH5K_DEBUG=y -# CONFIG_ATH5K_TRACER is not set CONFIG_ATH5K_PCI=y # CONFIG_ATH5K_TEST_CHANNELS is not set CONFIG_ATH9K_HW=m @@ -2975,7 +2966,6 @@ CONFIG_CARL9170_HWRNG=y CONFIG_AR5523=m CONFIG_WIL6210=m CONFIG_WIL6210_ISR_COR=y -CONFIG_WIL6210_TRACING=y # CONFIG_WIL6210_DEBUGFS is not set CONFIG_ATH10K=m CONFIG_ATH10K_CE=y @@ -2984,14 +2974,12 @@ CONFIG_ATH10K_SDIO=m CONFIG_ATH10K_USB=m CONFIG_ATH10K_DEBUG=y # CONFIG_ATH10K_DEBUGFS is not set -# CONFIG_ATH10K_TRACING is not set CONFIG_ATH10K_DFS_CERTIFIED=y CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set CONFIG_ATH11K=m CONFIG_ATH11K_PCI=m # CONFIG_ATH11K_DEBUG is not set -# CONFIG_ATH11K_TRACING is not set CONFIG_WLAN_VENDOR_ATMEL=y CONFIG_ATMEL=m CONFIG_PCI_ATMEL=m @@ -3073,7 +3061,6 @@ CONFIG_IWLWIFI_OPMODE_MODULAR=y # Debugging Options # # CONFIG_IWLWIFI_DEBUG is not set -# CONFIG_IWLWIFI_DEVICE_TRACING is not set # end of Debugging Options CONFIG_WLAN_VENDOR_INTERSIL=y @@ -6839,7 +6826,6 @@ CONFIG_PSTORE_DEFLATE_COMPRESS_DEFAULT=y CONFIG_PSTORE_COMPRESS_DEFAULT="deflate" # CONFIG_PSTORE_CONSOLE is not set # CONFIG_PSTORE_PMSG is not set -# CONFIG_PSTORE_FTRACE is not set # CONFIG_PSTORE_RAM is not set # CONFIG_PSTORE_BLK is not set # CONFIG_SYSV_FS is not set @@ -7265,8 +7251,6 @@ CONFIG_SYSTEM_TRUSTED_KEYS="" # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set # end of Certificates for signature checking -CONFIG_BINARY_PRINTF=y - # # Library routines # @@ -7467,7 +7451,6 @@ CONFIG_DEBUG_MISC=y # CONFIG_DEBUG_PAGEALLOC is not set # CONFIG_PAGE_OWNER is not set CONFIG_PAGE_POISONING=y -# CONFIG_DEBUG_PAGE_REF is not set # CONFIG_DEBUG_RODATA_TEST is not set CONFIG_ARCH_HAS_DEBUG_WX=y CONFIG_DEBUG_WX=y @@ -7586,7 +7569,6 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=60 # CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set # CONFIG_LATENCYTOP is not set CONFIG_USER_STACKTRACE_SUPPORT=y -CONFIG_NOP_TRACER=y CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y @@ -7598,52 +7580,8 @@ CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_FENTRY=y CONFIG_HAVE_OBJTOOL_MCOUNT=y CONFIG_HAVE_C_RECORDMCOUNT=y -CONFIG_TRACER_MAX_TRACE=y -CONFIG_TRACE_CLOCK=y -CONFIG_RING_BUFFER=y -CONFIG_EVENT_TRACING=y -CONFIG_CONTEXT_SWITCH_TRACER=y -CONFIG_TRACING=y -CONFIG_GENERIC_TRACER=y CONFIG_TRACING_SUPPORT=y -CONFIG_FTRACE=y -# CONFIG_BOOTTIME_TRACING is not set -CONFIG_FUNCTION_TRACER=y -CONFIG_FUNCTION_GRAPH_TRACER=y -CONFIG_DYNAMIC_FTRACE=y -CONFIG_DYNAMIC_FTRACE_WITH_REGS=y -CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y -CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y -CONFIG_FUNCTION_PROFILER=y -CONFIG_STACK_TRACER=y -# CONFIG_IRQSOFF_TRACER is not set -CONFIG_SCHED_TRACER=y -# CONFIG_HWLAT_TRACER is not set -# CONFIG_OSNOISE_TRACER is not set -# CONFIG_TIMERLAT_TRACER is not set -# CONFIG_MMIOTRACE is not set -CONFIG_FTRACE_SYSCALLS=y -CONFIG_TRACER_SNAPSHOT=y -# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set -CONFIG_BRANCH_PROFILE_NONE=y -# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set -# CONFIG_BLK_DEV_IO_TRACE is not set -CONFIG_UPROBE_EVENTS=y -CONFIG_DYNAMIC_EVENTS=y -CONFIG_PROBE_EVENTS=y -CONFIG_FTRACE_MCOUNT_RECORD=y -CONFIG_FTRACE_MCOUNT_USE_CC=y -# CONFIG_SYNTH_EVENTS is not set -# CONFIG_HIST_TRIGGERS is not set -# CONFIG_TRACE_EVENT_INJECT is not set -# CONFIG_TRACEPOINT_BENCHMARK is not set -CONFIG_RING_BUFFER_BENCHMARK=m -# CONFIG_TRACE_EVAL_MAP_FILE is not set -# CONFIG_FTRACE_RECORD_RECURSION is not set -# CONFIG_FTRACE_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_STARTUP_TEST is not set -# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set -# CONFIG_PREEMPTIRQ_DELAY_TEST is not set +# CONFIG_FTRACE is not set # CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set # CONFIG_SAMPLES is not set CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y -- 2.35.3

2 1

[PATCH] kernel: update to 5.15.59
by Arne Fitzenreiter 06 Aug '22

06 Aug '22

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.armv6l-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/x86_64/linux | 3 +- lfs/linux | 6 +- ...ayer7.patch => linux-5.15.59-layer7.patch} | 74 +++++++++---------- 6 files changed, 44 insertions(+), 45 deletions(-) rename src/patches/linux/{linux-5.15.46-layer7.patch => linux-5.15.59-layer7.patch} (94%) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index af31c0c61..6a0ea681d 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 5.15.57-ipfire Kernel Configuration +# Linux/arm64 5.15.59-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.3.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index e769ce32a..9d2776bd2 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 5.15.57-ipfire Kernel Configuration +# Linux/arm 5.15.59-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.3.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index c6b63411d..f58bf4b2f 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 5.15.57-ipfire Kernel Configuration +# Linux/x86 5.15.59-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 11.3.0" CONFIG_CC_IS_GCC=y diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index 88a4bb40d..1f7df2e2e 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -1360,6 +1360,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/arch/x86/include/asm/espfix.h #lib/modules/KVER-ipfire/build/arch/x86/include/asm/exec.h #lib/modules/KVER-ipfire/build/arch/x86/include/asm/extable.h +#lib/modules/KVER-ipfire/build/arch/x86/include/asm/extable_fixup_types.h #lib/modules/KVER-ipfire/build/arch/x86/include/asm/fb.h #lib/modules/KVER-ipfire/build/arch/x86/include/asm/fixmap.h #lib/modules/KVER-ipfire/build/arch/x86/include/asm/floppy.h @@ -7213,7 +7214,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/DRM_I915_USERFAULT_AUTOSUSPEND #lib/modules/KVER-ipfire/build/include/config/DRM_I915_USERPTR #lib/modules/KVER-ipfire/build/include/config/DRM_KMS_HELPER -#lib/modules/KVER-ipfire/build/include/config/DRM_LEGACY #lib/modules/KVER-ipfire/build/include/config/DRM_MGAG200 #lib/modules/KVER-ipfire/build/include/config/DRM_MIPI_DSI #lib/modules/KVER-ipfire/build/include/config/DRM_NOUVEAU @@ -9245,7 +9245,6 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/NORTEL_HERMES #lib/modules/KVER-ipfire/build/include/config/NOUVEAU_DEBUG #lib/modules/KVER-ipfire/build/include/config/NOUVEAU_DEBUG_DEFAULT -#lib/modules/KVER-ipfire/build/include/config/NOUVEAU_LEGACY_CTX_SUPPORT #lib/modules/KVER-ipfire/build/include/config/NOZOMI #lib/modules/KVER-ipfire/build/include/config/NO_HZ #lib/modules/KVER-ipfire/build/include/config/NO_HZ_COMMON diff --git a/lfs/linux b/lfs/linux index 07e838933..e80f99601 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 5.15.57 +VER = 5.15.59 ARM_PATCHES = 5.15-ipfire5 THISAPP = linux-$(VER) @@ -78,7 +78,7 @@ objects =$(DL_FILE) \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 9adea6b8ee97ead38ecab39b1ef08b2ee1647eebbb2a8ccd2ba253eeebfd6435c83a03e83e186809473a982a373185874c0082aa0c56f5928d304c7df56dfb86 +$(DL_FILE)_BLAKE2 = c601b25663f73438daa40f1a72039a4ca6a027cd356a9cca3f00341a8aab0845893d4ac848a43a34758c0959e38b11ac8857777531cf1472b18f3373ba6c426b arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 58a70e757a9121a0aac83604a37aa787ec7ac0ee4970c5a3ac3bcb2dbaca32b00089cae6c0da5cf2fe0a2e156427b5165c6a86e0371a3e896f4c7cdd699c34a0 install : $(TARGET) @@ -116,7 +116,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) ln -svf linux-$(VER) $(DIR_SRC)/linux # Layer7-patch - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.46-layer7.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.59-layer7.patch # DVB Patches cd $(DIR_APP) && patch -Np2 < $(DIR_SRC)/src/patches/v4l-dvb_fix_tua6034_pll.patch diff --git a/src/patches/linux/linux-5.15.46-layer7.patch b/src/patches/linux/linux-5.15.59-layer7.patch similarity index 94% rename from src/patches/linux/linux-5.15.46-layer7.patch rename to src/patches/linux/linux-5.15.59-layer7.patch index d6b46142c..f02a852a6 100644 --- a/src/patches/linux/linux-5.15.46-layer7.patch +++ b/src/patches/linux/linux-5.15.59-layer7.patch @@ -1,7 +1,7 @@ -diff -Naur linux-5.15.46.orig/include/linux/skbuff.h linux-5.15.46/include/linux/skbuff.h ---- linux-5.15.46.orig/include/linux/skbuff.h 2022-06-11 14:51:47.639775333 +0000 -+++ linux-5.15.46/include/linux/skbuff.h 2022-06-11 14:53:07.977494189 +0000 -@@ -772,6 +772,9 @@ +diff -Naur linux-5.15.59.ORG/include/linux/skbuff.h linux-5.15.59/include/linux/skbuff.h +--- linux-5.15.59.ORG/include/linux/skbuff.h 2022-08-03 12:03:56.000000000 +0200 ++++ linux-5.15.59/include/linux/skbuff.h 2022-08-05 13:28:29.785231584 +0200 +@@ -807,6 +807,9 @@ #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE) unsigned long _nfct; #endif @@ -11,9 +11,9 @@ diff -Naur linux-5.15.46.orig/include/linux/skbuff.h linux-5.15.46/include/linux unsigned int len, data_len; __u16 mac_len, -diff -Naur linux-5.15.46.orig/include/net/netfilter/nf_conntrack.h linux-5.15.46/include/net/netfilter/nf_conntrack.h ---- linux-5.15.46.orig/include/net/netfilter/nf_conntrack.h 2022-06-11 14:51:48.471834543 +0000 -+++ linux-5.15.46/include/net/netfilter/nf_conntrack.h 2022-06-11 14:53:07.977494189 +0000 +diff -Naur linux-5.15.59.ORG/include/net/netfilter/nf_conntrack.h linux-5.15.59/include/net/netfilter/nf_conntrack.h +--- linux-5.15.59.ORG/include/net/netfilter/nf_conntrack.h 2022-08-03 12:03:56.000000000 +0200 ++++ linux-5.15.59/include/net/netfilter/nf_conntrack.h 2022-08-05 13:28:29.786231577 +0200 @@ -119,6 +119,23 @@ /* Extensions */ struct nf_ct_ext *ext; @@ -38,9 +38,9 @@ diff -Naur linux-5.15.46.orig/include/net/netfilter/nf_conntrack.h linux-5.15.46 /* Storage reserved for other modules, must be the last member */ union nf_conntrack_proto proto; }; -diff -Naur linux-5.15.46.orig/include/uapi/linux/netfilter/xt_layer7.h linux-5.15.46/include/uapi/linux/netfilter/xt_layer7.h ---- linux-5.15.46.orig/include/uapi/linux/netfilter/xt_layer7.h 1970-01-01 00:00:00.000000000 +0000 -+++ linux-5.15.46/include/uapi/linux/netfilter/xt_layer7.h 2022-06-11 14:53:07.977494189 +0000 +diff -Naur linux-5.15.59.ORG/include/uapi/linux/netfilter/xt_layer7.h linux-5.15.59/include/uapi/linux/netfilter/xt_layer7.h +--- linux-5.15.59.ORG/include/uapi/linux/netfilter/xt_layer7.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-5.15.59/include/uapi/linux/netfilter/xt_layer7.h 2022-08-05 13:28:29.786231577 +0200 @@ -0,0 +1,13 @@ +#ifndef _XT_LAYER7_H +#define _XT_LAYER7_H @@ -55,9 +55,9 @@ diff -Naur linux-5.15.46.orig/include/uapi/linux/netfilter/xt_layer7.h linux-5.1 +}; + +#endif /* _XT_LAYER7_H */ -diff -Naur linux-5.15.46.orig/net/netfilter/Kconfig linux-5.15.46/net/netfilter/Kconfig ---- linux-5.15.46.orig/net/netfilter/Kconfig 2022-06-11 14:51:48.599843652 +0000 -+++ linux-5.15.46/net/netfilter/Kconfig 2022-06-11 14:53:07.977494189 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/Kconfig linux-5.15.59/net/netfilter/Kconfig +--- linux-5.15.59.ORG/net/netfilter/Kconfig 2022-08-03 12:03:56.000000000 +0200 ++++ linux-5.15.59/net/netfilter/Kconfig 2022-08-05 13:28:29.786231577 +0200 @@ -1389,6 +1389,26 @@ To compile it as a module, choose M here. If unsure, say N. @@ -85,9 +85,9 @@ diff -Naur linux-5.15.46.orig/net/netfilter/Kconfig linux-5.15.46/net/netfilter/ config NETFILTER_XT_MATCH_LENGTH tristate '"length" match support' depends on NETFILTER_ADVANCED -diff -Naur linux-5.15.46.orig/net/netfilter/Makefile linux-5.15.46/net/netfilter/Makefile ---- linux-5.15.46.orig/net/netfilter/Makefile 2022-06-11 14:51:48.599843652 +0000 -+++ linux-5.15.46/net/netfilter/Makefile 2022-06-11 14:53:07.981494474 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/Makefile linux-5.15.59/net/netfilter/Makefile +--- linux-5.15.59.ORG/net/netfilter/Makefile 2022-08-03 12:03:56.000000000 +0200 ++++ linux-5.15.59/net/netfilter/Makefile 2022-08-05 13:28:29.786231577 +0200 @@ -201,6 +201,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o @@ -96,9 +96,9 @@ diff -Naur linux-5.15.46.orig/net/netfilter/Makefile linux-5.15.46/net/netfilter obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o -diff -Naur linux-5.15.46.orig/net/netfilter/nf_conntrack_core.c linux-5.15.46/net/netfilter/nf_conntrack_core.c ---- linux-5.15.46.orig/net/netfilter/nf_conntrack_core.c 2022-06-11 14:51:48.599843652 +0000 -+++ linux-5.15.46/net/netfilter/nf_conntrack_core.c 2022-06-11 14:53:07.981494474 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/nf_conntrack_core.c linux-5.15.59/net/netfilter/nf_conntrack_core.c +--- linux-5.15.59.ORG/net/netfilter/nf_conntrack_core.c 2022-08-03 12:03:56.000000000 +0200 ++++ linux-5.15.59/net/netfilter/nf_conntrack_core.c 2022-08-05 13:28:29.787231570 +0200 @@ -648,6 +648,11 @@ */ nf_ct_remove_expectations(ct); @@ -111,9 +111,9 @@ diff -Naur linux-5.15.46.orig/net/netfilter/nf_conntrack_core.c linux-5.15.46/ne nf_ct_del_from_dying_or_unconfirmed_list(ct); local_bh_enable(); -diff -Naur linux-5.15.46.orig/net/netfilter/nf_conntrack_standalone.c linux-5.15.46/net/netfilter/nf_conntrack_standalone.c ---- linux-5.15.46.orig/net/netfilter/nf_conntrack_standalone.c 2022-06-11 14:51:48.603843938 +0000 -+++ linux-5.15.46/net/netfilter/nf_conntrack_standalone.c 2022-06-11 14:54:23.322859367 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/nf_conntrack_standalone.c linux-5.15.59/net/netfilter/nf_conntrack_standalone.c +--- linux-5.15.59.ORG/net/netfilter/nf_conntrack_standalone.c 2022-08-03 12:03:56.000000000 +0200 ++++ linux-5.15.59/net/netfilter/nf_conntrack_standalone.c 2022-08-05 13:28:29.787231570 +0200 @@ -370,6 +370,11 @@ ct_show_zone(s, ct, NF_CT_DEFAULT_ZONE_DIR); ct_show_delta_time(s, ct); @@ -126,9 +126,9 @@ diff -Naur linux-5.15.46.orig/net/netfilter/nf_conntrack_standalone.c linux-5.15 seq_printf(s, "use=%u\n", refcount_read(&ct->ct_general.use)); if (seq_has_overflowed(s)) -diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regexp.c linux-5.15.46/net/netfilter/regexp/regexp.c ---- linux-5.15.46.orig/net/netfilter/regexp/regexp.c 1970-01-01 00:00:00.000000000 +0000 -+++ linux-5.15.46/net/netfilter/regexp/regexp.c 2022-06-11 14:53:07.985494758 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/regexp/regexp.c linux-5.15.59/net/netfilter/regexp/regexp.c +--- linux-5.15.59.ORG/net/netfilter/regexp/regexp.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-5.15.59/net/netfilter/regexp/regexp.c 2022-08-05 13:28:29.788231563 +0200 @@ -0,0 +1,1197 @@ +/* + * regcomp and regexec -- regsub and regerror are elsewhere @@ -1327,9 +1327,9 @@ diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regexp.c linux-5.15.46/net/ne +#endif + + -diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regexp.h linux-5.15.46/net/netfilter/regexp/regexp.h ---- linux-5.15.46.orig/net/netfilter/regexp/regexp.h 1970-01-01 00:00:00.000000000 +0000 -+++ linux-5.15.46/net/netfilter/regexp/regexp.h 2022-06-11 14:53:07.985494758 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/regexp/regexp.h linux-5.15.59/net/netfilter/regexp/regexp.h +--- linux-5.15.59.ORG/net/netfilter/regexp/regexp.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-5.15.59/net/netfilter/regexp/regexp.h 2022-08-05 13:28:29.788231563 +0200 @@ -0,0 +1,41 @@ +/* + * Definitions etc. for regexp(3) routines. @@ -1372,18 +1372,18 @@ diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regexp.h linux-5.15.46/net/ne +void regerror(char *s); + +#endif -diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regmagic.h linux-5.15.46/net/netfilter/regexp/regmagic.h ---- linux-5.15.46.orig/net/netfilter/regexp/regmagic.h 1970-01-01 00:00:00.000000000 +0000 -+++ linux-5.15.46/net/netfilter/regexp/regmagic.h 2022-06-11 14:53:07.985494758 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/regexp/regmagic.h linux-5.15.59/net/netfilter/regexp/regmagic.h +--- linux-5.15.59.ORG/net/netfilter/regexp/regmagic.h 1970-01-01 01:00:00.000000000 +0100 ++++ linux-5.15.59/net/netfilter/regexp/regmagic.h 2022-08-05 13:28:29.788231563 +0200 @@ -0,0 +1,5 @@ +/* + * The first byte of the regexp internal "program" is actually this magic + * number; the start node begins in the second byte. + */ +#define MAGIC 0234 -diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regsub.c linux-5.15.46/net/netfilter/regexp/regsub.c ---- linux-5.15.46.orig/net/netfilter/regexp/regsub.c 1970-01-01 00:00:00.000000000 +0000 -+++ linux-5.15.46/net/netfilter/regexp/regsub.c 2022-06-11 14:53:07.985494758 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/regexp/regsub.c linux-5.15.59/net/netfilter/regexp/regsub.c +--- linux-5.15.59.ORG/net/netfilter/regexp/regsub.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-5.15.59/net/netfilter/regexp/regsub.c 2022-08-05 13:28:29.788231563 +0200 @@ -0,0 +1,95 @@ +/* + * regsub @@ -1480,9 +1480,9 @@ diff -Naur linux-5.15.46.orig/net/netfilter/regexp/regsub.c linux-5.15.46/net/ne + } + *dst++ = '\0'; +} -diff -Naur linux-5.15.46.orig/net/netfilter/xt_layer7.c linux-5.15.46/net/netfilter/xt_layer7.c ---- linux-5.15.46.orig/net/netfilter/xt_layer7.c 1970-01-01 00:00:00.000000000 +0000 -+++ linux-5.15.46/net/netfilter/xt_layer7.c 2022-06-11 14:53:07.985494758 +0000 +diff -Naur linux-5.15.59.ORG/net/netfilter/xt_layer7.c linux-5.15.59/net/netfilter/xt_layer7.c +--- linux-5.15.59.ORG/net/netfilter/xt_layer7.c 1970-01-01 01:00:00.000000000 +0100 ++++ linux-5.15.59/net/netfilter/xt_layer7.c 2022-08-05 13:28:29.788231563 +0200 @@ -0,0 +1,666 @@ +/* + Kernel module to match application layer (OSI layer 7) data in connections. -- 2.36.1

2 1

[PATCH] nano: Update to 6.4
by Matthias Fischer 06 Aug '22

06 Aug '22

For details see: https://www.nano-editor.org/news.php "Changes between v6.3 and v6.4: ------------------------------ Benno Schulenberg (24): bump version numbers and add a news item for the 6.4 release display: remember text and column positions when softwrapping a line docs: concisely describe how the linter behaves docs: remove the two notices about the changed defaults docs: rename README.GIT to README.hacking, so it's clearer what is meant docs: stop mentioning the obsoleted keywords that were removed files: designate the root directory with a simple "/", not with "//" formatter: instead of leaving curses, use full_refresh() to wipe messages gnulib: update to its current upstream state help: reshuffle two shortcuts so that more help-line items are paired options: stop accepting -z, as --suspendable has been dropped too rcfile: remove five obsolete or deprecated keywords syntax: default: do not colorize a square or angle bracket after a URL syntax: perl: add missing keywords, and reduce the length of some lines syntax: python: mention an alternative linter in a comment tweaks: add a missing word to a news item tweaks: add a translator hint tweaks: improve a comment, and reshuffle two functions plus some lines tweaks: put each regex on separate line, to better show many keywords tweaks: rename a variable, to not be the same as a function name tweaks: rename two variables, to not contain the name of another tweaks: reshuffle a description and rewrap another tweaks: reshuffle a few lines, to group things better version: condense the copyright message, to not dominate the output LIU Hao (1): build: ignore errors from `git describe`" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/nano | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/nano b/lfs/nano index 05e63528c..5dc6981b0 100644 --- a/lfs/nano +++ b/lfs/nano @@ -24,7 +24,7 @@ include Config -VER = 6.3 +VER = 6.4 THISAPP = nano-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 92ef2acac0dacebc0bf8364bfee928a8394d8e4323e622ad6ba9d35bebd18d3976ab0ca747f7c9b5597874775b44ba4b5560e7392606aa68736158c2bda62b92 +$(DL_FILE)_BLAKE2 = b59ff7a741ce4c8b31afdbbfaf1d704cccbceddcd7f1421f30a6dd40495ec456ca891aeb9777c070c6cce4e9c594f83798ff0cdacdfe06e81b0aa0b700033da3 install : $(TARGET) -- 2.25.1

2 1

[PATCH] rtl8821cu: add realtek wlan driver
by Arne Fitzenreiter 05 Aug '22

05 Aug '22

realtek has released a third different usb ac wlan chipset. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- lfs/rtl8821cu | 95 +++++++++++++++++++++++++++++++++++++++++++++++++++ make.sh | 1 + 2 files changed, 96 insertions(+) create mode 100644 lfs/rtl8821cu diff --git a/lfs/rtl8821cu b/lfs/rtl8821cu new file mode 100644 index 000000000..b5a0357bc --- /dev/null +++ b/lfs/rtl8821cu @@ -0,0 +1,95 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VERSUFIX = ipfire$(KCFG) +MODPATH = /lib/modules/$(KVER)-$(VERSUFIX)/extra/wlan + +VER = 20210118-f91ddf3cc7555b9a1c27c90f23764cfc0b1b6f9c + +THISAPP = 8821cu-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP)-kmod-$(KVER)-$(VERSUFIX) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_BLAKE2 = a3ea84b45258fed06baab211393725391fe26686fe85c2273605e6cb59e3e83e54d45e24bc2c3b046de9bb3af8a8cc3a584dbd80ecea3bb8416fb5e79113fb69 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +b2 : $(subst %,%_BLAKE2,$(objects)) + +dist: + $(PAK) + +############################################################################### +# Downloading, checking, b2sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_BLAKE2,$(objects)) : + @$(B2SUM) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && CONFIG_RTL8821CU=m make $(MAKETUNING) \ + -C /lib/modules/$(KVER)-$(VERSUFIX)/build/ M=$(DIR_APP)/ modules + + # Install the built kernel modules. + mkdir -p $(MODPATH) + cd $(DIR_APP) && for f in $$(ls *.ko); do \ + /lib/modules/$$(uname -r)$(KCFG)/build/scripts/sign-file sha512 \ + /lib/modules/$$(uname -r)$(KCFG)/build/certs/signing_key.pem \ + /lib/modules/$$(uname -r)$(KCFG)/build/certs/signing_key.x509 \ + $$f; \ + xz $$f; \ + install -m 644 $$f.xz $(MODPATH); \ + done + + @rm -rf $(DIR_APP) + @$(POSTBUILD) + diff --git a/make.sh b/make.sh index 7fb63b913..e70dacd2a 100755 --- a/make.sh +++ b/make.sh @@ -1172,6 +1172,7 @@ buildipfire() { lfsmake2 rtl8189fs KCFG="" lfsmake2 rtl8812au KCFG="" lfsmake2 rtl8822bu KCFG="" + lfsmake2 rtl8821cu KCFG="" lfsmake2 xradio KCFG="" lfsmake2 linux-initrd KCFG="" -- 2.36.1

2 1

[PATCH] rsync: Patch CVE-2022-29154
by Peter Müller 05 Aug '22

05 Aug '22

https://www.openwall.com/lists/oss-security/2022/08/02/1 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/rsync | 5 +- src/patches/rsync-CVE-2022-29154.patch | 322 +++++++++++++++++++++++++ 2 files changed, 326 insertions(+), 1 deletion(-) create mode 100644 src/patches/rsync-CVE-2022-29154.patch diff --git a/lfs/rsync b/lfs/rsync index f40c28ce2..c27258929 100644 --- a/lfs/rsync +++ b/lfs/rsync @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = rsync -PAK_VER = 14 +PAK_VER = 15 DEPS = @@ -85,6 +85,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Replace shebang in rsync-ssl cd $(DIR_APP) && sed -i -e "s@^#!.*@#!/bin/bash@" rsync-ssl + # Fix for CVE-2022-29154 + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/rsync-CVE-2022-29154.patch + cd $(DIR_APP) && ./configure \ --prefix=/usr \ --without-included-popt \ diff --git a/src/patches/rsync-CVE-2022-29154.patch b/src/patches/rsync-CVE-2022-29154.patch new file mode 100644 index 000000000..d3b4499a4 --- /dev/null +++ b/src/patches/rsync-CVE-2022-29154.patch @@ -0,0 +1,322 @@ +commit b7231c7d02cfb65d291af74ff66e7d8c507ee871 +Author: Wayne Davison <wayne(a)opencoder.net> +Date: Sun Jul 31 16:55:34 2022 -0700 + + Some extra file-list safety checks. + +diff --git a/exclude.c b/exclude.c +index 39073a0c..b670c8ba 100644 +--- a/exclude.c ++++ b/exclude.c +@@ -27,16 +27,22 @@ extern int am_server; + extern int am_sender; + extern int eol_nulls; + extern int io_error; ++extern int xfer_dirs; ++extern int recurse; + extern int local_server; + extern int prune_empty_dirs; + extern int ignore_perishable; ++extern int old_style_args; ++extern int relative_paths; + extern int delete_mode; + extern int delete_excluded; + extern int cvs_exclude; + extern int sanitize_paths; + extern int protocol_version; ++extern int list_only; + extern int module_id; + ++extern char *filesfrom_host; + extern char curr_dir[MAXPATHLEN]; + extern unsigned int curr_dir_len; + extern unsigned int module_dirlen; +@@ -44,8 +50,10 @@ extern unsigned int module_dirlen; + filter_rule_list filter_list = { .debug_type = "" }; + filter_rule_list cvs_filter_list = { .debug_type = " [global CVS]" }; + filter_rule_list daemon_filter_list = { .debug_type = " [daemon]" }; ++filter_rule_list implied_filter_list = { .debug_type = " [implied]" }; + + int saw_xattr_filter = 0; ++int trust_sender_filter = 0; + + /* Need room enough for ":MODS " prefix plus some room to grow. */ + #define MAX_RULE_PREFIX (16) +@@ -292,6 +300,125 @@ static void add_rule(filter_rule_list *listp, const char *pat, unsigned int pat_ + } + } + ++/* Each arg the client sends to the remote sender turns into an implied include ++ * that the receiver uses to validate the file list from the sender. */ ++void add_implied_include(const char *arg) ++{ ++ filter_rule *rule; ++ int arg_len, saw_wild = 0, backslash_cnt = 0; ++ int slash_cnt = 1; /* We know we're adding a leading slash. */ ++ const char *cp; ++ char *p; ++ if (old_style_args || list_only || filesfrom_host != NULL) ++ return; ++ if (relative_paths) { ++ cp = strstr(arg, "/./"); ++ if (cp) ++ arg = cp+3; ++ } else { ++ if ((cp = strrchr(arg, '/')) != NULL) ++ arg = cp + 1; ++ } ++ arg_len = strlen(arg); ++ if (arg_len) { ++ if (strpbrk(arg, "*[?")) { ++ /* We need to add room to escape backslashes if wildcard chars are present. */ ++ cp = arg; ++ while ((cp = strchr(cp, '\\')) != NULL) { ++ arg_len++; ++ cp++; ++ } ++ saw_wild = 1; ++ } ++ arg_len++; /* Leave room for the prefixed slash */ ++ rule = new0(filter_rule); ++ if (!implied_filter_list.head) ++ implied_filter_list.head = implied_filter_list.tail = rule; ++ else { ++ rule->next = implied_filter_list.head; ++ implied_filter_list.head = rule; ++ } ++ rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0); ++ p = rule->pattern = new_array(char, arg_len + 1); ++ *p++ = '/'; ++ cp = arg; ++ while (*cp) { ++ switch (*cp) { ++ case '\\': ++ backslash_cnt++; ++ if (saw_wild) ++ *p++ = '\\'; ++ *p++ = *cp++; ++ break; ++ case '/': ++ if (p[-1] == '/') /* This is safe because of the initial slash. */ ++ break; ++ if (relative_paths) { ++ filter_rule const *ent; ++ int found = 0; ++ *p = '\0'; ++ for (ent = implied_filter_list.head; ent; ent = ent->next) { ++ if (ent != rule && strcmp(ent->pattern, rule->pattern) == 0) ++ found = 1; ++ } ++ if (!found) { ++ filter_rule *R_rule = new0(filter_rule); ++ R_rule->rflags = FILTRULE_INCLUDE + (saw_wild ? FILTRULE_WILD : 0); ++ R_rule->pattern = strdup(rule->pattern); ++ R_rule->u.slash_cnt = slash_cnt; ++ R_rule->next = implied_filter_list.head; ++ implied_filter_list.head = R_rule; ++ } ++ } ++ slash_cnt++; ++ *p++ = *cp++; ++ break; ++ default: ++ *p++ = *cp++; ++ break; ++ } ++ } ++ *p = '\0'; ++ rule->u.slash_cnt = slash_cnt; ++ arg = (const char *)rule->pattern; ++ } ++ ++ if (recurse || xfer_dirs) { ++ /* Now create a rule with an added "/" & "**" or "*" at the end */ ++ rule = new0(filter_rule); ++ if (recurse) ++ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD | FILTRULE_WILD2; ++ else ++ rule->rflags = FILTRULE_INCLUDE | FILTRULE_WILD; ++ /* A +4 in the len leaves enough room for / * * \0 or / * \0 \0 */ ++ if (!saw_wild && backslash_cnt) { ++ /* We are appending a wildcard, so now the backslashes need to be escaped. */ ++ p = rule->pattern = new_array(char, arg_len + backslash_cnt + 3 + 1); ++ cp = arg; ++ while (*cp) { ++ if (*cp == '\\') ++ *p++ = '\\'; ++ *p++ = *cp++; ++ } ++ } else { ++ p = rule->pattern = new_array(char, arg_len + 3 + 1); ++ if (arg_len) { ++ memcpy(p, arg, arg_len); ++ p += arg_len; ++ } ++ } ++ if (p[-1] != '/') ++ *p++ = '/'; ++ *p++ = '*'; ++ if (recurse) ++ *p++ = '*'; ++ *p = '\0'; ++ rule->u.slash_cnt = slash_cnt + 1; ++ rule->next = implied_filter_list.head; ++ implied_filter_list.head = rule; ++ } ++} ++ + /* This frees any non-inherited items, leaving just inherited items on the list. */ + static void pop_filter_list(filter_rule_list *listp) + { +@@ -718,7 +845,7 @@ static void report_filter_result(enum logcode code, char const *name, + : name_flags & NAME_IS_DIR ? "directory" + : "file"; + rprintf(code, "[%s] %sing %s %s because of pattern %s%s%s\n", +- w, actions[*w!='s'][!(ent->rflags & FILTRULE_INCLUDE)], ++ w, actions[*w=='g'][!(ent->rflags & FILTRULE_INCLUDE)], + t, name, ent->pattern, + ent->rflags & FILTRULE_DIRECTORY ? "/" : "", type); + } +@@ -890,6 +1017,7 @@ static filter_rule *parse_rule_tok(const char **rulestr_ptr, + } + switch (ch) { + case ':': ++ trust_sender_filter = 1; + rule->rflags |= FILTRULE_PERDIR_MERGE + | FILTRULE_FINISH_SETUP; + /* FALL THROUGH */ +diff --git a/flist.c b/flist.c +index 1ba306bc..0e6bf782 100644 +--- a/flist.c ++++ b/flist.c +@@ -73,6 +73,7 @@ extern int need_unsorted_flist; + extern int sender_symlink_iconv; + extern int output_needs_newline; + extern int sender_keeps_checksum; ++extern int trust_sender_filter; + extern int unsort_ndx; + extern uid_t our_uid; + extern struct stats stats; +@@ -83,8 +84,7 @@ extern char curr_dir[MAXPATHLEN]; + + extern struct chmod_mode_struct *chmod_modes; + +-extern filter_rule_list filter_list; +-extern filter_rule_list daemon_filter_list; ++extern filter_rule_list filter_list, implied_filter_list, daemon_filter_list; + + #ifdef ICONV_OPTION + extern int filesfrom_convert; +@@ -986,6 +986,19 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x + exit_cleanup(RERR_UNSUPPORTED); + } + ++ if (*thisname != '.' || thisname[1] != '\0') { ++ int filt_flags = S_ISDIR(mode) ? NAME_IS_DIR : NAME_IS_FILE; ++ if (!trust_sender_filter /* a per-dir filter rule means we must trust the sender's filtering */ ++ && filter_list.head && check_filter(&filter_list, FINFO, thisname, filt_flags) < 0) { ++ rprintf(FERROR, "ERROR: rejecting excluded file-list name: %s\n", thisname); ++ exit_cleanup(RERR_PROTOCOL); ++ } ++ if (implied_filter_list.head && check_filter(&implied_filter_list, FINFO, thisname, filt_flags) <= 0) { ++ rprintf(FERROR, "ERROR: rejecting unrequested file-list name: %s\n", thisname); ++ exit_cleanup(RERR_PROTOCOL); ++ } ++ } ++ + if (inc_recurse && S_ISDIR(mode)) { + if (one_file_system) { + /* Room to save the dir's device for -x */ +diff --git a/io.c b/io.c +index cf94cee7..a6e3ed30 100644 +--- a/io.c ++++ b/io.c +@@ -419,6 +419,7 @@ static void forward_filesfrom_data(void) + while (s != eob) { + if (*s++ == '\0') { + ff_xb.len = s - sob - 1; ++ add_implied_include(sob); + if (iconvbufs(ic_send, &ff_xb, &iobuf.out, flags) < 0) + exit_cleanup(RERR_PROTOCOL); /* impossible? */ + write_buf(iobuf.out_fd, s-1, 1); /* Send the '\0'. */ +@@ -450,9 +451,12 @@ static void forward_filesfrom_data(void) + char *f = ff_xb.buf + ff_xb.pos; + char *t = ff_xb.buf; + char *eob = f + len; ++ char *cur = t; + /* Eliminate any multi-'\0' runs. */ + while (f != eob) { + if (!(*t++ = *f++)) { ++ add_implied_include(cur); ++ cur = t; + while (f != eob && *f == '\0') + f++; + } +diff --git a/main.c b/main.c +index 58920a2d..5a7fbdd7 100644 +--- a/main.c ++++ b/main.c +@@ -89,6 +89,7 @@ extern int backup_dir_len; + extern int basis_dir_cnt; + extern int default_af_hint; + extern int stdout_format_has_i; ++extern int trust_sender_filter; + extern struct stats stats; + extern char *stdout_format; + extern char *logfile_format; +@@ -104,7 +105,7 @@ extern char curr_dir[MAXPATHLEN]; + extern char backup_dir_buf[MAXPATHLEN]; + extern char *basis_dir[MAX_BASIS_DIRS+1]; + extern struct file_list *first_flist; +-extern filter_rule_list daemon_filter_list; ++extern filter_rule_list daemon_filter_list, implied_filter_list; + + uid_t our_uid; + gid_t our_gid; +@@ -635,6 +636,7 @@ static pid_t do_cmd(char *cmd, char *machine, char *user, char **remote_argv, in + #ifdef ICONV_CONST + setup_iconv(); + #endif ++ trust_sender_filter = 1; + } else if (local_server) { + /* If the user didn't request --[no-]whole-file, force + * it on, but only if we're not batch processing. */ +@@ -1500,6 +1502,8 @@ static int start_client(int argc, char *argv[]) + char *dummy_host; + int dummy_port = rsync_port; + int i; ++ if (filesfrom_fd < 0) ++ add_implied_include(remote_argv[0]); + /* For remote source, any extra source args must have either + * the same hostname or an empty hostname. */ + for (i = 1; i < remote_argc; i++) { +@@ -1523,6 +1527,7 @@ static int start_client(int argc, char *argv[]) + if (!rsync_port && !*arg) /* Turn an empty arg into a dot dir. */ + arg = "."; + remote_argv[i] = arg; ++ add_implied_include(arg); + } + } + +diff --git a/receiver.c b/receiver.c +index b3a69da0..93cf8efd 100644 +--- a/receiver.c ++++ b/receiver.c +@@ -593,10 +593,13 @@ int recv_files(int f_in, int f_out, char *local_name) + if (DEBUG_GTE(RECV, 1)) + rprintf(FINFO, "recv_files(%s)\n", fname); + +- if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0') +- && check_filter(&daemon_filter_list, FLOG, fname, 0) < 0) { +- rprintf(FERROR, "attempt to hack rsync failed.\n"); +- exit_cleanup(RERR_PROTOCOL); ++ if (daemon_filter_list.head && (*fname != '.' || fname[1] != '\0')) { ++ int filt_flags = S_ISDIR(file->mode) ? NAME_IS_DIR : NAME_IS_FILE; ++ if (check_filter(&daemon_filter_list, FLOG, fname, filt_flags) < 0) { ++ rprintf(FERROR, "ERROR: rejecting file transfer request for daemon excluded file: %s\n", ++ fname); ++ exit_cleanup(RERR_PROTOCOL); ++ } + } + + #ifdef SUPPORT_XATTRS -- 2.35.3

2 1

[PATCH] Bash: Update to 5.1.16
by Peter Müller 03 Aug '22

03 Aug '22

This is a maintenance release that bundles all the previously added patches, which have therefore been deleted. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/bash | 10 +- src/patches/bash/bash51-009 | 59 ----------- src/patches/bash/bash51-010 | 59 ----------- src/patches/bash/bash51-011 | 81 --------------- src/patches/bash/bash51-012 | 198 ------------------------------------ src/patches/bash/bash51-013 | 43 -------- src/patches/bash/bash51-014 | 48 --------- src/patches/bash/bash51-015 | 49 --------- src/patches/bash/bash51-016 | 64 ------------ 9 files changed, 3 insertions(+), 608 deletions(-) delete mode 100644 src/patches/bash/bash51-009 delete mode 100644 src/patches/bash/bash51-010 delete mode 100644 src/patches/bash/bash51-011 delete mode 100644 src/patches/bash/bash51-012 delete mode 100644 src/patches/bash/bash51-013 delete mode 100644 src/patches/bash/bash51-014 delete mode 100644 src/patches/bash/bash51-015 delete mode 100644 src/patches/bash/bash51-016 diff --git a/lfs/bash b/lfs/bash index f032972aa..ec8939aed 100644 --- a/lfs/bash +++ b/lfs/bash @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 5.1.8 +VER = 5.1.16 THISAPP = bash-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -53,7 +53,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = c61f70cef51b6576254a8cbdfbc69904c9e9ebefb061f03c719e35ac2aa3b497e654f78514ffd6e6c74cd546de917a6cfae1e643bf7b8aec88f154b2c97b9090 +$(DL_FILE)_BLAKE2 = 0bc53b24d9b95cd85e45196510104acf6ac6c980f68aedcc83c8409ce6a4682e92736a9cbe089ed92d74590e28918d0bee0e67c8e0f994bd37e45fad83f5b48e install : $(TARGET) @@ -87,10 +87,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) sed -e "s/filename, RTLD_LAZY/filename, RTLD_NOW/" \ -i $(DIR_APP)/builtins/enable.def - for i in $$(seq 9 16); do \ - cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/bash/bash51-$$(printf "%03d" "$${i}") || exit 1; \ - done - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/bash/bash-4.0-paths-1.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/bash/bash-4.0-profile-1.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/bash/bash-3.2-ssh_source_bash.patch diff --git a/src/patches/bash/bash51-009 b/src/patches/bash/bash51-009 deleted file mode 100644 index 2796c3b9b..000000000 --- a/src/patches/bash/bash51-009 +++ /dev/null @@ -1,59 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-009 - -Bug-Reported-by: Julien Moutinho <julm+bash(a)sourcephile.fr> -Bug-Reference-ID: <20211004035906.5kiobuzkpeckmvwg(a)sourcephile.fr> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2021-10/msg00022.html - -Bug-Description: - -The bash malloc implementation of malloc_usable_size() does not follow the -specification. This can cause library functions that use it to overwrite -memory bounds checking. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/lib/malloc/malloc.c 2020-07-08 10:19:30.000000000 -0400 ---- lib/malloc/malloc.c 2021-10-05 16:10:55.000000000 -0400 -*************** -*** 1287,1297 **** - } - -! /* XXX - should we return 0 if ISFREE? */ -! maxbytes = binsize(p->mh_index); -! -! /* So the usable size is the maximum number of bytes in the bin less the -! malloc overhead */ -! maxbytes -= MOVERHEAD + MSLOP; -! return (maxbytes); - } - ---- 1358,1367 ---- - } - -! /* return 0 if ISFREE */ -! if (p->mh_alloc == ISFREE) -! return 0; -! -! /* Since we use bounds checking, the usable size is the last requested size. */ -! return (p->mh_nbytes); - } - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 8 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 9 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-010 b/src/patches/bash/bash51-010 deleted file mode 100644 index cfe6fa46b..000000000 --- a/src/patches/bash/bash51-010 +++ /dev/null @@ -1,59 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-010 - -Bug-Reported-by: Jonas Alfredsson <jonas.alfredsson(a)protonmail.com> -Bug-Reference-ID: <LjAfZaEuZncr2RaqhSSfcaiXdkuK6kdEYxshP3LApXbgMVQzggMGyWHO9knVkXicW2fP-ibsipJ_GZ-YaJRm96Rsozf6PgFmPsljRCtflls=(a)protonmail.com> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2021-05/msg00059.html - -Bug-Description: - -If `wait -n' is interrupted by a trapped signal other than SIGINT, it does -not completely clean up state, and that can prevent subsequent calls to -`wait -n' from working correctly. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/builtins/wait.def 2020-12-16 17:13:12.000000000 -0500 ---- builtins/wait.def 2021-11-17 10:25:15.000000000 -0500 -*************** -*** 112,116 **** - WORD_LIST *list; - { -! int status, code, opt, nflag, wflags; - char *vname; - SHELL_VAR *pidvar; ---- 112,117 ---- - WORD_LIST *list; - { -! int status, code, opt, nflag; -! volatile int wflags; - char *vname; - SHELL_VAR *pidvar; -*************** -*** 181,184 **** ---- 188,193 ---- - status = 128 + wait_signal_received; - wait_sigint_cleanup (); -+ if (wflags & JWAIT_WAITING) -+ unset_waitlist (); - WAIT_RETURN (status); - } - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 9 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 10 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-011 b/src/patches/bash/bash51-011 deleted file mode 100644 index 655c7ec8b..000000000 --- a/src/patches/bash/bash51-011 +++ /dev/null @@ -1,81 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-011 - -Bug-Reported-by: Alex fxmbsw7 Ratchev <fxmbsw7(a)gmail.com> -Bug-Reference-ID: <CAALKErFrm+yuwy=ioK+RmjCiwxTDmzeMFWqLF2BEWYtkGS5UFQ(a)mail.gmail.com> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-11/msg00064.html - -Bug-Description: - -When reading a compound assignment, and running it through the parser to -split it into words, we need to save and restore any alias we're currently -expanding. - -Patch (apply with `patch -p0'): - -*** ../bash-5.1-patched/parse.y 2020-11-28 12:10:06.000000000 -0500 ---- parse.y 2021-10-13 11:04:27.000000000 -0400 -*************** -*** 6494,6501 **** - - push_stream (1); -- #if 0 /* TAG: bash-5.2 Alex fxmbsw7 Ratchev <fxmbsw7(a)gmail.com> 11/17/2020 */ - if (ea = expanding_alias ()) - parser_save_alias (); -- #endif - last_read_token = WORD; /* WORD to allow reserved words here */ - current_command_line_count = 0; ---- 6494,6499 ---- -*************** -*** 6532,6539 **** - pop_stream (); - -- #if 0 /* TAG: bash-5.2 */ - if (ea) - parser_restore_alias (); -- #endif - - #if defined (HISTORY) ---- 6530,6535 ---- -*** ../bash-5.1-patched/y.tab.c 2020-11-28 12:17:19.000000000 -0500 ---- y.tab.c 2021-11-17 10:47:35.000000000 -0500 -*************** -*** 8788,8795 **** - - push_stream (1); -- #if 0 /* TAG: bash-5.2 Alex fxmbsw7 Ratchev <fxmbsw7(a)gmail.com> 11/17/2020 */ - if (ea = expanding_alias ()) - parser_save_alias (); -- #endif - last_read_token = WORD; /* WORD to allow reserved words here */ - current_command_line_count = 0; ---- 8777,8782 ---- -*************** -*** 8826,8833 **** - pop_stream (); - -- #if 0 /* TAG: bash-5.2 */ - if (ea) - parser_restore_alias (); -- #endif - - #if defined (HISTORY) ---- 8813,8818 ---- -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 10 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 11 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-012 b/src/patches/bash/bash51-012 deleted file mode 100644 index 222491884..000000000 --- a/src/patches/bash/bash51-012 +++ /dev/null @@ -1,198 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-012 - -Bug-Reported-by: Nikolay Borisov <nborisov(a)suse.com> -Bug-Reference-ID: <1a715205-06ce-413b-c1c0-2f5639ce06c0(a)suse.com> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2020-11/msg00091.html - -Bug-Description: - -There is a possible race condition that arises when a child process receives -a signal trapped by the parent before it can reset the signal dispositions. -The child process is not supposed to trap the signal in this circumstance. - -Patch (apply with `patch -p0'): - -*** ../bash-20201118/command.h 2020-08-14 15:04:39.000000000 -0400 ---- command.h 2020-11-27 15:18:02.000000000 -0500 -*************** -*** 125,128 **** ---- 125,129 ---- - #define SUBSHELL_COPROC 0x40 /* subshell from a coproc pipeline */ - #define SUBSHELL_RESETTRAP 0x80 /* subshell needs to reset trap strings on first call to trap */ -+ #define SUBSHELL_IGNTRAP 0x100 /* subshell should reset trapped signals from trap_handler */ - - /* A structure which represents a word. */ - -*** ../bash-20201118/execute_cmd.c 2020-11-23 14:16:48.000000000 -0500 ---- execute_cmd.c 2020-11-27 16:43:25.000000000 -0500 -*************** -*** 1548,1551 **** ---- 1548,1554 ---- - reset_signal_handlers (); - subshell_environment |= SUBSHELL_RESETTRAP; -+ /* Note that signal handlers have been reset, so we should no longer -+ reset the handler and resend trapped signals to ourselves. */ -+ subshell_environment &= ~SUBSHELL_IGNTRAP; - - /* We are in a subshell, so forget that we are running a trap handler or -*************** -*** 4321,4325 **** - cmdflags |= CMD_NO_FORK; - -! subshell_environment = SUBSHELL_FORK; /* XXX */ - if (pipe_in != NO_PIPE || pipe_out != NO_PIPE) - subshell_environment |= SUBSHELL_PIPE; ---- 4324,4329 ---- - cmdflags |= CMD_NO_FORK; - -! /* We redo some of what make_child() does with SUBSHELL_IGNTRAP */ -! subshell_environment = SUBSHELL_FORK|SUBSHELL_IGNTRAP; /* XXX */ - if (pipe_in != NO_PIPE || pipe_out != NO_PIPE) - subshell_environment |= SUBSHELL_PIPE; -*************** -*** 4575,4578 **** ---- 4580,4584 ---- - reset_signal_handlers (); - subshell_environment |= SUBSHELL_RESETTRAP; -+ subshell_environment &= ~SUBSHELL_IGNTRAP; - - if (async) -*************** -*** 5515,5518 **** ---- 5521,5525 ---- - /* Cancel traps, in trap.c. */ - restore_original_signals (); -+ subshell_environment &= ~SUBSHELL_IGNTRAP; - - #if defined (JOB_CONTROL) - -*** ../bash-20201118/jobs.c 2020-08-04 10:17:39.000000000 -0400 ---- jobs.c 2020-11-27 16:39:56.000000000 -0500 -*************** -*** 2218,2221 **** ---- 2218,2223 ---- - pid_t mypid; - -+ subshell_environment |= SUBSHELL_IGNTRAP; -+ - /* If this ends up being changed to modify or use `command' in the - child process, go back and change callers who free `command' in -diff -rC 2 ../bash-20201118/nojobs.c nojobs.c -*** ../bash-20201118/nojobs.c 2020-07-08 10:11:25.000000000 -0400 ---- nojobs.c 2020-11-27 16:38:36.000000000 -0500 -*************** -*** 576,579 **** ---- 576,581 ---- - #endif - -+ subshell_environment |= SUBSHELL_IGNTRAP; -+ - default_tty_job_signals (); - } - -*** ../bash-20201118/sig.c 2020-11-23 13:22:17.000000000 -0500 ---- sig.c 2020-11-28 10:21:43.000000000 -0500 -*************** -*** 56,60 **** - #endif - -! extern void initialize_siglist (); - - #if !defined (JOB_CONTROL) ---- 56,61 ---- - #endif - -! extern void initialize_siglist PARAMS((void)); -! extern void set_original_signal PARAMS((int, SigHandler *)); - - #if !defined (JOB_CONTROL) -*************** -*** 256,259 **** ---- 257,267 ---- - XHANDLER(i) = oact.sa_handler; - XSAFLAGS(i) = oact.sa_flags; -+ -+ #if 0 -+ set_original_signal (XSIG(i), XHANDLER(i)); /* optimization */ -+ #else -+ set_original_signal (XSIG(i), act.sa_handler); /* optimization */ -+ #endif -+ - /* Don't do anything with signals that are ignored at shell entry - if the shell is not interactive. */ - -*** ../bash-20201118/subst.c 2020-11-16 10:33:15.000000000 -0500 ---- subst.c 2020-11-27 16:07:00.000000000 -0500 -*************** -*** 5952,5955 **** ---- 5952,5956 ---- - /* Cancel traps, in trap.c. */ - restore_original_signals (); /* XXX - what about special builtins? bash-4.2 */ -+ subshell_environment &= ~SUBSHELL_IGNTRAP; - QUIT; /* catch any interrupts we got post-fork */ - setup_async_signals (); -*************** -*** 6383,6386 **** ---- 6384,6388 ---- - QUIT; /* catch any interrupts we got post-fork */ - subshell_environment |= SUBSHELL_RESETTRAP; -+ subshell_environment &= ~SUBSHELL_IGNTRAP; - } - - -diff -rC 2 ../bash-20201118/trap.c trap.c -*** ../bash-20201118/trap.c 2020-11-28 12:04:07.000000000 -0500 ---- trap.c 2020-11-28 10:22:10.000000000 -0500 -*************** -*** 482,485 **** ---- 482,511 ---- - } - -+ /* This means we're in a subshell, but have not yet reset the handler for -+ trapped signals. We're not supposed to execute the trap in this situation; -+ we should restore the original signal and resend the signal to ourselves -+ to preserve the Posix "signal traps that are not being ignored shall be -+ set to the default action" semantics. */ -+ if ((subshell_environment & SUBSHELL_IGNTRAP) && trap_list[sig] != (char *)IGNORE_SIG) -+ { -+ sigset_t mask; -+ -+ /* Paranoia */ -+ if (original_signals[sig] == IMPOSSIBLE_TRAP_HANDLER) -+ original_signals[sig] = SIG_DFL; -+ -+ restore_signal (sig); -+ -+ /* Make sure we let the signal we just caught through */ -+ sigemptyset (&mask); -+ sigprocmask (SIG_SETMASK, (sigset_t *)NULL, &mask); -+ sigdelset (&mask, sig); -+ sigprocmask (SIG_SETMASK, &mask, (sigset_t *)NULL); -+ -+ kill (getpid (), sig); -+ -+ SIGRETURN (0); -+ } -+ - if ((sig >= NSIG) || - (trap_list[sig] == (char *)DEFAULT_SIG) || - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 11 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 12 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-013 b/src/patches/bash/bash51-013 deleted file mode 100644 index f2413a58d..000000000 --- a/src/patches/bash/bash51-013 +++ /dev/null @@ -1,43 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-013 - -Bug-Reported-by: Anders Kaseorg <andersk(a)mit.edu> -Bug-Reference-ID: <de65540274064d7b95f17e9c46a3a6d8(a)oc11expo7.exchange.mit.edu> -Bug-Reference-URL: https://lists.gnu.org/archive/html/bug-bash/2021-11/msg00025.html - -Bug-Description: - -Bash did not always perform tilde expansion following an unquoted colon on -the rhs of an assignment statement in posix mode. - -Patch (apply with `patch -p0'): - -*** ../bash-20211028/subst.c 2021-10-18 16:09:58.000000000 -0400 ---- subst.c 2021-11-30 11:19:47.000000000 -0500 -*************** -*** 3826,3829 **** ---- 3826,3830 ---- - td.flags = W_ASSIGNRHS; - #endif -+ td.flags |= (W_NOGLOB|W_TILDEEXP); - td.word = savestring (string); - value = call_expand_word_internal (&td, quoted, 0, (int *)NULL, (int *)NULL); - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 12 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 13 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-014 b/src/patches/bash/bash51-014 deleted file mode 100644 index cd8df23ab..000000000 --- a/src/patches/bash/bash51-014 +++ /dev/null @@ -1,48 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-014 - -Bug-Reported-by: platon7pronko(a)gmail.com -Bug-Reference-ID: -Bug-Reference-URL: https://savannah.gnu.org/patch/?10035 - -Bug-Description: - -Bash may produce corrupted input if a multibyte character spans a 512-byte -boundary while reading the output of a command substitution. - -Patch (apply with `patch -p0'): - -*** ../bash-20210217/subst.c 2021-02-03 10:32:08.000000000 -0500 ---- subst.c 2021-03-01 16:47:52.000000000 -0500 -*************** -*** 6243,6247 **** - /* punt on the hard case for now */ - memset (&ps, '\0', sizeof (mbstate_t)); -! mblen = mbrtowc (&wc, bufp-1, bufn+1, &ps); - if (MB_INVALIDCH (mblen) || mblen == 0 || mblen == 1) - istring[istring_index++] = c; ---- 6243,6247 ---- - /* punt on the hard case for now */ - memset (&ps, '\0', sizeof (mbstate_t)); -! mblen = mbrtowc (&wc, bufp-1, bufn, &ps); - if (MB_INVALIDCH (mblen) || mblen == 0 || mblen == 1) - istring[istring_index++] = c; - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 13 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 14 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-015 b/src/patches/bash/bash51-015 deleted file mode 100644 index 5ae65811a..000000000 --- a/src/patches/bash/bash51-015 +++ /dev/null @@ -1,49 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-015 - -Bug-Reported-by: Volodymyr Prodan <vovcat(a)gmail.com> -Bug-Reference-ID: -Bug-Reference-URL: https://savannah.gnu.org/patch/?10076 - -Bug-Description: - -Patch (apply with `patch -p0'): - -There are some characters (e.g., cyrillic) that can't be displayed using -certain single-byte encodings (e.g., cp1251) because the negative signed -int is interpreted as EOF and not displayed. - -*** ../bash-20210524/lib/readline/display.c 2021-03-16 18:12:20.000000000 -0400 ---- lib/readline/display.c 2021-06-07 16:53:08.000000000 -0400 -*************** -*** 1599,1603 **** - - for (cur_face = FACE_NORMAL, i = 0; i < n; i++) -! putc_face (str[i], face[i], &cur_face); - putc_face (EOF, FACE_NORMAL, &cur_face); - } ---- 1599,1603 ---- - - for (cur_face = FACE_NORMAL, i = 0; i < n; i++) -! putc_face ((unsigned char) str[i], face[i], &cur_face); - putc_face (EOF, FACE_NORMAL, &cur_face); - } - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 14 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 15 - - #endif /* _PATCHLEVEL_H_ */ diff --git a/src/patches/bash/bash51-016 b/src/patches/bash/bash51-016 deleted file mode 100644 index 4694498b2..000000000 --- a/src/patches/bash/bash51-016 +++ /dev/null @@ -1,64 +0,0 @@ - BASH PATCH REPORT - ================= - -Bash-Release: 5.1 -Patch-ID: bash51-016 - -Bug-Reported-by: Vincent Menegaux <vincent.menegaux(a)gmail.com> -Bug-Reference-ID: -Bug-Reference-URL: https://savannah.gnu.org/patch/?10070 - -Bug-Description: - -Multiple `!' tokens should toggle negation of an expression in a [[ -conditional command, instead of simply negating the expression. - -Patch (apply with `patch -p0'): - -*** ../bash-20210515/parse.y 2021-04-21 15:32:50.000000000 -0400 ---- parse.y 2021-05-24 11:53:30.000000000 -0400 -*************** -*** 4797,4801 **** - term = cond_term (); - if (term) -! term->flags |= CMD_INVERT_RETURN; - } - else if (tok == WORD && yylval.word->word[0] == '-' && yylval.word->word[1] && yylval.word->word[2] == 0 && test_unop (yylval.word->word)) ---- 4797,4801 ---- - term = cond_term (); - if (term) -! term->flags ^= CMD_INVERT_RETURN; - } - else if (tok == WORD && yylval.word->word[0] == '-' && yylval.word->word[1] && yylval.word->word[2] == 0 && test_unop (yylval.word->word)) - -*** ../bash-20210515/y.tab.c 2021-05-14 15:50:41.000000000 -0400 ---- y.tab.c 2021-05-24 16:35:55.000000000 -0400 -*************** -*** 7091,7095 **** - term = cond_term (); - if (term) -! term->flags |= CMD_INVERT_RETURN; - } - else if (tok == WORD && yylval.word->word[0] == '-' && yylval.word->word[1] && yylval.word->word[2] == 0 && test_unop (yylval.word->word)) ---- 7091,7095 ---- - term = cond_term (); - if (term) -! term->flags ^= CMD_INVERT_RETURN; - } - else if (tok == WORD && yylval.word->word[0] == '-' && yylval.word->word[1] && yylval.word->word[2] == 0 && test_unop (yylval.word->word)) - -*** ../bash-5.1/patchlevel.h 2020-06-22 14:51:03.000000000 -0400 ---- patchlevel.h 2020-10-01 11:01:28.000000000 -0400 -*************** -*** 26,30 **** - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 15 - - #endif /* _PATCHLEVEL_H_ */ ---- 26,30 ---- - looks for to find the patch level (for the sccs version string). */ - -! #define PATCHLEVEL 16 - - #endif /* _PATCHLEVEL_H_ */ -- 2.35.3

2 1

[PATCH] linux: Randomize layout of sensitive kernel structures
by Peter Müller 03 Aug '22

03 Aug '22

To quote from the kernel documentation: > If you say Y here, the layouts of structures that are entirely > function pointers (and have not been manually annotated with > __no_randomize_layout), or structures that have been explicitly > marked with __randomize_layout, will be randomized at compile-time. > This can introduce the requirement of an additional information > exposure vulnerability for exploits targeting these structure > types. > > Enabling this feature will introduce some performance impact, > slightly increase memory usage, and prevent the use of forensic > tools like Volatility against the system (unless the kernel > source tree isn't cleaned after kernel installation). > > The seed used for compilation is located at > scripts/gcc-plgins/randomize_layout_seed.h. It remains after > a make clean to allow for external modules to be compiled with > the existing seed and will be removed by a make mrproper or > make distclean. > > Note that the implementation requires gcc 4.7 or newer. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 3 ++- config/rootfiles/common/aarch64/linux | 5 +++++ config/rootfiles/common/armv6l/linux | 5 +++++ config/rootfiles/common/x86_64/linux | 5 +++++ 4 files changed, 17 insertions(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 40975b5fc..c8e7ada01 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -793,7 +793,8 @@ CONFIG_HAVE_GCC_PLUGINS=y CONFIG_GCC_PLUGINS=y # CONFIG_GCC_PLUGIN_CYC_COMPLEXITY is not set CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y -# CONFIG_GCC_PLUGIN_RANDSTRUCT is not set +CONFIG_GCC_PLUGIN_RANDSTRUCT=y +CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y # end of General architecture-dependent options CONFIG_RT_MUTEXES=y diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index dbd6e8f2f..b3a642e56 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -7646,6 +7646,8 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/GARP #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_LATENT_ENTROPY +#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT +#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT_PERFORMANCE #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK_BYREF_ALL #lib/modules/KVER-ipfire/build/include/config/GCC_VERSION @@ -11684,6 +11686,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/generated/autoconf.h #lib/modules/KVER-ipfire/build/include/generated/bounds.h #lib/modules/KVER-ipfire/build/include/generated/compile.h +#lib/modules/KVER-ipfire/build/include/generated/randomize_layout_hash.h #lib/modules/KVER-ipfire/build/include/generated/timeconst.h #lib/modules/KVER-ipfire/build/include/generated/uapi #lib/modules/KVER-ipfire/build/include/generated/uapi/linux @@ -17129,6 +17132,8 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.so #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.c +#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.so +#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_seed.h #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/sancov_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/stackleak_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/structleak_plugin.c diff --git a/config/rootfiles/common/armv6l/linux b/config/rootfiles/common/armv6l/linux index 79e4facfe..c3411fe8d 100644 --- a/config/rootfiles/common/armv6l/linux +++ b/config/rootfiles/common/armv6l/linux @@ -8071,6 +8071,8 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_ARM_SSP_PER_TASK #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_LATENT_ENTROPY +#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT +#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT_PERFORMANCE #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK_BYREF_ALL #lib/modules/KVER-ipfire/build/include/config/GCC_VERSION @@ -12134,6 +12136,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/generated/autoconf.h #lib/modules/KVER-ipfire/build/include/generated/bounds.h #lib/modules/KVER-ipfire/build/include/generated/compile.h +#lib/modules/KVER-ipfire/build/include/generated/randomize_layout_hash.h #lib/modules/KVER-ipfire/build/include/generated/timeconst.h #lib/modules/KVER-ipfire/build/include/generated/uapi #lib/modules/KVER-ipfire/build/include/generated/uapi/linux @@ -17579,6 +17582,8 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.so #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.c +#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.so +#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_seed.h #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/sancov_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/stackleak_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/structleak_plugin.c diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index b25f85a3a..1b78fe8c5 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -7624,6 +7624,8 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/GARP #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGINS #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_LATENT_ENTROPY +#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT +#lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_RANDSTRUCT_PERFORMANCE #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK #lib/modules/KVER-ipfire/build/include/config/GCC_PLUGIN_STRUCTLEAK_BYREF_ALL #lib/modules/KVER-ipfire/build/include/config/GCC_VERSION @@ -12128,6 +12130,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/generated/autoconf.h #lib/modules/KVER-ipfire/build/include/generated/bounds.h #lib/modules/KVER-ipfire/build/include/generated/compile.h +#lib/modules/KVER-ipfire/build/include/generated/randomize_layout_hash.h #lib/modules/KVER-ipfire/build/include/generated/timeconst.h #lib/modules/KVER-ipfire/build/include/generated/uapi #lib/modules/KVER-ipfire/build/include/generated/uapi/linux @@ -17567,6 +17570,8 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/latent_entropy_plugin.so #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.c +#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_plugin.so +#lib/modules/KVER-ipfire/build/scripts/gcc-plugins/randomize_layout_seed.h #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/sancov_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/stackleak_plugin.c #lib/modules/KVER-ipfire/build/scripts/gcc-plugins/structleak_plugin.c -- 2.35.3

2 6

[PATCH] linux: Do not enable dangerous legacy DRM drivers
by Peter Müller 03 Aug '22

03 Aug '22

https://lists.ipfire.org/pipermail/development/2022-July/013886.html This leaves current Nvidia Nouveau support untouched. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 40975b5fc..3a05794aa 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -5121,7 +5121,7 @@ CONFIG_DRM_AMD_DC_DCN=y # CONFIG_HSA_AMD is not set CONFIG_DRM_NOUVEAU=m -CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT=y +# CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT is not set CONFIG_NOUVEAU_DEBUG=5 CONFIG_NOUVEAU_DEBUG_DEFAULT=3 # CONFIG_NOUVEAU_DEBUG_MMU is not set @@ -5201,14 +5201,7 @@ CONFIG_DRM_XEN_FRONTEND=m CONFIG_DRM_VBOXVIDEO=m CONFIG_DRM_GUD=m CONFIG_DRM_HYPERV=m -CONFIG_DRM_LEGACY=y -# CONFIG_DRM_TDFX is not set -# CONFIG_DRM_R128 is not set -# CONFIG_DRM_I810 is not set -# CONFIG_DRM_MGA is not set -# CONFIG_DRM_SIS is not set -# CONFIG_DRM_VIA is not set -# CONFIG_DRM_SAVAGE is not set +# CONFIG_DRM_LEGACY is not set CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y # -- 2.35.3

2 1

[PATCH] GnuTLS: Update to 3.7.7
by Peter Müller 03 Aug '22

03 Aug '22

Please refer to https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html the release notes of this version, and https://www.gnutls.org/security-new.html#GNUTLS-SA-2022-07-07 for the accompanying security advisory. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/gnutls | 2 +- lfs/gnutls | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/gnutls b/config/rootfiles/common/gnutls index 25173efd3..88dcdd105 100644 --- a/config/rootfiles/common/gnutls +++ b/config/rootfiles/common/gnutls @@ -33,7 +33,7 @@ usr/lib/libgnutls-dane.so.0.4.1 #usr/lib/libgnutls.la #usr/lib/libgnutls.so usr/lib/libgnutls.so.30 -usr/lib/libgnutls.so.30.33.1 +usr/lib/libgnutls.so.30.34.1 #usr/lib/libgnutlsxx.la #usr/lib/libgnutlsxx.so usr/lib/libgnutlsxx.so.30 diff --git a/lfs/gnutls b/lfs/gnutls index 9c418890a..089b37719 100644 --- a/lfs/gnutls +++ b/lfs/gnutls @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.7.6 +VER = 3.7.7 THISAPP = gnutls-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9f3cce8dfc0b88f2c42d1d2633417dac649a265407b620b6d15967e5210debb99d287ef31d2b9dc37a527ac1e5b9db4c240b98a63293078fbd2e26ac694bf3d3 +$(DL_FILE)_BLAKE2 = a66037ecc6da660ff12949f50012840263c2e0b174079e41b62a2d884f060cee56f0c64a2815d07321a54b08cce016d2b4c8f0e059636c1ab5f7db9c8d64c7c6 install : $(TARGET) -- 2.35.3

1 0

[PATCH] linux: Enable PCI passthrough for QEMU
by Peter Müller 03 Aug '22

03 Aug '22

Fixes: #12754 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 12 +++++++++++- config/kernel/kernel.config.armv6l-ipfire | 12 +++++++++++- config/kernel/kernel.config.riscv64-ipfire | 12 +++++++++++- config/kernel/kernel.config.x86_64-ipfire | 12 +++++++++++- 4 files changed, 44 insertions(+), 4 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 9232335ff..123679467 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -6740,7 +6740,17 @@ CONFIG_UIO=m # CONFIG_UIO_NETX is not set # CONFIG_UIO_PRUSS is not set # CONFIG_UIO_MF624 is not set -# CONFIG_VFIO is not set +CONFIG_VFIO=m +CONFIG_VFIO_IOMMU_TYPE1=m +CONFIG_VFIO_VIRQFD=m +# CONFIG_VFIO_NOIOMMU is not set +CONFIG_VFIO_PCI_CORE=m +CONFIG_VFIO_PCI_MMAP=y +CONFIG_VFIO_PCI_INTX=y +CONFIG_VFIO_PCI=m +CONFIG_VFIO_PCI_VGA=y +CONFIG_VFIO_PCI_IGD=y +# CONFIG_VFIO_MDEV is not set CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO=y CONFIG_VIRTIO_PCI_LIB=y diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire index dc0aee51b..ac1d9749c 100644 --- a/config/kernel/kernel.config.armv6l-ipfire +++ b/config/kernel/kernel.config.armv6l-ipfire @@ -6747,7 +6747,17 @@ CONFIG_UIO=m # CONFIG_UIO_NETX is not set # CONFIG_UIO_PRUSS is not set # CONFIG_UIO_MF624 is not set -# CONFIG_VFIO is not set +CONFIG_VFIO=m +CONFIG_VFIO_IOMMU_TYPE1=m +CONFIG_VFIO_VIRQFD=m +# CONFIG_VFIO_NOIOMMU is not set +CONFIG_VFIO_PCI_CORE=m +CONFIG_VFIO_PCI_MMAP=y +CONFIG_VFIO_PCI_INTX=y +CONFIG_VFIO_PCI=m +CONFIG_VFIO_PCI_VGA=y +CONFIG_VFIO_PCI_IGD=y +# CONFIG_VFIO_MDEV is not set CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO=m CONFIG_VIRTIO_MENU=y diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire index 0801f4389..c379447e7 100644 --- a/config/kernel/kernel.config.riscv64-ipfire +++ b/config/kernel/kernel.config.riscv64-ipfire @@ -5590,7 +5590,17 @@ CONFIG_UIO_PCI_GENERIC=m # CONFIG_UIO_NETX is not set # CONFIG_UIO_PRUSS is not set # CONFIG_UIO_MF624 is not set -# CONFIG_VFIO is not set +CONFIG_VFIO=m +CONFIG_VFIO_IOMMU_TYPE1=m +CONFIG_VFIO_VIRQFD=m +# CONFIG_VFIO_NOIOMMU is not set +CONFIG_VFIO_PCI_CORE=m +CONFIG_VFIO_PCI_MMAP=y +CONFIG_VFIO_PCI_INTX=y +CONFIG_VFIO_PCI=m +CONFIG_VFIO_PCI_VGA=y +CONFIG_VFIO_PCI_IGD=y +# CONFIG_VFIO_MDEV is not set CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO=y CONFIG_VIRTIO_PCI_LIB=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 40975b5fc..fc68e47b1 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -6241,7 +6241,17 @@ CONFIG_UIO_PCI_GENERIC=m # CONFIG_UIO_PRUSS is not set # CONFIG_UIO_MF624 is not set CONFIG_UIO_HV_GENERIC=m -# CONFIG_VFIO is not set +CONFIG_VFIO=m +CONFIG_VFIO_IOMMU_TYPE1=m +CONFIG_VFIO_VIRQFD=m +# CONFIG_VFIO_NOIOMMU is not set +CONFIG_VFIO_PCI_CORE=m +CONFIG_VFIO_PCI_MMAP=y +CONFIG_VFIO_PCI_INTX=y +CONFIG_VFIO_PCI=m +CONFIG_VFIO_PCI_VGA=y +CONFIG_VFIO_PCI_IGD=y +# CONFIG_VFIO_MDEV is not set CONFIG_IRQ_BYPASS_MANAGER=m CONFIG_VIRT_DRIVERS=y # CONFIG_VBOXGUEST is not set -- 2.35.3

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development August 2022