Development September 2021

development@lists.ipfire.org

9 participants
91 discussions

[PATCH] pam: Update to version 1.5.2
by Adolf Belka 27 Sep '21

27 Sep '21

- Update from 1.5.1 to 1.5.2 - Update rootfile - Changelog Release 1.5.2 * pam_exec: implemented quiet_log option. * pam_mkhomedir: added support of HOME_MODE and UMASK from /etc/login.defs. * pam_timestamp: changed hmac algorithm to call openssl instead of the bundled sha1 implementation if selected, added option to select the hash algorithm to use with HMAC. * Added pkgconfig files for provided libraries. * Added --with-systemdunitdir configure option to specify systemd unit directory. * Added --with-misc-conv-bufsize configure option to specify the buffer size in libpam_misc's misc_conv() function, raised the default value for this parameter from 512 to 4096. * Multiple minor bug fixes, portability fixes, documentation improvements, and translation updates. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/pam | 3 +++ lfs/pam | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/pam b/config/rootfiles/common/pam index e487e3fe2..88e155f77 100644 --- a/config/rootfiles/common/pam +++ b/config/rootfiles/common/pam @@ -126,6 +126,9 @@ usr/lib/libpam_misc.so.0.82.1 #usr/lib/libpamc.so usr/lib/libpamc.so.0 usr/lib/libpamc.so.0.82.1 +#usr/lib/pkgconfig/pam.pc +#usr/lib/pkgconfig/pam_misc.pc +#usr/lib/pkgconfig/pamc.pc #usr/lib/systemd #usr/lib/systemd/system #usr/lib/systemd/system/pam_namespace.service diff --git a/lfs/pam b/lfs/pam index 463ee71da..d90cfb928 100644 --- a/lfs/pam +++ b/lfs/pam @@ -24,7 +24,7 @@ include Config -VER = 1.5.1 +VER = 1.5.2 THISAPP = Linux-PAM-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 155f2a31d07077b2c63a1f135876c31b +$(DL_FILE)_MD5 = 895e8adfa14af334f679bbeb28503f66 install : $(TARGET) -- 2.33.0

1 0

[PATCH] openssh: Update to version 8.8p1
by Adolf Belka 27 Sep '21

27 Sep '21

- Update from 8.7p1 to 8.8p1 - Update of rootfile not required - Changelog OpenSSH 8.8p1 Future deprecation notice A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. This creates one area of potential incompatibility: scp(1) when using the SFTP protocol no longer requires this finicky and brittle quoting, and attempts to use it may cause transfers to fail. We consider the removal of the need for double-quoting shell characters in file names to be a benefit and do not intend to introduce bug- compatibility for legacy scp/rcp in scp(1) when using the SFTP protocol. Another area of potential incompatibility relates to the use of remote paths relative to other user's home directories, for example - "scp host:~user/file /tmp". The SFTP protocol has no native way to expand a ~user path. However, sftp-server(8) in OpenSSH 8.7 and later support a protocol extension "expand-path(a)openssh.com" to support this. Security sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser directive has been set to run the command as a different user. Instead these commands would inherit the groups that sshd(8) was started with. Depending on system configuration, inherited groups may allow AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to gain unintended privilege. Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are enabled by default in sshd_config(5). Potentially-incompatible changes This release disables RSA signatures using the SHA-1 hash algorithm by default. This change has been made as the SHA-1 hash algorithm is cryptographically broken, and it is possible to create chosen-prefix hash collisions for <USD$50K [1] For most users, this change should be invisible and there is no need to replace ssh-rsa keys. OpenSSH has supported RFC8332 RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys will automatically use the stronger algorithm where possible. Changes since OpenSSH 8.7p1 This release is motivated primarily by the above deprecation and security fix. New features * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs directive to accept a "none" argument to specify the default behaviour. Bugfixes * scp(1): when using the SFTP protocol, continue transferring files after a transfer error occurs, better matching original scp/rcp behaviour. * ssh(1): fixed a number of memory leaks in multiplexing, * ssh-keygen(1): avoid crash when using the -Y find-principals command. * A number of documentation and manual improvements, including bz#3340, PR139, PR215, PR241, PR257 Portability * ssh-agent(1): on FreeBSD, use procctl to disable ptrace(2) * ssh(1)/sshd(8): some fixes to the pselect(2) replacement compatibility code. bz#3345 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openssh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index ec8ac1e55..1aea6cba9 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -24,7 +24,7 @@ include Config -VER = 8.7p1 +VER = 8.8p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f545230799f131aecca04da56e61990a +$(DL_FILE)_MD5 = 8ce5f390958baeeab635aafd0ef41453 install : $(TARGET) -- 2.33.0

1 0

[PATCH v2] libcap: Update to version 2.59
by Adolf Belka 27 Sep '21

27 Sep '21

- v2 version extends the update from 2.56 to 2.59 - Update from 2.50 to 2.59 - Update rootfile - Changelog Release notes for 2.59 libcap-2.55 ... 2.58 would SIGSEGV if an operation was attempted on a NULL value for cap_t or cap_iab_t. Restore the more tolerant error return behavior last seen with libcap-2.54. (Bug 214525) More make -j13 fixes (missing dependency for make -C progs sudotest). Various minor documentation fixes. Release notes for 2.58 Fixed a potential libcap memory leak by adding a destructor (Bug 214373 reported by yan12125) Major improvement is that there is a path for Linux-PAM compliant applications to support setting Ambient vector Capabilities via pam_cap.so now (Bug 214377) In addition to the bug, related discussion is in two Github issues: https://github.com/shadow-maint/shadow/pull/408#issuecomment-919673098 and https://github.com/rra/pam-krb5/issues/21 Added support for RPM builds that generate the build-id that RPM expects (see https://github.com/rpm-software-management/rpm/issues/367 for discussion) Minor contrib/sucap/su.c cleanups Clean up kdebug build rules More documentation cleanup Release notes for 2.57 capsh enhancements: --mode makes a guess at the libcap mode of the current process (Bug 214319) --strict makes capsh less permissive and expects the user to perform more deliberate capability transactions useful for learning all the steps; and helps this article be more pedagogical. Build system fixes Preserve $(WARNINGS) (Fix from David Seifert) Don't ever build test binaries unless make test etc is invoked (speeds builds on slower systems) Support make -j12 for all, test and sudotest targets getcap -r / now generates readable output (Bug 214317) Some documentation cleanup: more consistency. Release notes for 2.56 Canonicalize the Makefile use (in collaboration with David Seifert) In the process fixed a bug in pam_cap/test_pam_cap (reported by David Seifert, Bug 214257) Doc fixes for cap_iab.3 Added color support to captree, which helped make the following fix generate readable output: Fixed captree to not display duplicate copies of sub-trees if also exploring their ancestor (Bug 214269) Fixed contrib/sucap/su to correctly handle the Inheritable flag. Release notes for 2.55 Two rounds of fixes for the results of some static analysis performed by Zoltan Fridrich Removed a clang compilation warning about memory allocation by rewriting the way cap_free() and the various libcap memory allocation mechanisms work. (Bug 214183) This generated a few broken builds until it was fixed. Cleanup of some man pages; some fixes and shorter URL to bugzilla link. Added libcap cap_proc_root() API function (to reach parity with the Go cap package). This is only potentially useful with the recently added cap_iab_get_pid() function Revamped what the GOLANG=yes builds install - used to install local copies of cap and psx, but these were effectively useless because of the Go module support in recent Go releases in favor of user controller GOPATH. Now make GOLANG=yes only installs the captree utility Added some features to captree and created a small article on it Added a man page for the captree utility Some small changes to the tests to account for the idiosyncrasies of some new testing environments I've accumulated. Included adding --has-b support to capsh Release notes for 2.54 Fix for a corner case infinite loop handling long strings (patch provided by Samanta Navarro) Fixes to not ignore allocation failures (patch provided by Samanta Navarro) Evolving work from Samanta Navarro, found and fixed a memory leak in cap_iab_get_proc() More robust discovery of the name of the dynamic loader of the build target (patch provided by Arnout Vandecappelle) Revamped the Go capability comparison API for *cap.Set and *cap.IAB, and added cap.IABGetPID() Added libcap cap_iab_compare() and cap_iab_get_pid() APIs. Added a Go utility, captree, to display the process (and thread) graph along with the POSIX.1e and IAB capabilities of each PID{TID} tree. Extended getpcap to support the --iab command line argument, which outputs a PID's IAB tuple too (if non-default). Install *.so files as executable now that they are executable as binaries A feature of 2.52 but not extended to install rules at that time. Absorbed a lot of wisdom from a number of downstream package workarounds including wisdom from (Zhi Li and Arnout Vandecappelle and unknown others... Bugs 214023#c16, 214085) Support make FORCELINKPAM=yes or make FORCELINKPAM=no for those packagers that feel strongly about not letting this be dynamically discovered at build time. Fixed a compiler warnings from the GitHub build tester (Bug 214143) Release notes for 2.53 The (C) cap_launch functionality was previously broken when launches failed (found and fixed by Samanta Navarro) Added a test case for this too. Lots of tyops fixed in code and documentation (also by Samanta Navarro) Support distributions that aggressively link shared objects (reported by David Runge; Bug 214023) These distributions failed to observe a runnable pam_cap.so and various make options failed. Support clang builds (again). (Reported by Johan Herland 214047) This used to work, but by accident. It broke with the advent of a runnable libcap.so , libpsx.so and pam_cap.so support. Fixed now, and added a build target to validate it still works at release time. Minor documentation updates including one for Slavi Marinov who was trying to get cap.LaunchFunc() to work. Worked up a couple of example modifications to goapps/web to demonstrate a different user per web query and enabling a custom chroot per web query. Release notes for 2.52 Revived -std=c89 compilation for make all etc. (Bug 213541 reported by Byron Stanoszek.) The shared library objects: pam_cap.so, libcap.so and libpsx.so, are all now runnable as standalone binaries! The support is used to display some description information. To activate it, these binaries need to be installed executable (chmod +x ...) We also provided a write-up of how to enable this sort of feature in other .so files here. The module pam_cap.so now contains support for a default=<IAB> module argument. (Bug 213611). Enhanced capsh --suggest to also compare against the capability value names and not just their descriptions. Added capsh --current support. Minor documentation updates. Added a contrib/sucap/su.c pure-capabilities PAM implementation of su. This is primarily to demonstrate that such a thing is possible, and to validate that the pam_cap.so module is capable of adding any IAB tuple of inheritables per group or user. At this time, it relies on features only present in this version of libcap and HEAD of the Linux-PAM sources for the pam_unix.so module. Release notes for 2.51 Fix capsh installation (Bug 213261 - reported by Jan Palus) Add an autoauth module flag to pam_cap.so (Bug 213279 - noted a feature request hidden in StackExchange) Unified libcap/cap (Go) and libcap (C) default generation of external format binary data (Bug 213375 - addressing an issue raised by Mike Schilling) This standard binary format should be forwards/backwards compatible with earlier libcap2 builds and libcap/cap packages API enhancement cap_fill() and (*cap.Set).Fill() - to permit copying one capability flag to another. This can be used to raise all the Permitted capabilities in a Set with one API call. In tree build/run/test of Go packages now uses Go module vendoring (Bug 212453). This is with an eye to the imminent golang change removing support for GOPATH based building. Minor compilation warning fixes Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libcap | 9 +++-- lfs/libcap | 7 ++-- .../libcap-2.50-install_capsh_again.patch | 38 ------------------- 3 files changed, 9 insertions(+), 45 deletions(-) delete mode 100644 src/patches/libcap-2.50-install_capsh_again.patch diff --git a/config/rootfiles/common/libcap b/config/rootfiles/common/libcap index def30cb5a..31d307b94 100644 --- a/config/rootfiles/common/libcap +++ b/config/rootfiles/common/libcap @@ -1,10 +1,10 @@ #lib/libcap.a lib/libcap.so.2 -lib/libcap.so.2.50 +lib/libcap.so.2.59 #lib/libpsx.a #lib/libpsx.so -#lib/libpsx.so.2 -#lib/libpsx.so.2.50 +lib/libpsx.so.2 +lib/libpsx.so.2.59 #lib/pkgconfig/libcap.pc #lib/pkgconfig/libpsx.pc lib/security/pam_cap.so @@ -36,8 +36,10 @@ usr/lib/libcap.so #usr/share/man/man3/cap_get_proc.3 #usr/share/man/man3/cap_get_secbits.3 #usr/share/man/man3/cap_iab.3 +#usr/share/man/man3/cap_iab_compare.3 #usr/share/man/man3/cap_iab_fill.3 #usr/share/man/man3/cap_iab_from_text.3 +#usr/share/man/man3/cap_iab_get_pid.3 #usr/share/man/man3/cap_iab_get_proc.3 #usr/share/man/man3/cap_iab_get_vector.3 #usr/share/man/man3/cap_iab_init.3 @@ -73,6 +75,7 @@ usr/lib/libcap.so #usr/share/man/man3/psx_syscall.3 #usr/share/man/man3/psx_syscall3.3 #usr/share/man/man3/psx_syscall6.3 +#usr/share/man/man8/captree.8 #usr/share/man/man8/getcap.8 #usr/share/man/man8/getpcaps.8 #usr/share/man/man8/setcap.8 diff --git a/lfs/libcap b/lfs/libcap index 610ff474b..7dd65983b 100644 --- a/lfs/libcap +++ b/lfs/libcap @@ -24,7 +24,7 @@ include Config -VER = 2.50 +VER = 2.59 THISAPP = libcap-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 66a561afa81666236ff973544ff4e864 +$(DL_FILE)_MD5 = 585540ad79ee2692722877c0c528d165 install : $(TARGET) @@ -70,13 +70,12 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libcap-2.50-install_capsh_again.patch # Prevent a static library from being installed cd $(DIR_APP) && sed -i '/install.*STALIBNAME/d' libcap/Makefile cd $(DIR_APP) && make GOLANG=no cd $(DIR_APP) && make install GOLANG=no rm -vf /lib/libcap.so - ln -svf /lib/libcap.so.2.50 /usr/lib/libcap.so + ln -svf /lib/libcap.so.2.59 /usr/lib/libcap.so chmod +x /lib/libcap.so.* @rm -rf $(DIR_APP) @$(POSTBUILD) diff --git a/src/patches/libcap-2.50-install_capsh_again.patch b/src/patches/libcap-2.50-install_capsh_again.patch deleted file mode 100644 index 0ae7520dc..000000000 --- a/src/patches/libcap-2.50-install_capsh_again.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 1f8d32942be54850a3a89c7b58ba5613b5525c58 Mon Sep 17 00:00:00 2001 -From: "Andrew G. Morgan" <morgan(a)kernel.org> -Date: Fri, 28 May 2021 13:41:17 -0700 -Subject: [PATCH] Make capsh an installed binary again - -Bug report from Jan Palus: - - https://bugzilla.kernel.org/show_bug.cgi?id=213261 - -Signed-off-by: Andrew G. Morgan <morgan(a)kernel.org> ---- - progs/Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/progs/Makefile b/progs/Makefile -index 313dc4d..3c3dc97 100644 ---- a/progs/Makefile -+++ b/progs/Makefile -@@ -32,14 +32,14 @@ $(BUILD): %: %.o $(DEPS) - - install: all - mkdir -p -m 0755 $(FAKEROOT)$(SBINDIR) -- for p in $(PROGS) ; do \ -+ for p in $(PROGS) capsh ; do \ - install -m 0755 $$p $(FAKEROOT)$(SBINDIR) ; \ - done - ifeq ($(RAISE_SETFCAP),yes) - $(FAKEROOT)$(SBINDIR)/setcap cap_setfcap=i $(FAKEROOT)$(SBINDIR)/setcap - endif - --test: $(PROGS) -+test: $(PROGS) capsh - - capshdoc.h.cf: capshdoc.h ./mkcapshdoc.sh - ./mkcapshdoc.sh > $@ --- -2.32.0.rc2 - -- 2.33.0

1 0

[PATCH] grep: Update to version 3.7
by Adolf Belka 27 Sep '21

27 Sep '21

- Update from 3.6 to 3.7 - Update of rootfile not required - Changelog * Noteworthy changes in release 3.7 (2021-08-14) [stable] ** Changes in behavior Use of the --unix-byte-offsets (-u) option now evokes a warning. Since 3.1, this Windows-only option has had no effect. ** Bug fixes Preprocessing N patterns would take at least O(N^2) time when too many patterns hashed to too few buckets. This now takes seconds, not days: : | grep -Ff <(seq 6400000 | tr 0-9 A-J) [Bug#44754 introduced in grep 3.5] - More details of the changes can be found in the ChangeLog file in the source tarball. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/grep | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/grep b/lfs/grep index d19a6831b..27b2161ae 100644 --- a/lfs/grep +++ b/lfs/grep @@ -24,7 +24,7 @@ include Config -VER = 3.6 +VER = 3.7 THISAPP = grep-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = f47fe27049510b2249dba7f862ac1b51 +$(DL_FILE)_MD5 = 7c9cca97fa18670a21e72638c3e1dabf install : $(TARGET) -- 2.33.0

1 0

[PATCH] gdb: Update to version 11.1
by Adolf Belka 27 Sep '21

27 Sep '21

- Update from 10.2 to 11.1 - Update of rootfile - Changelog Version 11.1 of GDB includes the following changes and enhancements: Support for ARM Symbian (arm*-*-symbianelf*) has been removed. Building GDB now requires GMP (The GNU Multiple Precision Arithmetic Library). New command-line options "--early-init-command" (or "-eix") and "--early-init-eval-command" (or "-eiex") GDB/MI Changes: New --qualified option for the '-break-insert' and '-dprintf-insert' commands. New --force-condition option for the '-break-insert' and '-dprintf-insert' commands. New --force option for the '-break-condition' command. The '-file-list-exec-source-files' now accepts an optional regular expression to filter the source files included in the result. The results from '-file-list-exec-source-files' now include a 'debug-fully-read' field to indicate if the corresponding source's debugging information has been partially read (false) or has been fully read (true). TUI Improvements: Mouse actions are now supported. The mouse wheel scrolls the appropriate window. Key combinations that do not have a specific action on the focused window are now passed to GDB. Python enhancements: Inferior objects now contain a read-only 'connection_num' attribute that gives the connection number as seen in 'info connections' and 'info inferiors'. New method gdb.Frame.level() which returns the stack level of the frame object. New method gdb.PendingFrame.level() which returns the stack level of the frame object. When hitting a catchpoint, the Python API will now emit a gdb.BreakpointEvent rather than a gdb.StopEvent. The gdb.Breakpoint attached to the event will have type BP_CATCHPOINT. Python TUI windows can now receive mouse click events. If the Window object implements the click method, it is called for each mouse click event in this window. New setting "python ignore-environment on|off"; if "on", causes GDB's builtin Python to ignore any environment variable that would otherwise affect how Python behaves (needs to be set during "early initialization" (see above). New setting "python dont-write-bytecode auto|on|off". Guile API enhancements: Improved support for rvalue reference values. New procedures for obtaining value variants: value-reference-value, value-rvalue-reference-value and value-const-value. New "qMemTags" and "QMemTags" remote protocol packets (associated with Memory Tagging). GDB will now look for the .gdbinit file in a config directory before looking for ~/.gdbinit. The file is searched for in the following locations: $XDG_CONFIG_HOME/gdb/gdbinit, $HOME/.config/gdb/gdbinit, $HOME/.gdbinit. On Apple hosts the search order is instead: $HOME/Library/Preferences/gdb/gdbinit, $HOME/.gdbinit. The "break [...] if CONDITION" command no longer returns an error when the condition is invalid at one or more locations. Instead, if the condition is valid at one or more locations, the locations where the condition is not valid are disabled. The behavior of the "condition" command is changed to match the new behavior of the "break" command. Support for general memory tagging functionality (currently limited to AArch64 MTE) Core file debugging now supported for x86_64 Cygwin programs. New "org.gnu.gdb.riscv.vector" feature for RISC-V targets. GDB now supports fixed point types which are described in DWARF as base types with a fixed-point encoding. Additionally, support for the DW_AT_GNU_numerator and DW_AT_GNU_denominator has also been added. Miscellaneous: New "startup-quietly on|off" setting; when "on", behaves the same as passing the "-silent" option on the command line. New "print type hex on|off" setting; when 'on', the 'ptype' command uses hexadecimal notation to print sizes and offsets of struct members. When 'off', decimal notation is used. The "inferior" command, when run without argument, prints information about the current inferior. The "ptype" command now supports "/x" and "/d", affecting the base used to print sizes and offsets. The output of the "info source" has been restructured. New "style version foreground | background | intensity" commands to control the styling of the GDB version number. Various debug and maintenance commands (mostly useful for the GDB developers) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/gdb | 11 +++++++++++ lfs/gdb | 4 ++-- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/gdb b/config/rootfiles/common/gdb index d2be68c3e..4c91357ec 100644 --- a/config/rootfiles/common/gdb +++ b/config/rootfiles/common/gdb @@ -4,6 +4,9 @@ #usr/bin/gdbserver #usr/include/gdb #usr/include/gdb/jit-reader.h +#usr/include/sim +#usr/include/sim/callback.h +#usr/include/sim/sim.h #usr/lib/libinproctrace.so #usr/share/gdb #usr/share/gdb/python @@ -56,6 +59,14 @@ #usr/share/gdb/system-gdbinit/wrs-linux.py #usr/share/info/annotate.info #usr/share/info/gdb.info +#usr/share/info/gdb.info-1 +#usr/share/info/gdb.info-2 +#usr/share/info/gdb.info-3 +#usr/share/info/gdb.info-4 +#usr/share/info/gdb.info-5 +#usr/share/info/gdb.info-6 +#usr/share/info/gdb.info-7 +#usr/share/info/gdb.info-8 #usr/share/info/stabs.info #usr/share/man/man1/gcore.1 #usr/share/man/man1/gdb-add-index.1 diff --git a/lfs/gdb b/lfs/gdb index cdbebadbd..79ed0b386 100644 --- a/lfs/gdb +++ b/lfs/gdb @@ -24,7 +24,7 @@ include Config -VER = 10.2 +VER = 11.1 THISAPP = gdb-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c044b7146903ec51c9d2337a29aee93b +$(DL_FILE)_MD5 = 257cb0f67927f79acf636d8c01e19990 install : $(TARGET) -- 2.33.0

1 0

[PATCH] curl: Update to version 7.79.1
by Adolf Belka 27 Sep '21

27 Sep '21

- Update from 7.78.0 to 7.79.1 - Update of rootfile not required - Changelog Fixed in 7.79.1 - September 22 2021 Bugfixes: Curl_http2_setup: don't change connection data on repeat invokes curl_multi_fdset: make FD_SET() not operate on sockets out of range dist: provide lib/.checksrc in the tarball FAQ: add GOPHERS + curl works on data, not files hsts: CURLSTS_FAIL from hsts read callback should fail transfer hsts: handle unlimited expiry http: fix the broken >3 digit response code detection strerror: use sys_errlist instead of strerror on Windows test1184: disable tests/sshserver.pl: make it work with openssh-8.7p1 Fixed in 7.79.0 - September 15 2021 Changes: bearssl: support CURLOPT_CAINFO_BLOB http: consider cookies over localhost to be secure secure transport: support CURLINFO_CERTINFO Bugfixes: CVE-2021-22945: clear the leftovers pointer when sending succeeds CVE-2021-22946: do not ignore --ssl-reqd CVE-2021-22947: reject STARTTLS server response pipelining ares: use ares_getaddrinfo() asyn-ares.c: move all version number checks to the top auth: do not append zero-terminator to authorisation id in kerberos auth: properly handle byte order in kerberos security message auth: use sasl authzid option in kerberos auth: we do not support a security layer after kerberos authentication BINDINGS.md: update links to use https where available build: fix compiler warnings c-hyper: deal with Expect: 100-continue combined with POSTFIELDS c-hyper: fix header value passed to debug callback c-hyper: handle HTTP/1.1 => HTTP/1.0 downgrade on reused connection c-hyper: initial step for 100-continue support c-hyper: initial support for "dumping" 1xx HTTP responses c-hyper: remove the hyper_executor_poll() loop from Curl_http CI/cirrus: reduce compile time with increased parallism CI: use GitHub Container Registry instead of Docker Hub cirrus: Add FreeBSD 13.0 job and disable sanitizer build cmake: avoid poll() on macOS cmake: sync CURL_DISABLE options codeql: fix error "Resource not accessible by integration" compressed.d: it's a request, not an order config.d: escape the backslash properly config.d: note that curlrc is used even when --config config: get rid of the unused HAVE_SIG_ATOMIC_T et. al. configure.ac: revert bad nghttp2 library detection improvements configure: error out if both ngtcp2 and quiche are specified configure: make --disable-hsts work configure: set classic mingw minimum OS version to XP configure: tweak nghttp2 library name fix connect: get local port + ip also when reusing connections connect: remove superfluous conditional curl-openssl.m4: check lib64 for the pkg-config file curl-openssl.m4: show correct output for OpenSSL v3 curl.1: mention "global" flags curl.1: provide examples for each option curl: add warning for ignored data after quoted form parameter curl: add warning for incompatible parameters usage curl: better error message when -O fails to get a good name curl: stop retry if Retry-After: is longer than allowed curl_easy_setopt.3: improve the string copy wording Curl_hsts_loadcb: don't attempt to load if hsts wasn't inited curl_setup.h: sync values for HTTP_ONLY curl_url_get.3: clarify about path and query CURLMOPT_TIMERFUNCTION.3: remove misplaced "time" CURLOPT_DOH_URL.3: CURLOPT_OPENSOCKETFUNCTION is not inherited CURLOPT_SSL_CTX_*.3: tidy up the example CURLOPT_UNIX_SOCKET_PATH.3: remove nginx reference, add see also docs/MQTT: update state of username/password support docs: remove experimental mentions from HSTS and MQTT docs: the security list is reached at security at curl.se now easy: use a custom implementation of wcsdup on Windows examples/*hiperfifo.c: fix calloc arguments to match function proto examples/cookie_interface: avoid printfing time_t directly examples/cookie_interface: fix scan-build printf warning examples/ephiperfifo.c: simplify signal handler FAQ: add two dev related questions getparameter: fix the --local-port number parser happy-eyeballs-timeout-ms.d: polish the wording hostip: Make Curl_ipv6works function independent of getaddrinfo http2: Curl_http2_setup needs to init stream data in all invokes http2: revert a change that broke upgrade to h2c http2: revert call the handle-closed function correctly on closed stream http: disallow >3-digit response codes http: ignore content-length if any transfer-encoding is used http_proxy: clear 'sending' when the outgoing request is sent http_proxy: fix the User-Agent inclusion in CONNECT http_proxy: fix user-agent and custom headers for CONNECT with hyper http_proxy: only wait for writable socket while sending request INTERNALS: bump c-ares requirement to 1.16.0 INTERNALS: c-ares has a new home: c-ares.org lib: don't use strerror() libcurl-errors.3: clarify two CURLUcode errors limit-rate.d: clarify base unit mailing lists: move from cool.haxx.se to lists.haxx.se mbedtls: avoid using a large buffer on the stack mbedTLS: initial 3.0.0 support mbedtls_threadlock: fix unused variable warning mksymbolsmanpage.pl: Fix showing symbol's last used version mksymbolsmanpage.pl: match symbols case insenitively multi: fix compiler warning with `CURL_DISABLE_WAKEUP` ngtcp2: compile with the latest ngtcp2 and nghttp3 ngtcp2: fix build with ngtcp2 and nghttp3 ngtcp2: remove the acked_crypto_offset struct field init ngtcp2: replace deprecated functions with nghttp3_conn_shutdown_stream_read ngtcp2: reset the oustanding send buffer again when drained ngtcp2: rework the return value handling of ngtcp2_conn_writev_stream ngtcp2: stop buffering crypto data ngtcp2: utilize crypto API functions to simplify openssl: annotate SSL3_MT_SUPPLEMENTAL_DATA openssl: when creating a new context, there cannot be an old one opt-docs: make sure all man pages have examples opt-docs: verify man page sections + order opts docs: unify phrasing in NAME header output.d: add method to suppress response bodies page-header: add GOPHERS, simplify wording in the 1st para progress: fix a compile warning on some systems progress: make trspeed avoid floats runtests: add option -u to error on server unexpectedly alive schannel: Work around typo in classic mingw macro scripts: invoke interpreters through /usr/bin/env setopt: enable CURLOPT_IGNORE_CONTENT_LENGTH for hyper strerror.h: remove the #include from files not using it symbols-in-versions: fix CURLSSLBACKEND_QSOSSL last used version test1138: remove trailing space to make work with hyper test1173: check references to libcurl options test1280: CRLFify the response to please hyper test1565: fix windows build errors test365: verify response with chunked AND Content-Length headers tests/*server.pl: flush output before executing subprocess tests/*server.py: remove pidfile on server termination tests/runtests.pl: cleanup copy&paste mistakes and unused code tests/server/*.c: align handling of portfile argument and file tests: adjust the tftpd output to work with hyper mode tests: be explicit about using 'python3' instead of 'python' tests: enable test 1129 for hyper builds tests: make three tests pass until 2037 tool/tests: fix potential year 2038 issues tool_operate: Fix --fail-early with parallel transfers url: fix compiler warning in no-verbose builds urlapi.c:seturl: assert URL instead of using if-check vtls: fix typo in schannel_verify.c winbuild/README.md: clarify GEN_PDB option wolfssl: clean up wolfcrypt error queue write-out.d: clarify size_download/upload x509asn1: fix heap over-read when parsing x509 certificates Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/curl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/curl b/lfs/curl index 1d516664c..70465bb35 100644 --- a/lfs/curl +++ b/lfs/curl @@ -24,7 +24,7 @@ include Config -VER = 7.78.0 +VER = 7.79.1 THISAPP = curl-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 419c2461366cf404160a820f7a902b7e +$(DL_FILE)_MD5 = 74d3c4ca8aaa6c0619806d6e246e65fb install : $(TARGET) -- 2.33.0

1 0

Fwd: [oss-security] CVE-2021-3773: Lack of port sanity checking in natd and Netfilter leads to exploit of OpenVPN clients on Linux and FreeBSD platforms
by Peter Müller 27 Sep '21

27 Sep '21

Hello Erik, hello *, https://www.openwall.com/lists/oss-security/2021/09/08/3 crossed my path the other day, but I did not yet have time to read it comprehensively. Since you being the OpenVPN guru around here (no offense intended :-) ): Are you aware of this? Is this something we are affected by? Thanks, and best regards, Peter Müller

2 1

[PATCH v2] libxcrypt: Update to version 4.4.26
by Adolf Belka 27 Sep '21

27 Sep '21

- v2 version is to extend from 4.4.25 to 4.4.26 - Update from 4.4.23 to 4.4.26 - Update of rootfile not required - Changelog Version 4.4.26 * Fix compilation on systems with GCC >= 10, that do not support declarations with __attribute__((symver)). Version 4.4.25 * Add support for Python 3.11 in the configure script. * Stricter checking of invalid salt characters (issue #135). Hashed passphrases are always entirely printable ASCII, and do not contain any whitespace or the characters ':', ';', '*', '!', or '\'. (These characters are used as delimiters and special markers in the passwd(5) and shadow(5) files.) Version 4.4.24 * Add hash group for Debian in lib/hashes.conf. Debian has switched to use the yescrypt hashing algorithm as the default for new user passwords, so we should add a group for this distribution. * Overhaul the badsalt test. Test patterns are now mostly generated rather than manually coded into a big table. Not reading past the end of the “setting” part of the string is tested more thoroughly (this would have caught the sunmd5 $$ bug if it had been available at the time). Test logs are tidier. * Add ‘test-programs’ utility target to Makefile. It is sometimes useful to compile all the test programs but not run them. Add a Makefile target that does this. * Fix incorrect bcrypt-related ifdeffage in test/badsalt.c. The four variants of bcrypt are independently configurable, but the badsalt tests for them were all being toggled by INCLUDE_bcrypt, which is only the macro for the $2b$ variant. * Fix bigcrypt-related test cases in test/badsalt.c. The test spec was only correct when both or neither of bigcrypt and descrypt were enabled. * Detect ASan in configure and disable incompatible tests. ASan’s “interceptors” for crypt and crypt_r have a semantic conflict with libxcrypt, requiring a few tests to be disabled for builds with -fsanitize-address. See commentary in test/crypt-badargs.c for an explanation of the conflict, and the commentary in build-aux/zw_detect_asan.m4 for why a configure test is required. * Fix several issues found by Covscan in the testsuite. These include: - CWE-170: String not null terminated (STRING_NULL) - CWE-188: Reliance on integer endianness (INCOMPATIBLE_CAST) - CWE-190: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN) - CWE-569: Wrong sizeof argument (SIZEOF_MISMATCH) - CWE-573: Missing varargs init or cleanup (VARARGS) - CWE-687: Argument cannot be negative (NEGATIVE_RETURNS) Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/libxcrypt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/libxcrypt b/lfs/libxcrypt index 16ebb1dc5..770b4249e 100644 --- a/lfs/libxcrypt +++ b/lfs/libxcrypt @@ -24,10 +24,10 @@ include Config -VER = 4.4.23 +VER = 4.4.26 THISAPP = libxcrypt-$(VER) -DL_FILE = $(THISAPP).tar.gz +DL_FILE = $(THISAPP).tar.xz DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 405116b5cc90b72216afccc54025afbc +$(DL_FILE)_MD5 = 34954869627f62f9992808b6cff0d0a9 install : $(TARGET) -- 2.33.0

2 1

[PATCH v2] sudo: Update to version 1.9.8p2
by Adolf Belka 26 Sep '21

26 Sep '21

- v2 version is to extend from 1.9.8p1 to 1.9.8p2 - Update from 1.9.7p2 to 1.9.8p2 - Update rootfile - Changelog What's new in Sudo 1.9.8p2 * Fixed a potential out-of-bounds read with "sudo -i" when the target user's shell is bash. This is a regression introduced in sudo 1.9.8. Bug #998. * sudo_logsrvd now only sends a log ID for first command of a session. There is no need to send the log ID for each sub-command. * Fixed a few minor memory leaks in intercept mode. * Fixed a problem with sudo_logsrvd in relay mode if "store_first" was enabled when handling sub-commands. A new zero-length journal file was created for each sub-command instead of simply using the existing journal file. What's new in Sudo 1.9.8p1 * Fixed support for passing a prompt (sudo -p) or a login class (sudo -l) on the command line. This is a regression introduced in sudo 1.9.8. Bug #993. * Fixed a crash with "sudo ALL" rules in the LDAP and SSSD back-ends. This is a regression introduced in sudo 1.9.8. Bug #994. * Fixed a compilation error when the --enable-static-sudoers configure option was specified. This is a regression introduced in sudo 1.9.8 caused by a symbol clash with the intercept and log server protobuf functions. What's new in Sudo 1.9.8 * It is now possible to transparently intercepting sub-commands executed by the original command run via sudo. Intercept support is implemented using LD_PRELOAD (or the equivalent supported by the system) and so has some limitations. The two main limitations are that only dynamic executables are supported and only the execl, execle, execlp, execv, execve, execvp, and execvpe library functions are currently intercepted. Its main use case is to support restricting privileged shells run via sudo. To support this, there is a new "intercept" Defaults setting and an INTERCEPT command tag that can be used in sudoers. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh Defaults!SHELLS intercept would cause sudo to run the listed shells in intercept mode. This can also be set on a per-rule basis. For example: Cmnd_Alias SHELLS=/bin/bash, /bin/sh, /bin/csh, /bin/ksh, /bin/zsh chuck ALL = INTERCEPT: SHELLS would only apply intercept mode to user "chuck" when running one of the listed shells. In intercept mode, sudo will not prompt for a password before running a sub-command and will not allow a set-user-ID or set-group-ID program to be run by default. The new intercept_authenticate and intercept_allow_setid sudoers settings can be used to change this behavior. * The new "log_subcmds" sudoers setting can be used to log additional commands run in a privileged shell. It uses the same mechanism as the intercept support described above and has the same limitations. * The new "log_exit_status" sudoers setting can be used to log the exit status commands run via sudo. This is also a corresponding "log_exit" setting in the sudo_logsrvd.conf eventlog stanza. * Support for logging sudo_logsrvd errors via syslog or to a file. Previously, most sudo_logsrvd errors were only visible in the debug log. * Better diagnostics when there is a TLS certificate validation error. * Using the "+=" or "-=" operators in a Defaults setting that takes a string, not a list, now produces a warning from sudo and a syntax error from inside visudo. * Fixed a bug where the "iolog_mode" setting in sudoers and sudo_logsrvd had no effect when creating I/O log parent directories if the I/O log file name ended with the string "XXXXXX". * Fixed a bug in the sudoers custom prompt code where the size parameter that was passed to the strlcpy() function was incorrect. No overflow was possible since the correct amount of memory was already pre-allocated. * The mksigname and mksiglist helper programs are now built with the host compiler, not the target compiler, when cross-compiling. Bug #989. * Fixed compilation error when the --enable-static-sudoers configure option was specified. This was due to a typo introduced in sudo 1.9.7. GitHub PR #113. For more details of the changes then view the ChangeLog file in the source tarball or at https://www.sudo.ws/changes.html Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/sudo | 2 ++ lfs/sudo | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/sudo b/config/rootfiles/common/sudo index babdcb484..80e83efa4 100644 --- a/config/rootfiles/common/sudo +++ b/config/rootfiles/common/sudo @@ -18,6 +18,8 @@ usr/lib/sudo/group_file.so usr/lib/sudo/libsudo_util.so.0.0.0 #usr/lib/sudo/sample_approval.la usr/lib/sudo/sample_approval.so +#usr/lib/sudo/sudo_intercept.la +usr/lib/sudo/sudo_intercept.so #usr/lib/sudo/sudo_noexec.la usr/lib/sudo/sudo_noexec.so #usr/lib/sudo/sudoers.la diff --git a/lfs/sudo b/lfs/sudo index a74c34e7e..bec0f6021 100644 --- a/lfs/sudo +++ b/lfs/sudo @@ -24,7 +24,7 @@ include Config -VER = 1.9.7p2 +VER = 1.9.8p2 THISAPP = sudo-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = d6f8217bfd16649236e100c49e0a7cc4 +$(DL_FILE)_MD5 = f831c1d62835cde89c261465d9c781e4 install : $(TARGET) -- 2.33.0

1 0

[PATCH v2] libedit: Update to version 20210910-3.1
by Adolf Belka 26 Sep '21

26 Sep '21

- v2 version is to extend from 20210714-3.1 to 20210910-3.1 - Update from 20210522-3.1 to 20210910-3.1 - Update rootfile - Changelog 2021-09-10 Jess Thrysoee * all: sync with upstream source 2021-07-14 Jess Thrysoee * all: sync with upstream source * src/histedit.h: Add wcsdup declaration when ifndef HAVE_WCSDUP. Patch by Rainer Jung. * examples/wtc1.c: Fix warnings and add missing brace. Patch by Rainer Jung. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/libedit | 2 +- lfs/libedit | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/libedit b/config/rootfiles/common/libedit index 2a1b8f534..a27458f0e 100644 --- a/config/rootfiles/common/libedit +++ b/config/rootfiles/common/libedit @@ -4,7 +4,7 @@ #usr/lib/libedit.la #usr/lib/libedit.so usr/lib/libedit.so.0 -usr/lib/libedit.so.0.0.66 +usr/lib/libedit.so.0.0.68 #usr/lib/pkgconfig/libedit.pc #usr/share/man/man3/editline.3 #usr/share/man/man3/el_deletestr.3 diff --git a/lfs/libedit b/lfs/libedit index c28d07188..3e58896ad 100644 --- a/lfs/libedit +++ b/lfs/libedit @@ -24,7 +24,7 @@ include Config -VER = 20210522-3.1 +VER = 20210910-3.1 THISAPP = libedit-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 6ad9e9208daf031adf1ebc64441769e0 +$(DL_FILE)_MD5 = 648946c97eb92daed5ca0d08bbd5e6a2 install : $(TARGET) -- 2.33.0

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2021