Development February 2022

development@lists.ipfire.org

16 participants
114 discussions

[PATCH 01/28] gcc: toolchain stage 2: Set sysroot to /tools_${arch}
by Michael Tremer 14 Feb '22

14 Feb '22

The stage 2 compiler was looking for libraries outside the bootstrapped toolchain environment which causes that linked programs cannot be executied because the runtime linker only looks for libraries inside the toolchain environment. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- lfs/gcc | 1 + 1 file changed, 1 insertion(+) diff --git a/lfs/gcc b/lfs/gcc index ade02dcda..96e58ddae 100644 --- a/lfs/gcc +++ b/lfs/gcc @@ -116,6 +116,7 @@ ifeq "$(PASS)" "2" EXTRA_CONFIG = \ --build=$(BUILDTARGET) \ --prefix=$(TOOLS_DIR) \ + --with-sysroot=$(ROOT) \ --with-local-prefix=$(TOOLS_DIR) \ --with-native-system-header-dir=$(TOOLS_DIR)/include \ --enable-languages=c,c++ \ -- 2.30.2

3 34

[PATCH] New Addon: gptfdisk 1.0.8
by smooky＠v16.de 14 Feb '22

14 Feb '22

>>> https://www.rodsbooks.com/gdisk/ <<< source = https://sourceforge.net/projects/gptfdisk/files/gptfdisk/1.0.8/gptfdisk-1.0… Hi @ all I have a new add-on here which I use e.g. to bring partitions from mbr to gpt without data loss. It is also well suited for rescuing broken partitions. GPT fdisk (consisting of the gdisk, cgdisk, sgdisk, and fixparts programs) is a set of text-mode partitioning tools for Linux, FreeBSD, Mac OS X, and Windows. The gdisk, cgdisk, and sgdisk programs work on Globally Unique Identifier (GUID) Partition Table (GPT) disks, rather than on the older (and once more common) Master Boot Record (MBR) partition tables. The fixparts program repairs certain types of damage to MBR disks and enables changing partition types from primary to logical and vice-versa. Signed-off-by: Marcel Follert (Smooky) <smooky(a)v16.de> --- config/rootfiles/packages/gptfdisk | 4 ++ lfs/gptfdisk | 85 ++++++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 90 insertions(+) create mode 100644 config/rootfiles/packages/gptfdisk create mode 100644 lfs/gptfdisk diff --git a/config/rootfiles/packages/gptfdisk b/config/rootfiles/packages/gptfdisk new file mode 100644 index 000000000..a1a854021 --- /dev/null +++ b/config/rootfiles/packages/gptfdisk @@ -0,0 +1,4 @@ +usr/sbin/cgdisk +usr/sbin/fixparts +usr/sbin/gdisk +usr/sbin/sgdisk diff --git a/lfs/gptfdisk b/lfs/gptfdisk new file mode 100644 index 000000000..3f87e0c7e --- /dev/null +++ b/lfs/gptfdisk @@ -0,0 +1,85 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 1.0.8 + +THISAPP = gptfdisk-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) +PROG = gptfdisk +PAK_VER = 1 + +DEPS = + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 74684c4eb0e6d5a1839e4bb0bba36fa2 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xvfz $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && sed -i '29s#<ncursesw/ncurses.h>#<ncurses.h>#g' gptcurses.cc + cd $(DIR_APP) && make + cd $(DIR_APP) && cp cgdisk fixparts gdisk sgdisk /usr/sbin + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index e6f948ba0..4915ec2cb 100755 --- a/make.sh +++ b/make.sh @@ -1615,6 +1615,7 @@ buildipfire() { lfsmake2 libcdada lfsmake2 pmacct lfsmake2 squid-asnbl + lfsmake2 gptfdisk } buildinstaller() { -- 2.33.1

3 3

[PATCH 1/8] perl-Try-Tiny: New package.
by Stefan Schantl 14 Feb '22

14 Feb '22

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- config/rootfiles/common/perl-Try-Tiny | 6 ++ lfs/perl-Try-Tiny | 79 +++++++++++++++++++++++++++ make.sh | 1 + 3 files changed, 86 insertions(+) create mode 100644 config/rootfiles/common/perl-Try-Tiny create mode 100644 lfs/perl-Try-Tiny diff --git a/config/rootfiles/common/perl-Try-Tiny b/config/rootfiles/common/perl-Try-Tiny new file mode 100644 index 000000000..bb259b538 --- /dev/null +++ b/config/rootfiles/common/perl-Try-Tiny @@ -0,0 +1,6 @@ +#usr/lib/perl5/site_perl/5.32.1/Try +usr/lib/perl5/site_perl/5.32.1/Try/Tiny.pm +#usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Try +#usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Try/Tiny +#usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Try/Tiny/.packlist +#usr/share/man/man3/Try::Tiny.3 diff --git a/lfs/perl-Try-Tiny b/lfs/perl-Try-Tiny new file mode 100644 index 000000000..abff99afb --- /dev/null +++ b/lfs/perl-Try-Tiny @@ -0,0 +1,79 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2019 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + + +############################################################################### +# Definitions +############################################################################### +include Config +VER = 0.31 + +THISAPP = Try-Tiny-$(VER) +DL_FILE = ${THISAPP}.tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 993a29ee8a03c9bd9c2f7c53d1082a03 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && perl Makefile.PL + cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 378cd35eb..4ef9edb1f 100755 --- a/make.sh +++ b/make.sh @@ -1278,6 +1278,7 @@ buildipfire() { lfsmake2 perl-Apache-Htpasswd lfsmake2 perl-Parse-Yapp lfsmake2 perl-Data-UUID + lfsmake2 perl-Try-Tiny lfsmake2 gnupg lfsmake2 hdparm lfsmake2 sdparm -- 2.30.2

3 23

[PATCH] firewall: Drop P2P chains from initscript.
by Stefan Schantl 14 Feb '22

14 Feb '22

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org> --- src/initscripts/system/firewall | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 48653ff57..ecc57c8aa 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -154,12 +154,6 @@ iptables_init() { fi iptables -A HOSTILE -j DROP -m comment --comment "DROP_HOSTILE" - # P2PBLOCK - iptables -N P2PBLOCK - iptables -A INPUT -j P2PBLOCK - iptables -A FORWARD -j P2PBLOCK - iptables -A OUTPUT -j P2PBLOCK - # IPS (Guardian) chains iptables -N GUARDIAN iptables -A INPUT -j GUARDIAN -- 2.30.2

2 1

iana-etc
by Adolf Belka 14 Feb '22

14 Feb '22

Hi all, I have noticed that iana-etc on IPFire was last updated in 2011. It appears that iana no longer provided a versioned form of their data. However I have found a github location that has setup an automated versioning script to automatically create a versioned source file roughly every week. This is https://github.com/Mic92/iana-etc and the source file has the /etc/services and /etc/protocols files ready available to copy to the installation locations. Another alternative is Arch Linux who run a process once a month to download the .xml files and then run some gawk scripts to strip all the stuff that is not required for a list of the services and protocols. Arch Linux stores both the text versions and the xml versions of the services and protocols in the OS. Looking at the two above options the one from Mic92 seems to be the easier options as that provides both the text and xml versions and so the LFS file would only need to copy the text versions to the correct location. Feedback on the best approach to use for this? Regards, Adolf.

2 1

[PATCH] squid: Update from 5.2 => 5.4.1
by Matthias Fischer 13 Feb '22

13 Feb '22

For details see: http://www.squid-cache.org/Versions/v5/changesets/SQUID_5_4_1.html This is 'squid 5.4.1', containing the previous patch for Bug #5055. Prior to this patch I reverted my previous patches 'squid: Update 5.2 => 5.4" and 'squid 5.4: Latest patch - Bug #5055 - from upstream' and marked them as 'superseded' in patchwork. For a better overview the 'squid-gcc11'-patch has been renamed again and moved to an own squid-patch-directory. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 7 ++++--- .../{squid-gcc11.patch => squid/01_squid-gcc11.patch} | 0 2 files changed, 4 insertions(+), 3 deletions(-) rename src/patches/{squid-gcc11.patch => squid/01_squid-gcc11.patch} (100%) diff --git a/lfs/squid b/lfs/squid index b25f594a9..4b723a8e1 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 5.2 +VER = 5.4.1 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 102984f3ea382a1fa5bd917c2ee155ec +$(DL_FILE)_MD5 = a6d55b34ee8d32052026db1db98f4d0d install : $(TARGET) @@ -77,7 +77,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar xaf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squid-gcc11.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/squid/01_squid-gcc11.patch + cd $(DIR_APP) && autoreconf -vfi cd $(DIR_APP)/libltdl && autoreconf -vfi diff --git a/src/patches/squid-gcc11.patch b/src/patches/squid/01_squid-gcc11.patch similarity index 100% rename from src/patches/squid-gcc11.patch rename to src/patches/squid/01_squid-gcc11.patch -- 2.25.1

2 1

[PATCH] Ipblacklist.v3 Ancillary files
by Rob Brewer 12 Feb '22

12 Feb '22

Hi Michael and Adolf, This is my first patch to test that I am using git correctly to generate the V3 patches. It should be almost identical Tim's original Ancillary files patch. Can you please check that the format is correct and if this is OK I'll proceed to generate the remaining patches. Rob >From a11e598f9d686ee7010eea89a441bfcc0dd565da Mon Sep 17 00:00:00 2001 From: Rob <granturav8(a)gmail.com> Date: Sat, 12 Feb 2022 15:34:01 +0000 Subject: [PATCH] Ipblacklist.v3 Ancillary files --- config/ipblacklist/sources | 138 +++++++++++++++++++++++++++++++ src/misc-progs/getipsetstat.c | 25 ++++++ src/misc-progs/ipblacklistctrl.c | 48 +++++++++++ 3 files changed, 211 insertions(+) create mode 100644 config/ipblacklist/sources create mode 100644 src/misc-progs/getipsetstat.c create mode 100644 src/misc-progs/ipblacklistctrl.c diff --git a/config/ipblacklist/sources b/config/ipblacklist/sources new file mode 100644 index 000000000..3cfa7f7d4 --- /dev/null +++ b/config/ipblacklist/sources @@ -0,0 +1,138 @@ +############################################################################ +# # +# IP Address blacklists for IPFire # +# # +# This file contains a list of blacklist sources that will replace the one # +# internal to the updated if it is found at /var/ipfire/blacklist/sources. # +# The intention is to provide a common source of information for both the # +# updater and WUI. # +# # +# The chains created in the packet filter will be named by the top level # +# key and this will also be used in the log message to identify the reason # +# for the dropped packet. # +# # +# The fields are: # +# # +# name The blacklist's full name # +# url URL of the file containing the list # +# info URL giving information about the source # +# parser The parser function used to extract IP addresses from the # +# downloaded list # +# rate Minimum period between checks for updates. Can be specified in # +# days (d), hours (h) or minutes (m) # +# category Used for documentation on the WUI. Can be one of the following # +# 'application' Potentially unwanted applications # +# 'attacker' Generic source of malicious packets # +# 'c and c' Malware Command and Control source # +# 'composite' Composite of other lists # +# 'invalid' Invalid addresses on the public internet # +# 'scanner' Port scanner that is not initself malicious # +# disable Name of another list to disable if this one is enabled. Used # +# when the other list is a subset of this one. # +# # +# The info and category fields are purely for documentation. # +# # +############################################################################ + +%sources = ( 'EMERGING_FWRULE' => { 'name' => 'Emerging Threats Blocklist', + 'url' => 'https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt', + 'info' => 'https://doc.emergingthreats.net/bin/view/Main/EmergingFirewallRules', + 'parser' => 'ip-or-net-list', + 'rate' => '1h', + 'category' => 'composite', + 'disable' => ['FEODO_RECOMMENDED', 'FEODO_IP', 'FEODO_AGGRESIVE', 'SPAMHAUS_DROP', 'DSHIELD'] }, + 'EMERGING_COMPROMISED' => { 'name' => 'Emerging Threats Compromised IPs', + 'url' => 'https://rules.emergingthreats.net/blockrules/compromised-ips.txt', + 'info' => 'https://doc.emergingthreats.net/bin/view/Main/CompromisedHost', + 'parser' => 'ip-or-net-list', + 'rate' => '1h', + 'category' => 'attacker' }, + 'SPAMHAUS_DROP' => { 'name' => "Spamhaus Don't Route or Peer List", + 'url' => 'https://www.spamhaus.org/drop/drop.txt', + 'info' => 'https://www.spamhaus.org/drop/', + 'parser' => 'ip-or-net-list', + 'rate' => '12h', + 'category' => 'reputation' }, + 'SPAMHAUS_EDROP' => { 'name' => "Spamhaus Extended Don't Route or Peer List", + 'url' => 'https://www.spamhaus.org/drop/edrop.txt', + 'info' => 'https://www.spamhaus.org/drop/', + 'parser' => 'ip-or-net-list', + 'rate' => '1h', + 'category' => 'reputation' }, + 'DSHIELD' => { 'name' => 'Dshield.org Recommended Block List', + 'url' => 'https://www.dshield.org/block.txt', + 'info' => 'https://dshield.org/', + 'parser' => 'dshield', + 'rate' => '1h', + 'category' => 'attacker' }, + 'FEODO_RECOMMENDED'=> {'name' => 'Feodo Trojan IP Blocklist (Recommended)', + 'url' => 'https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt', + 'info' => 'https://feodotracker.abuse.ch/blocklist', + 'parser' => 'ip-or-net-list', + 'rate' => '5m', + 'category' => 'c and c' }, + 'FEODO_IP' => { 'name' => 'Feodo Trojan IP Blocklist', + 'url' => 'https://feodotracker.abuse.ch/downloads/ipblocklist.txt', + 'info' => 'https://feodotracker.abuse.ch/blocklist', + 'parser' => 'ip-or-net-list', + 'rate' => '5m', + 'category' => 'c and c', + 'disable' => 'FEODO_RECOMMENDED' }, + 'FEODO_AGGRESIVE' => { 'name' => 'Feodo Trojan IP Blocklist (Aggresive)', + 'url' => 'https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.txt', + 'info' => 'https://feodotracker.abuse.ch/blocklist', + 'parser' => 'ip-or-net-list', + 'rate' => '5m', + 'category' => 'c and c', + 'disable' => ['FEODO_IP', 'FEODO_RECOMMENDED'] }, + 'CIARMY' => { 'name' => 'The CINS Army List', + 'url' => 'https://cinsscore.com/list/ci-badguys.txt', + 'info' => 'https://cinsscore.com/#list', + 'parser' => 'ip-or-net-list', + 'rate' => '15m', + 'category' => 'reputation' }, + 'TOR_ALL' => { 'name' => 'Known TOR Nodes', + 'url' => 'https://www.dan.me.uk/torlist', + 'info' => 'https://www.dan.me.uk/tornodes', + 'parser' => 'ip-or-net-list', + 'rate' => '1h', + 'category' => 'application', + 'disable' => 'TOR_EXIT' }, + 'TOR_EXIT' => { 'name' => 'Known TOR Exit Nodes', + 'url' => 'https://www.dan.me.uk/torlist/?exit', + 'info' => 'https://www.dan.me.uk/tornodes', + 'parser' => 'ip-or-net-list',, + 'rate' => '1h', + 'category' => 'application' }, + 'ALIENVAULT' => { 'name' => 'AlienVault IP Reputation database', + 'url' => 'https://reputation.alienvault.com/reputation.generic', + 'info' => 'https://www.alienvault.com/resource-center/videos/what-is-ip-domain-reputat…', + 'parser' => 'ip-or-net-list', + 'rate' => '1h', + 'category' => 'reputation' }, + 'BOGON' => { 'name' => 'Bogus address list (Martian)', + 'url' => 'https://www.team-cymru.org/Services/Bogons/bogon-bn-agg.txt', + 'info' => 'https://www.team-cymru.com/bogon-reference.html', + 'parser' => 'ip-or-net-list', + 'rate' => '1d', + 'category' => 'invalid' }, + 'BOGON_FULL' => { 'name' => 'Full Bogus Address List', + 'url' => 'https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt', + 'info' => 'https://www.team-cymru.com/bogon-reference.html', + 'parser' => 'ip-or-net-list', + 'rate' => '4h', + 'category' => 'invalid', + 'disable' => 'BOGON' }, + 'SHODAN' => { 'name' => 'ISC Shodan scanner blacklist', + 'url' => 'https://isc.sans.edu/api/threatlist/shodan?tab', + 'info' => 'https://isc.sans.edu', + 'parser' => 'ip-or-net-list', + 'rate' => '1d', + 'category' => 'scanner' }, + 'BLOCKLIST_DE' => { 'name' => 'Blocklist.de all attacks list', + 'url' => 'https://lists.blocklist.de/lists/all.txt', + 'info' => 'https://www.blocklist.de', + 'parser' => 'ip-or-net-list', + 'rate' => '30m', + 'category' => 'attacker' } + ); diff --git a/src/misc-progs/getipsetstat.c b/src/misc-progs/getipsetstat.c new file mode 100644 index 000000000..781bfc55b --- /dev/null +++ b/src/misc-progs/getipsetstat.c @@ -0,0 +1,25 @@ +/* IPFire helper program - GetIPSetStat + * + * Get the list from IPSET LIST + * + */ + +#include <stdio.h> +#include <string.h> +#include <unistd.h> +#include <stdlib.h> +#include <sys/types.h> +#include <fcntl.h> +#include "setuid.h" + + +int main(void) +{ + if (!(initsetuid())) + exit(1); + + safe_system("/usr/sbin/ipset list -t -f /var/tmp/ipsets.txt"); + safe_system("chown nobody:nobody /var/tmp/ipsets.txt"); + + return 0; +} diff --git a/src/misc-progs/ipblacklistctrl.c b/src/misc-progs/ipblacklistctrl.c new file mode 100644 index 000000000..7536b1e97 --- /dev/null +++ b/src/misc-progs/ipblacklistctrl.c @@ -0,0 +1,48 @@ +/* This file is part of the IPFire Firewall. + * + * This program is distributed under the terms of the GNU General Public + * Licence. See the file COPYING for details. + * + */ + +#include <stdlib.h> +#include <stdio.h> +#include <string.h> +#include <unistd.h> +#include <sys/types.h> +#include <fcntl.h> +#include "setuid.h" + +int main(int argc, char *argv[]) { + + if (!(initsetuid())) + exit(1); + + if (argc < 2) { + fprintf(stderr, "\nNo argument given.\n" + "ipblacklistctrl (update|restore|log-on|log-off|" + "enable|disable)\n\n"); + exit(1); + } + + if (strcmp(argv[1], "update") == 0) { + safe_system("/usr/local/bin/ipblacklist update >/dev/null 2>&1 &"); + } else if (strcmp(argv[1], "restore") == 0) { + safe_system("/usr/local/bin/ipblacklist restore >/dev/null 2>&1 &"); + } else if (strcmp(argv[1], "log-on") == 0) { + safe_system("/usr/local/bin/ipblacklist log-on >/dev/null 2>&1 &"); + } else if (strcmp(argv[1], "log-off") == 0) { + safe_system("/usr/local/bin/ipblacklist log-off >/dev/null 2>&1 &"); + } else if (strcmp(argv[1], "enable") == 0) { + safe_system("/usr/local/bin/ipblacklist enable >/dev/null 2>&1 &"); + } else if (strcmp(argv[1], "disable") == 0) { + safe_system("/usr/local/bin/ipblacklist disable >/dev/null 2>&1 &"); + } else { + fprintf(stderr, "\nBad argument given.\n" + "ipblacklistctrl (update|restore|log-on|log-off|" + "enable|disable)\n\n"); + exit(1); + } + + return 0; +} -- 2.34.1 x

1 0

[PATCH] nano: Update to 6.1
by Matthias Fischer 12 Feb '22

12 Feb '22

For details see: https://www.nano-editor.org/news.php "The behavior of ^K at a prompt has been enhanced: when there is text after the cursor, just this text is erased. (In the usual situation, however, when the cursor is at the end of the answer, the behavior is as before: the whole answer is erased.) At a prompt, M-6 copies the current answer into the cutbuffer. Large external pastes into nano are handled more quickly." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/nano | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lfs/nano b/lfs/nano index d9a0dbfd6..16888fbee 100644 --- a/lfs/nano +++ b/lfs/nano @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 6.0 +VER = 6.1 THISAPP = nano-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = nano -PAK_VER = 40 +PAK_VER = 41 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 5b6ff59f2490db80a3498c4cd3eda085 +$(DL_FILE)_MD5 = 59ecd880ac645676e0a7543c8da3afd0 install : $(TARGET) -- 2.25.1

2 1

squid 5.4.1
by Matthias Fischer 12 Feb '22

12 Feb '22

Hi all, please note: 'squid 5.4.1' was published. => http://www.squid-cache.org/Versions/v5/ I'm at it. Best, Matthias

1 0

[PATCH v2] Kernel: Block non-UID-0 profiling completely
by Peter Müller 11 Feb '22

11 Feb '22

This is recommended by KSPP, Lynis, and others. Indeed, there is no legitimate reason why an unprivileged user on IPFire should do any profiling. Unfortunately, this change never landed in the mainline kernel, hence a distribution patch is necessary. The second version of this patch rebases the kernel patch by Jeff Vander Stoep against Linux 5.15.17 to avoid fuzzying. Tested-by: Peter Müller <peter.mueller(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/etc/sysctl.conf | 3 + lfs/linux | 3 + ...rther-restriction-of-perf_event_open.patch | 75 +++++++++++++++++++ 3 files changed, 81 insertions(+) create mode 100644 src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index c8c775d13..5fc3e3d89 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -101,3 +101,6 @@ net.ipv4.tcp_rfc1337 = 1 # Include PID in file names of generated core dumps kernel.core_uses_pid = 1 + +# Block non-uid-0 profiling +kernel.perf_event_paranoid = 3 diff --git a/lfs/linux b/lfs/linux index a8cb9dda3..e6bd14523 100644 --- a/lfs/linux +++ b/lfs/linux @@ -131,6 +131,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # fix Boot with enabled usercopy hardening cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.9-crypto_testmgr_allocate_buffers_with____GFP_COMP.patch + # Patch performance monitoring restrictions to allow further hardening + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch + ifeq "$(BUILD_ARCH)" "armv6l" # Apply Arm-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1 diff --git a/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch b/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch new file mode 100644 index 000000000..8a578e01c --- /dev/null +++ b/src/patches/linux/linux-5.15.17-security-perf-allow-further-restriction-of-perf_event_open.patch @@ -0,0 +1,75 @@ +From: Jeff Vander Stoep <jeffv(a)google.com> +Date: Wed, 27 Jul 2016 07:45:46 -0700 +Message-Id: <1469630746-32279-1-git-send-email-jeffv(a)google.com> +Subject: [kernel-hardening] [PATCH 1/2] security, + perf: allow further restriction of perf_event_open + +When kernel.perf_event_paranoid is set to 3 (or greater), disallow +all access to performance events by users without CAP_SYS_ADMIN. + +This new level of restriction is intended to reduce the attack +surface of the kernel. Perf is a valuable tool for developers but +is generally unnecessary and unused on production systems. Perf may +open up an attack vector to vulnerable device-specific drivers as +recently demonstrated in CVE-2016-0805, CVE-2016-0819, +CVE-2016-0843, CVE-2016-3768, and CVE-2016-3843. This new level of +restriction allows for a safe default to be set on production systems +while leaving a simple means for developers to grant access [1]. + +This feature is derived from CONFIG_GRKERNSEC_PERF_HARDEN by Brad +Spengler. It is based on a patch by Ben Hutchings [2]. Ben's patches +have been modified and split up to address on-list feedback. + +kernel.perf_event_paranoid=3 is the default on both Debian [2] and +Android [3]. + +[1] Making perf available to developers on Android: +https://android-review.googlesource.com/#/c/234400/ +[2] Original patch by Ben Hutchings: +https://lkml.org/lkml/2016/1/11/587 +[3] https://android-review.googlesource.com/#/c/234743/ + +Signed-off-by: Jeff Vander Stoep <jeffv(a)google.com> +Reviewed-by: Kees Cook <keescook(a)chromium.org> +--- + Documentation/sysctl/kernel.txt | 1 + + include/linux/perf_event.h | 5 +++++ + kernel/events/core.c | 4 ++++ + 3 files changed, 10 insertions(+) + +diff -Naur linux-5.15.22.orig/include/linux/perf_event.h linux-5.15.22/include/linux/perf_event.h +--- linux-5.15.22.orig/include/linux/perf_event.h 2022-02-11 15:39:26.163576222 +0000 ++++ linux-5.15.22/include/linux/perf_event.h 2022-02-11 15:42:16.719697397 +0000 +@@ -1346,6 +1346,11 @@ + return security_perf_event_open(attr, PERF_SECURITY_TRACEPOINT); + } + ++static inline bool perf_paranoid_any(void) ++{ ++ return sysctl_perf_event_paranoid > 2; ++} ++ + extern void perf_event_init(void); + extern void perf_tp_event(u16 event_type, u64 count, void *record, + int entry_size, struct pt_regs *regs, +diff -Naur linux-5.15.22.orig/kernel/events/core.c linux-5.15.22/kernel/events/core.c +--- linux-5.15.22.orig/kernel/events/core.c 2022-02-11 15:39:27.667683028 +0000 ++++ linux-5.15.22/kernel/events/core.c 2022-02-11 15:42:16.723697680 +0000 +@@ -414,6 +414,7 @@ + * 0 - disallow raw tracepoint access for unpriv + * 1 - disallow cpu events for unpriv + * 2 - disallow kernel profiling for unpriv ++ * 3 - disallow all unpriv perf event use + */ + int sysctl_perf_event_paranoid __read_mostly = 2; + +@@ -12090,6 +12091,9 @@ + if (err) + return err; + ++ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + err = perf_copy_attr(attr_uptr, &attr); + if (err) + return err; -- 2.34.1

1 0

← Newer
1
...
4
5
6
7
8
9
10
11
12
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development February 2022