Development July 2022

development@lists.ipfire.org

14 participants
75 discussions

[PATCH] ipblocklist: Fixed typo in 'en.pl'
by Matthias Fischer 15 Jul '22

15 Jul '22

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- langs/en/cgi-bin/en.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 87cc679a5..070e2871f 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1600,7 +1600,7 @@ 'ipblocklist disable post' => '', 'ipblocklist disable pre' => 'Disabling', 'ipblocklist download error' => 'A download error occurs.', -'ipblocklist empyt blocklist received' => 'An empty blocklist has been received.', +'ipblocklist empty blocklist received' => 'An empty blocklist has been received.', 'ipblocklist enable' => 'Enable', 'ipblocklist entries' => 'Entries', 'ipblocklist hits' => 'Total number of blocklist hits for', -- 2.25.1

2 1

[PATCH] ipblocklist.cgi: Theme fix
by Matthias Fischer 15 Jul '22

15 Jul '22

Themes have been dropped - 'ipblocklist.cgi' refused to start. Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/ipblocklist.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/ipblocklist.cgi b/html/cgi-bin/ipblocklist.cgi index 431ff1a37..bb438129c 100644 --- a/html/cgi-bin/ipblocklist.cgi +++ b/html/cgi-bin/ipblocklist.cgi @@ -62,7 +62,7 @@ my %settings = ( # Read all parameters &Header::getcgihash( \%cgiparams); &General::readhash( "${General::swroot}/main/settings", \%mainsettings ); -&General::readhash( "/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color ); +&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color); # Get list of supported blocklists. my @blocklists = &IPblocklist::get_blocklists(); -- 2.25.1

2 1

[PATCH] krb5: Update to 1.20
by Peter Müller 14 Jul '22

14 Jul '22

Please refer to https://web.mit.edu/kerberos/krb5-1.20/ for the release notes of this version. No rootfile changes were necessary. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- lfs/krb5 | 9 +++------ .../krb5-1.18.3_prevent_spurious_text.patch | 18 ------------------ 2 files changed, 3 insertions(+), 24 deletions(-) delete mode 100644 src/patches/krb5-1.18.3_prevent_spurious_text.patch diff --git a/lfs/krb5 b/lfs/krb5 index e08948005..ce7d52d11 100644 --- a/lfs/krb5 +++ b/lfs/krb5 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = Kerberos -VER = 1.19.2 +VER = 1.20 THISAPP = krb5-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 +$(DL_FILE)_BLAKE2 = fdaaab6c16dbe073c4308f312e321536b582b75fad10e5450be66b6b828825c8c775e56f5287d4a7df819d20889e5c0d9cc1d179d861c9caba185332c0db7387 install : $(TARGET) @@ -77,10 +77,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_SRC)/$(THISAPP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) - - cd $(DIR_APP) && patch -Np2 -i $(DIR_SRC)/src/patches/krb5-1.18.3_prevent_spurious_text.patch cd $(DIR_APP) && patch -Np2 -i $(DIR_SRC)/src/patches/krb5-1.18.3_remove_known_failed_test.patch - cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc \ diff --git a/src/patches/krb5-1.18.3_prevent_spurious_text.patch b/src/patches/krb5-1.18.3_prevent_spurious_text.patch deleted file mode 100644 index 0e3015379..000000000 --- a/src/patches/krb5-1.18.3_prevent_spurious_text.patch +++ /dev/null @@ -1,18 +0,0 @@ -Submitted By: linuxfromscratch DOT org -Date: 2020-11-19 -Initial Package Version: 1.18.3 -Origin: http://www.linuxfromscratch.org/blfs/view/svn/postlfs/mitkrb.html -Description: Patch increases the width of the virtual terminal used for some tests to prevent some spurious text in the output which is taken as a failure. - -diff --color -Nur krb5-1.18.3.orig/src/tests/dejagnu/config/default.exp krb5-1.18.3/src/tests/dejagnu/config/default.exp ---- krb5-1.18.3.orig/src/tests/dejagnu/config/default.exp 2020-12-07 04:51:12.997708618 +0100 -+++ krb5-1.18.3/src/tests/dejagnu/config/default.exp 2020-12-07 04:56:29.805839425 +0100 -@@ -12,7 +12,7 @@ - # realm name, defaulting to KRBTEST.COM. - - set timeout 100 --set stty_init {erase \^h kill \^u} -+set stty_init {erase \^h kill \^u cols 300} - set env(TERM) dumb - - set des3_krbtgt 0 -- 2.35.3

1 0

[PATCH] suricata: Update to 5.0.10
by Matthias Fischer 14 Jul '22

14 Jul '22

Changelog: "5.0.10 -- 2022-07-12 Bug #5429: TCP flow that retransmits the SYN with a newer TSval not properly tracked (5.0.x backport) [Note: Therefore 'suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch' could be removed] Bug #5424: inspection of smb traffic without smb/dcerpc doesn't work correct. (5.0.x backport) Bug #5423: DCERPC protocol detection when nested in SMB (5.0.x backport) Bug #5404: detect: will still inspect packets of a "dropped" flow for non-TCP (5.0.x backport) Bug #5388: detect/threshold: offline time handling issue (5.0.x backports) Bug #5358: test failure on Ubuntu 22.04 with GCC 12 (5.0.x backport) Bug #5354: detect/alert: fix segvfault when incrementing discarded alerts if alert-queue-expand fails (5.0.x backport) Bug #5345: CIDR prefix calculation fails on big endian archs (5.0.x backport) Bug #5343: ftp: quadratic complexity for tx iterator with linked list (5.0.x backport) Bug #5341: decode/mime: base64 decoding for data with spaces is broken (5.0.x backport) Bug #5339: PreProcessCommands does not handle all the edge cases (5.0.x backport) Bug #5325: FTP: expectation created in wrong direction (5.0.x backport) Bug #5305: cppcheck: various static analyzer "warning"s Bug #5302: Failed assert DeStateSearchState Bug #5301: eve: payload field randomly missing even if the packet field is present Bug #5289: Remove unneeded stack-on-signal initialization. Bug #5283: 5.0.x: ftp: don't let first incomplete segment be over maximum length Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport) Bug #5113: Off-by-one in flow-manager flow_hash row allocation Bug #5055: Documentation copyright years are invalid Bug #5021: dataset: error with space in rule language Bug #4926: Rule error in SMB dce_iface and dce_opnum keywords (5.0.x backport) Bug #4646: TCP reassembly, failed assert app_progress > last_ack_abs, both sides need to be pruned Optimization #5123: alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport) Optimization #5121: Use configurable or more dynamic @ PACKET_ALERT_MAX@ (5.0.x backport) Task #5322: stats/alert: log out to stats alerts that have been discarded from packet queue (5.0.x backport)" Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/suricata | 5 +- ...-Handle-retransmitted-SYN-with-TSval.patch | 55 ------------------- 2 files changed, 2 insertions(+), 58 deletions(-) delete mode 100644 src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch diff --git a/lfs/suricata b/lfs/suricata index 1ebcb4ba4..1fbc2c185 100644 --- a/lfs/suricata +++ b/lfs/suricata @@ -24,7 +24,7 @@ include Config -VER = 5.0.9 +VER = 5.0.10 THISAPP = suricata-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 02ab99585233a47b1577e55060ba1141c339718e5bd39b6f4d38bb9384fd459aae353f313083048128507f9023a8bcfea3e5a5bcc9ea0c75cfc9c288ca9db6b6 +$(DL_FILE)_BLAKE2 = b5c83b9882e89894c3dedb7f536d584a20bbeab24236752e528171db6589a6308422c8b0be4f433fc63b8cfc227aa0b67935a4aece943b10f4577398ea9ed467 install : $(TARGET) @@ -70,7 +70,6 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-disable-sid-2210059.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/suricata/suricata-5.0.8-fix-level1-cache-line-size-detection.patch cd $(DIR_APP) && LDFLAGS="$(LDFLAGS)" ./configure \ diff --git a/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch b/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch deleted file mode 100644 index 6bc745a0f..000000000 --- a/src/patches/suricata/suricata-5.0-stream-tcp-Handle-retransmitted-SYN-with-TSval.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 511648b3d7a4b5a5b4d55b92dffd63fcb23903a0 Mon Sep 17 00:00:00 2001 -From: Michael Tremer <michael.tremer(a)ipfire.org> -Date: Fri, 19 Nov 2021 17:17:47 +0000 -Subject: [PATCH] stream: tcp: Handle retransmitted SYN with TSval - -For connections that use TCP timestamps for which the first SYN packet -does not reach the server, any replies to retransmitted SYNs will be -tropped. - -This is happening in StateSynSentValidateTimestamp, where the timestamp -value in a SYN-ACK packet must match the one from the SYN packet. -However, since the server never received the first SYN packet, it will -respond with an updated timestamp from any of the following SYN packets. - -The timestamp value inside suricata is not being updated at any time -which should happen. This patch fixes that problem. - -This problem was introduced in 9f0294fadca3dcc18c919424242a41e01f3e8318. - -Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ---- - src/stream-tcp.c | 17 +++++++++++++++++ - 1 file changed, 17 insertions(+) - -diff --git a/src/stream-tcp.c b/src/stream-tcp.c -index 1cff19fa5..af681760b 100644 ---- a/src/stream-tcp.c -+++ b/src/stream-tcp.c -@@ -1641,6 +1641,23 @@ static int StreamTcpPacketStateSynSent(ThreadVars *tv, Packet *p, - "ssn->client.last_ack %"PRIu32"", ssn, - ssn->client.isn, ssn->client.next_seq, - ssn->client.last_ack); -+ } else if (PKT_IS_TOSERVER(p)) { -+ /* -+ * On retransmitted SYN packets, the timestamp value must be updated, -+ * to avoid dropping any SYN+ACK packets that respond to a retransmitted SYN -+ * with an updated timestamp in StateSynSentValidateTimestamp. -+ */ -+ if ((ssn->client.flags & STREAMTCP_STREAM_FLAG_TIMESTAMP) && TCP_HAS_TS(p)) { -+ uint32_t ts_val = TCP_GET_TSVAL(p); -+ -+ // Check whether packets have been received in the correct order (only ever update) -+ if (ssn->client.last_ts < ts_val) { -+ ssn->client.last_ts = ts_val; -+ ssn->client.last_pkt_ts = p->ts.tv_sec; -+ } -+ -+ SCLogDebug("ssn %p: Retransmitted SYN. Updated timestamp from packet %"PRIu64, ssn, p->pcap_cnt); -+ } - } - - /** \todo check if it's correct or set event */ --- -2.30.2 - -- 2.25.1

3 2

[PATCH] collectd: Do not keep track of entropy any more
by Peter Müller 13 Jul '22

13 Jul '22

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/collectd/collectd.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/config/collectd/collectd.conf b/config/collectd/collectd.conf index e34a97da1..4ef34ea07 100644 --- a/config/collectd/collectd.conf +++ b/config/collectd/collectd.conf @@ -16,7 +16,6 @@ LoadPlugin conntrack LoadPlugin cpu #LoadPlugin cpufreq LoadPlugin disk -LoadPlugin entropy LoadPlugin interface LoadPlugin iptables LoadPlugin load -- 2.35.3

1 0

[PATCH] util-linux: Do not ship broken symlink "/usr/bin/x86_64"
by Peter Müller 12 Jul '22

12 Jul '22

This file points to /usr/bin/setarch, which we do not ship on any architecture. As it serves no obvious purpose on IPFire installations, we may as well not ship it entirely. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/common/x86_64/util-linux | 2 +- config/rootfiles/core/170/update.sh | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/common/x86_64/util-linux b/config/rootfiles/common/x86_64/util-linux index bd862b557..de78f65c2 100644 --- a/config/rootfiles/common/x86_64/util-linux +++ b/config/rootfiles/common/x86_64/util-linux @@ -103,7 +103,7 @@ usr/bin/uclampset usr/bin/uuidgen usr/bin/uuidparse #usr/bin/whereis -usr/bin/x86_64 +#usr/bin/x86_64 #usr/include/blkid #usr/include/blkid/blkid.h #usr/include/libfdisk diff --git a/config/rootfiles/core/170/update.sh b/config/rootfiles/core/170/update.sh index e3f93df57..5d8903189 100644 --- a/config/rootfiles/core/170/update.sh +++ b/config/rootfiles/core/170/update.sh @@ -57,6 +57,7 @@ rm -rvf \ /sbin/ifcfg \ /sbin/routef \ /sbin/rtpr \ + /usr/bin/x86_64 \ /usr/lib/libbfd-2.36.* \ /usr/lib/libbind9-9.16.2* \ /usr/lib/libdnet* \ -- 2.35.3

3 7

[PATCH] Core Update 169: Regenerate initrds and save space on ARM
by Peter Müller 12 Jul '22

12 Jul '22

https://community.ipfire.org/t/again-with-the-file-system-full-core-169/8186 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/core/169/update.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/config/rootfiles/core/169/update.sh b/config/rootfiles/core/169/update.sh index 3902e2d45..50f0bd8a4 100644 --- a/config/rootfiles/core/169/update.sh +++ b/config/rootfiles/core/169/update.sh @@ -150,6 +150,19 @@ ldconfig # Apply sysctl changes /etc/init.d/sysctl start +# Regenerate all initrds +dracut --regenerate-all --force +case "$(uname -m)" in + armv*) + mkimage -A arm -T ramdisk -C lzma -d /boot/initramfs-${KVER}-ipfire.img /boot/uInit-${KVER}-ipfire + rm /boot/initramfs-${KVER}-ipfire.img + ;; + aarch64) + mkimage -A arm64 -T ramdisk -C lzma -d /boot/initramfs-${KVER}-ipfire.img /boot/uInit-${KVER}-ipfire + # dont remove initramfs because grub need this to boot. + ;; +esac + # Start services telinit u /etc/init.d/firewall restart -- 2.35.3

4 16

CONFIG_DRM_LEGACY
by Peter Müller 12 Jul '22

12 Jul '22

Hello development folks, recently, it has been flagged to me that we ship our kernels with CONFIG_DRM_LEGACY enabled. The documentation to this reads: > Enable legacy DRI1 drivers. Those drivers expose unsafe and dangerous > APIs to user-space, which can be used to circumvent access > restrictions and other security measures. For backwards compatibility > those drivers are still available, but their use is highly > inadvisable and might harm your system. > > You are recommended to use the safe modeset-only drivers instead, and > perform 3D emulation in user-space. > > Unless you have strong reasons to go rogue, say "N". Because of the kernel released on July 7 and its fixes to ASIX USB-to-Ethernet adapters, I am currently working on that sector of IPFire 2.x anyway. Unless somebody of you can recall why we really need to have CONFIG_DRM_LEGACY enabled, I would submit a patch disabling it - its documentation does not inspire confidence at all. :-) Thanks, and best regards, Peter Müller

3 2

[PATCH] unbound: Update to 1.16.1
by Matthias Fischer 12 Jul '22

12 Jul '22

For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-16-1 "Features Fix #704: [FR] Statistics counter for number of outgoing UDP queries sent; introduces 'num.query.udpout' to the 'unbound-control stats' command. Bug Fixes makedist.sh picks up 32bit libssp-0.dll when 32bit compile. Fix for edns client subnet to respect not looking in its cache when instructed to do so (e.g., prefetch). Merge PR #688: Rpz url notify issue. Note in the unbound.conf text that NOTIFY is allowed from the 'url:' addresses for auth and rpz zones. Remove unused LDNS function check for GOST Engine unloading. Fix for loading locally stored zones that have lines with blanks or blanks and comments. Fix #663: use after free issue with edns options. Clarify -v flag manpage entry (#705) Fix test program dohclient close to use portability routine. Show the output of the exact .rpl run that failed with 'make test'. Fix for cached 0 TTL records to not trigger prefetching when serve-expired-client-timeout is set. Add debug option to the mini_tdir.sh test code. Fix to not count cached NXDOMAIN for MAX_TARGET_NX. Allow fallback to the parent side when MAX_TARGET_NX is reached. This will also allow MAX_TARGET_NX more NXDOMAINs. iana portlist update. Fix detection of libz on windows compile with static option. Fix compile warning for windows compile. Merge PR #706: NXNS fallback. From #706: Cached NXDOMAIN does not increase the target nx responses. From #706: Don't generate parent side queries if we already have the lame records in cache. From #706: When a lame address is the best choice, don't try to generate target queries when the missing targets are all lame. Merge PR #671 from Petr Menšík: Disable ED25519 and ED448 in FIPS mode on openssl3. Merge PR #660 from Petr Menšík: Sha1 runtime insecure. For #660: formatting, less verbose logging, add EDE information. Fix for correct openssl error when adding windows CA certificates to the openssl trust store. Improve val_sigcrypt.c::algo_needs_missing for one loop pass. Reintroduce documentation and more EDE support for val_sigcrypt.c::dnskeyset_verify_rrset_sig. Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing for one loop pass'. Merge PR #668 from Cristian Rodríguez: Set IP_BIND_ADDRESS_NO_PORT on outbound tcp sockets." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index cb9145516..20fe72a57 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.16 +usr/lib/libunbound.so.8.1.17 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 938d3b46e..539ea5005 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.16.0 +VER = 1.16.1 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 62d002e66a24d60a973c620855d9d33e2833f78bf45d9176081646683fe6f371564a40fb637e4b276c556e3b46eb57ff49ee6a7300e9a9e24cb09f4b8dd31695 +$(DL_FILE)_BLAKE2 = 722e2d88f66f35459b71cd339f451bf803c836827f9f74540c4ae500b7f682f0e8c89bda34915fb8df289cc524486fab2a04018717e1ae7ad62006be68af1cad install : $(TARGET) -- 2.25.1

2 1

[PATCH] linux: Give CONFIG_RANDOMIZE_BASE on aarch64 another try
by Peter Müller 12 Jul '22

12 Jul '22

Quoted from https://capsule8.com/blog/kernel-configuration-glossary/: > Significance: Critical > > In support of Kernel Address Space Layout Randomization (KASLR) this randomizes > the physical address at which the kernel image is decompressed and the virtual > address where the kernel image is mapped as a security feature that deters > exploit attempts relying on knowledge of the location of kernel code internals. We tried to enable this back in 2020, and failed. Since then, things may have been improved, so let's give this low-hanging fruit another try. Fixes: #12363 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 469884b20..9232335ff 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -471,7 +471,7 @@ CONFIG_ARM64_SVE=y CONFIG_ARM64_MODULE_PLTS=y # CONFIG_ARM64_PSEUDO_NMI is not set CONFIG_RELOCATABLE=y -# CONFIG_RANDOMIZE_BASE is not set +CONFIG_RANDOMIZE_BASE=y CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y CONFIG_STACKPROTECTOR_PER_TASK=y # end of Kernel Features diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 906fde0c3..af96753fc 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -9427,6 +9427,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/RAID6_PQ #lib/modules/KVER-ipfire/build/include/config/RAID6_PQ_BENCHMARK #lib/modules/KVER-ipfire/build/include/config/RAID_ATTRS +#lib/modules/KVER-ipfire/build/include/config/RANDOMIZE_BASE #lib/modules/KVER-ipfire/build/include/config/RANDOMIZE_KSTACK_OFFSET_DEFAULT #lib/modules/KVER-ipfire/build/include/config/RAS #lib/modules/KVER-ipfire/build/include/config/RASPBERRYPI_FIRMWARE -- 2.35.3

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2022