Development May 2023

development@lists.ipfire.org

9 participants
44 discussions

[PATCH] diffutils: Update to version 3.9
by Adolf Belka 18 May '23

18 May '23

- Update from version 3.8 to 3.9 - Update of rootfile not required - Changelog version 3.9 * NEWS: Record release date. build: update gnulib to latest 2023-01-05 Jim Meyering <meyering(a)fb.com> tests: avoid large-subopt XPASS on systems without perl * tests/large-subopt: Use $PERL, rather than hard-coding "perl". * bootstrap.conf (gnulib_modules): Add "perl" to the list. Reported by Bruno Haible in https://lists.gnu.org/r/diffutils-devel/2023-01/msg00000.html 2023-01-05 Bruno Haible <bruno(a)clisp.org> tests: avoid a test failure when using Solaris 11.4's old grep * tests/colors (nanosecond_zeros): Use a dumbed-down grep '\.' in place of "grep -F ." to accommodate Solaris 11.4's old versions of grep in the default PATH. Reported here: https://lists.gnu.org/r/diffutils-devel/2023-01/msg00001.html 2023-01-01 Jim Meyering <meyering(a)fb.com> build: update gnulib to latest maint: update copyright dates 2022-12-31 Paul Eggert <eggert(a)cs.ucla.edu> build: simplify GCC 12 false alarm workaround * src/util.c (print_message_queue): Pacify GCC in a more-straightforward way. maint: fix assumption typo Fix a typo I introduced in my August 2021 signal handling fixes. Problem reported by Sam James (Bug#60457). * src/util.c (xsigismember): Don’t assume sigismember cannot return 0. 2022-12-30 Jim Meyering <meyering(a)fb.com> build: update gnulib to latest build: temp?-disable -Wanalyzer-use-of-uninitialized-value * src/util.c (print_message_queue): This function triggers false positive warnings from GCC12, so add pragmas to ignore that new warning in this one function. Required when using either of these: - gcc version 12.2.1 20221121 - gcc version 13.0.0 20221229 (experimental) 2022-12-11 Jim Meyering <meyering(a)fb.com> build: update gnulib to latest 2022-11-12 Jim Meyering <meyering(a)fb.com> build: update gnulib to latest 2022-02-14 Paul Eggert <eggert(a)cs.ucla.edu> doc: mark up SEE ALSO (Bug#53976) 2022-01-24 Jim Meyering <meyering(a)fb.com> tests: fix false-failure on systems without valgrind * tests/init.cfg (require_valgrind_): Use exit status of subshell, not that of the "local" declaration. 2022-01-14 Paul Eggert <eggert(a)cs.ucla.edu> build: update gnulib submodule to latest 2022-01-03 Jim Meyering <meyering(a)fb.com> maint: avoid new syntax-check failure * cfg.mk (local-checks-to-skip): Add sc_indent, to skip it. Otherwise, "make syntax-check" would fail. maint: make update-copyright build: update gnulib to latest; also bootstrap and init.sh 2021-10-30 Paul Eggert <eggert(a)cs.ucla.edu> maint: modernize README-{hacking,prereq} 2021-10-16 Paul Eggert <eggert(a)cs.ucla.edu> doc: copy fdl.texi into git This pacifies this notice from ./bootstrap: “Notice from module fdl: Don't use this module! Instead, copy the referenced license file into your version control repository.” * bootstrap.conf (gnulib_modules): Remove fdl. * doc/fdl.texi: New file, taken from Gnulib. maint: direct dependency on time_rz now Now that diff calls tzalloc, it depends directly on time_rz. * bootstrap.conf (gnulib_modules): Add time_rz. build: update gnulib submodule to latest 2021-10-15 Paul Eggert <eggert(a)cs.ucla.edu> diff: fix timezone bug on Solaris Problem reported by Vladimir Marek (bug#51228). * NEWS: Mention this. * src/context.c (print_context_label): Pass localtz to nstrftime, instead of always passing 0. * src/diff.c (main) [!HAVE_TM_GMTOFF]: Initialize localtz if time_format uses %z. * src/diff.h (localtz): New decl. * tests/Makefile.am (TESTS): Add timezone. * tests/timezone: New test. 2021-08-31 Paul Eggert <eggert(a)cs.ucla.edu> diff3: port better to MS-Windows * src/diff3.c (enum diff_type): Prefix constants like ADD with "DIFF_" to avoid collisions with unwise system headers. 2021-08-30 Paul Eggert <eggert(a)cs.ucla.edu> maint: port better to non-POSIX Problem privately reported by Gisle Vanem for MS-Windows. * src/util.c (sig, install_signal_handlers): Don’t assume SIGTSTP, SIGALRM, SIGQUIT. (is_tstp_index): New function, for use in SIGTSTP avoidance. maint: prefer attribute.h attributes Prefer the macros used in attribute.h, and _Noreturn, to the by-hand use of __attribute__, as this is more portable. * bootstrap.conf (gnulib_modules): Add attribute. * src/system.h: Include attribute.h. All uses of attributes changed to use the attribute.h macros. Plus, use _Noreturn. (FALLTHROUGH): Remove; attribute.h now defines this. build: update gnulib submodule to latest diff: avoid double translation * src/analyze.c (briefly_report): Do not translate here, as ‘message’ translates its format. diff: use variable arg list for messages This simplifies the code by using varargs. * bootstrap.conf (gnulib_modules): Add flexmember. (XGETTEXT_OPTIONS): Do not flag message5. * src/util.c: Include flexmember.h, stdarg.h. (struct msg): New members msgid, argbytes. args is now FLEXIBLE_ARRAY_MEMBER, and does not contain msgid. All uses changed. (message): Now varargs. Detect number of args by counting '%'s. Use FLEXSIZEOF, to avoid problems on systems with buggy allocators. Avoid redundant ‘*p = 0’ when *p is already zero after stpcpy. (message5): Remove; all callers changed to use ‘message’. (print_message_queue): Abort if too many args were passed; this cannot happen with current diffutils. 2021-08-29 Paul Eggert <eggert(a)cs.ucla.edu> diff: port better to MS-Windows Problem reported by Gisle Vanem (Bug#36488#30). * src/util.c (xsigaction) [SA_NOCLDSTOP]: Remove; no longer needed. (install_signal_handlers): If the first call to sigaction or signal fails, do not exit; just skip the signal and continue, in case the runtime does not support the signal even though the corresponding SIG* macro is defined. 2021-08-28 Paul Eggert <eggert(a)cs.ucla.edu> diff: cleanup signal handling just before exit This should fix an unlikely signal handling bug with colored output, and should also fix a Debian FTBFS (Fails To Build From Source) on powerpc64le-linux. See Bug#34519 and Frédéric Bonnard’s report in: https://bugs.debian.org/922552#19 * bootstrap.conf (gnulib_modules): Add raise, sigprocmask. * src/diff.c (main): Call cleanup_signal_handlers before exiting. Don’t bother calling ‘exit’; no longer needed nowadays. * src/util.c (sigprocmask, siginterrupt) [!SA_NOCLDSTOP]: Define to 0 instead of empty, since the results are now used. (sigset_t) [!SA_NOCLDSTOP]: Remove; we now rely on Gnulib. (xsigaction) [SA_NOCLDSTOP]: New function. (xsigaddset, xsigismember, xsignal, xsigprocmask): New functions. (some_signals_caught): New static var. (process_signals): Omit a conditional branch. Don’t bother loading interrupt_signal if stop_signal_count is nonzero. (process_signals, install_signal_handlers): Check for failures from sigprocmask etc. (sig, nsig): Now at top level, since multiple functions need them. (install_signal_handlers): No need for caught_sig array; just use caught_signals. However, set some_signals_caught. (cleanup_signal_handlers): New function. 2021-08-22 Paul Eggert <eggert(a)cs.ucla.edu> diff: add integer overflow checking * src/diff.c (option_list, main): Check for integer overflow in some unlikely and hard-to-test cases. maint: refactor integer overflow checking Rely on more-modern Gnulib capabilities instead of doing integer overflow checking by hand, in some cases. * lib/cmpbuf.c (buffer_lcm): * src/io.c (slurp, find_identical_ends): Use INT_ADD_WRAPV and INT_MULTIPLY_WRAPV rather than checking overflow by hand. * src/diff3.c (process_diff): * src/dir.c (dir_read): * src/io.c (find_identical_ends, read_files): Use xnmalloc rather than checking overflow by hand. (read_files): Rely on xcalloc to do overflow checking. diff: avoid sprintf %s sprintf fails if the result contains more than INT_MAX bytes, so rework the code to avoid usage of sprintf %s where the string might be longer than that. * bootstrap.conf (gnulib_modules): Remove xvasprintf. * src/diff.c (specify_style): * src/util.c (begin_output): Rewrite to avoid sprintf %s. * src/util.c: Do not include xvasprintf.h. (concat): Remove, as it uses sprintf %s. All uses rewritten. diff: use mempcpy * bootstrap.conf (gnulib_modules): Add mempcpy, stpcpy. * src/ifdef.c (do_printf_spec): * src/sdiff.c (expand_name, lf_snarf, temporary_file): * src/util.c (message5): Prefer mempcpy to memcpy plus manual size-updating. Prefer stpcpy to mempcpy plus manual size-spec. sdiff: fix unlikely memory leak * src/sdiff.c (temporary_file): Fix memory leak when mkstemp fails. Don’t assume temporary file name length fits in ‘int’. diff3: simplify process_diff * src/diff3.c (process_diff): Remove LAST_BLOCK arg, since callers no longer needed it. All callers changed. This removes an unnecessary initialization of bptr to NULL. maint: modernize IF_LINT for GCC 11.2.1 * src/cmp.c (cmp): * src/dir.c (find_dir_file_pathname): * src/sdiff.c (edit): Mention which GCC bug this IF_LINT works around. * src/diff3.c (process_diff): Always initialize to NULL, to avoid problems on mostly-theoretical hosts where accessing uninitialized variables traps. The next patch will have a better fix for this. * src/ifdef.c (do_printf_spec): No need for IF_LINT in GCC 11.2.1. maint: lint → GCC_LINT ‘lint’ is for traditional lint and perhaps some other tools; ‘GCC_LINT’ is targeted more for what we do. Gnulib accepts either, but we might as well be more accurate. * configure.ac (GCC_LINT): Define this instead of ‘lint’. All uses changed. diff: remove printint * src/system.h (printint): Remove. All uses removed. This type was only for porting to pre-C89 hosts, and is no longer needed. diff: remove INT_MAX limit on -F/-p searches * src/context.c (find_function): Don’t limit function-line searches to INT_MAX bytes, removing a FIXME. maint: .gitignore updates * .gitignore: Remove lib/unused-parameter.h. Add all of m4, since no files there need to be committed; this lets us remove m4/.gitignore and m4/gnulib-cache.m4. Add *.orig, *.patch, .Tpo, /*.diff, lib/*/ (which lets us remove /lib/sys/), lib/ctype.h, lib/errno.h, lib/float.h, lib/fnmatch.h, lib/getopt-cdefs.h, lib/getopt.h, lib/limits.h, lib/sigsegv.h, lib/stdalign.h, lib/stdarg.h, lib/stdbool.h, lib/stddef.h, lib/stdint.h, lib/stdopen.[ch], vc-dwim-log-*. Add slashes to autom4te.cache, build-aux. Remove redundant initial slashes from patterns that also have internal slashes. Remove plain ABOUT-NLS, since /ABOUT-NLS suffices. Sort using LC_ALL=C. maint: omit unused function if not debugging * src/util.c (debug_script): Compile only if DEBUG. maint: remove prepargs * lib/Makefile.am (noinst_HEADERS): Remove prepargs.h. (libdiffutils_a_SOURCES): Remove prepargs.c. * lib/prepargs.c, lib/prepargs.h: Remove. Hasn’t been needed for many years. * src/diff.c: Do not include prepargs.h. maint: zalloc → xzalloc * src/util.c (zalloc): Remove. All uses replaced by xzalloc, which means the same thing. 2021-08-22 Paul Eggert <eggert(a)cs.ucla.edu> diff3: suppress -fanalyzer alarms * src/diff3.c: Add pragma to suppress -Wanalyzer-null-dereference alarms. * src/diff.h (find_dir_file_pathname): Add malloc-related attributes, to pacify gcc -Wsuggest-attribute=malloc. 2021-08-22 Paul Eggert <eggert(a)cs.ucla.edu> maint: remove January workaround for Gnulib issue * configure.ac: Don’t add -Wno-analyzer-null-argument, since the issue is now fixed in Gnulib. build: update gnulib submodule to latest 2021-08-01 Paul Eggert <eggert(a)cs.ucla.edu> maint: remove stray init.cfg * init.cfg: Remove. I guess this file was a stray, since it was a copy of tests/init.cfg when it was checked in, and it hasn’t been maintained since. tests: port to valgrind 3.16.0 + GCC 11.2 * tests/init.cfg (stderr_fileno_): Reject valgrind if it reports a "Serious error" on a trival use of ‘diff’. Without this patch, on RHEL 8.4 when I compile diffutils with a GCC 11.2.0 that I built myself, ‘valgrind diff’ spits out messages like WARNING: Serious error when reading debug info / When reading debug info from diff: Ignoring non-Dwarf2/3/4 block in .debug_info’ and this causes the strip-trailing-cr test to fail. I guess valgrind complains because the valgrind version 3.16.0 that came with RHEL 8.4 cannot grok the debug entries generated by GCC 11.2.0. 2021-08-01 Jim Meyering <meyering(a)fb.com> maint: post-release administrivia * NEWS: Add header line for next release. * .prev-version: Record previous version. * cfg.mk (old_NEWS_hash): Auto-update. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/diffutils | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/diffutils b/lfs/diffutils index b3dab42ca..7fdfb5d87 100644 --- a/lfs/diffutils +++ b/lfs/diffutils @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 3.8 +VER = 3.9 THISAPP = diffutils-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -47,7 +47,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 573abbfba55c62ba30d2084ca68860e9681cfe92648407f7fb04e1aaed2e4719e2fb5a29cf25bd125d762f4dfd52f85ee91f2ec19b099365bada7fe27a0394af +$(DL_FILE)_BLAKE2 = d43ed9f1643ac46b69083755974fc9611ad00c3b98b08332c681223d17d762567562233b51342a16f7dad8f28dfc5536999143594e33a64e6624001a71787c8f install : $(TARGET) -- 2.40.1

1 10

[PATCH 1/7] python3-trio: Fixes Bug#13076 - allows fuse mount to work again
by Adolf Belka 17 May '23

17 May '23

- In Core 173 python3-trio was updated to version 0.22.0 when python was upgraded to 3.10.8 Although the build of python3-trio was successful it was missed that there was a new run-time dependency of python3-exceptiongroup for python3-pyfuse3 to work. python2-flit_scm is required as a build dependency for python3-exceptiongroup. - The modified packages were installed in my vm testbed and confirmed that borg mount then worked again. - It was also noted that python3-attr was no longer needed neither as a runtime dependency nor as a build time dependency. - Dependencies line of python3-trio updated for these two changes. Fixes: Bug#13076 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/python3-trio | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/python3-trio b/lfs/python3-trio index 2cae4bcf6..49f1207ab 100644 --- a/lfs/python3-trio +++ b/lfs/python3-trio @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -33,9 +33,9 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = python3-trio -PAK_VER = 2 +PAK_VER = 3 -DEPS = python3-attr python3-async_generator python3-attrs python3-sniffio python3-sortedcontainers python3-outcome python3-idna +DEPS = python3-async_generator python3-attrs python3-sniffio python3-sortedcontainers python3-outcome python3-idna python3-exceptiongroup SERVICES = -- 2.40.1

1 7

[PATCH 1/5] ovpnmain.cgi: Fix for bug#11048 - insecure download icon shown for connections with a password
by Adolf Belka 17 May '23

17 May '23

- The insecure package download icon is shown if entry 41 in /var/ipfire/ovpn/ovpnconfig is set to no-pass. The code block on ovpnmain.cgi that deals with this checks if the connection is a host and if the first password entry is a null. Then it adds no-pass to ovpnconfig. - The same block of code is also used for when he connection is edited. However at this stage the password entry is back to null because the password value is only kept until the connection has been saved. Therefore doing an edit results in the password value being taken as null even for connections with a password. - This fix enters no-pass if the connection type is host and the password is null, pass if the connection type is host and the password has characters. If the connection type is net then no-pass is used as net2net connections dop not have encrypted certificates. - The code has been changed to show a different icon for unencrypted and encrypted certificates. - Separate patches are provided for the language file change, the provision of a new icon and the code for the update.sh script for the Core Update to update all existing connections, if any exist, to have either pass or no-pass in index 41. - This patch set was a joint collaboration between Erik Kapfer and Adolf Belka - Patch set, including the code for the Core Update 175 update.sh script has been tested on a vm testbed Fixes: Bug#11048 Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Tested-by: Erik Kapfer <ummeegge(a)ipfire.org> Suggested-by: Adolf Belka <adolf.belka(a)ipfire.org> Suggested-by: Erik Kapfer <ummeegge(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/ovpnmain.cgi | 72 +++++++++++++++++++++++---------------- 1 file changed, 42 insertions(+), 30 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 51d6e8431..50ad21e79 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -4327,8 +4327,14 @@ if ($cgiparams{'TYPE'} eq 'net') { $confighash{$key}[39] = $cgiparams{'DAUTH'}; $confighash{$key}[40] = $cgiparams{'DCIPHER'}; - if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) { - $confighash{$key}[41] = "no-pass"; + if ($confighash{$key}[41] eq "") { + if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) { + $confighash{$key}[41] = "no-pass"; + } elsif (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} ne "")) { + $confighash{$key}[41] = "pass"; + } elsif ($cgiparams{'TYPE'} eq 'net') { + $confighash{$key}[41] = "no-pass"; + } } $confighash{$key}[42] = 'HOTP/T30/6'; @@ -5470,20 +5476,24 @@ END } - print <<END; - <td align='center' $col1>$active</td> + if ($confighash{$key}[41] eq "pass") { + print <<END; + <td align='center' $col1>$active</td> - <form method='post' name='frm${key}a'><td align='center' $col> - <input type='image' name='$Lang::tr{'dl client arch'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' /> - <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' /> - <input type='hidden' name='KEY' value='$key' /> - </td></form> + <form method='post' name='frm${key}a'><td align='center' $col> + <input type='image' name='$Lang::tr{'dl client arch'}' src='/images/openvpn_encrypted.png' + alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' /> + <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' /> + <input type='hidden' name='MODE' value='secure' /> + <input type='hidden' name='KEY' value='$key' /> + </td></form> END - ; - if ($confighash{$key}[41] eq "no-pass") { + ; } elsif ($confighash{$key}[41] eq "no-pass") { print <<END; - <form method='post' name='frm${key}g'><td align='center' $col> + <td align='center' $col1>$active</td> + + <form method='post' name='frm${key}a'><td align='center' $col> <input type='image' name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' /> <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' /> @@ -5491,7 +5501,7 @@ END <input type='hidden' name='KEY' value='$key' /> </td></form> END - } else { + ; } else { print "<td $col> </td>"; } @@ -5567,30 +5577,32 @@ END # If the config file contains entries, print Key to action icons if ( $id ) { print <<END; - <table border='0'> - <tr> + <table width='85%' border='0'> + <tr> <td class='boldbase'>  <b>$Lang::tr{'legend'}:</b></td> - <td>  <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td> - <td class='base'>$Lang::tr{'click to disable'}</td> + <td>    <img src='/images/openvpn.png' alt='?RELOAD'/></td> + <td class='base'>$Lang::tr{'dl client arch insecure'}</td> + <td>    <img src='/images/openvpn_encrypted.png' alt='?RELOAD'/></td> + <td class='base'>$Lang::tr{'dl client arch'}</td> <td>    <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td> <td class='base'>$Lang::tr{'show certificate'}</td> + <td>    <img src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}'/></td> + <td class='base'>$Lang::tr{'show otp qrcode'}</td> + </tr> + <tr> + <td>  </td> + <td>    <img src='/images/media-floppy.png' alt='?FLOPPY' /></td> + <td class='base'>$Lang::tr{'download certificate'}</td> + <td>  <img src='/images/off.gif' alt='?OFF' /></td> + <td class='base'>$Lang::tr{'click to enable'}</td> + <td>  <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td> + <td class='base'>$Lang::tr{'click to disable'}</td> <td>    <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td> <td class='base'>$Lang::tr{'edit'}</td> <td>    <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td> <td class='base'>$Lang::tr{'remove'}</td> - </tr> - <tr> - <td>  </td> - <td>  <img src='/images/off.gif' alt='?OFF' /></td> - <td class='base'>$Lang::tr{'click to enable'}</td> - <td>    <img src='/images/media-floppy.png' alt='?FLOPPY' /></td> - <td class='base'>$Lang::tr{'download certificate'}</td> - <td>    <img src='/images/openvpn.png' alt='?RELOAD'/></td> - <td class='base'>$Lang::tr{'dl client arch'}</td> - <td>    <img src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}'/></td> - <td class='base'>$Lang::tr{'show otp qrcode'}</td> - </tr> - </table><br> + </tr> + </table><br> END ; } -- 2.40.1

1 4

[PATCH] dracut: lower ram usage at commpression
by Arne Fitzenreiter 17 May '23

17 May '23

this lower the compression ratio sligtly (the ramdlisk is 100kb larger) and use only a single thread now. (it's still faster than before on a dual core.) Note to Peter: if there are no other changes on dracut ship only /usr/lib/dracut/dracut.conf.d/ipfire.conf at core update. fixes: #13091 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/dracut/ipfire.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/dracut/ipfire.conf b/config/dracut/ipfire.conf index bab5c8a2e..5a4f0aa7c 100644 --- a/config/dracut/ipfire.conf +++ b/config/dracut/ipfire.conf @@ -2,4 +2,4 @@ early_microcode="yes" # Compress using Zstandard -compress="zstd" +compress="zstd -10 -q -T1" -- 2.34.1

2 1

[PATCH] kernel: update to 6.1.28
by Arne Fitzenreiter 16 May '23

16 May '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/aarch64/linux | 2 +- config/rootfiles/common/x86_64/linux | 2 +- lfs/linux | 10 +- ...md-Fix-pmc-compile-dependency-errors.patch | 63 --------- ...ter_nftables_deactivate_anonymus_set.patch | 121 ------------------ 7 files changed, 6 insertions(+), 196 deletions(-) delete mode 100644 src/patches/linux/linux-6.0.7-platform-x86-amd-Fix-pmc-compile-dependency-errors.patch delete mode 100644 src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index 74ff773df..87167cd65 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.27-ipfire Kernel Configuration +# Linux/arm64 6.1.28-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index c8985b482..b30bbd1ec 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.27-ipfire Kernel Configuration +# Linux/x86 6.1.28-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0" CONFIG_CC_IS_GCC=y diff --git a/config/rootfiles/common/aarch64/linux b/config/rootfiles/common/aarch64/linux index 5809aa02b..cfadb4427 100644 --- a/config/rootfiles/common/aarch64/linux +++ b/config/rootfiles/common/aarch64/linux @@ -15914,7 +15914,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/sound/ac97/regs.h #lib/modules/KVER-ipfire/build/include/sound/ac97_codec.h #lib/modules/KVER-ipfire/build/include/sound/aci.h -#lib/modules/KVER-ipfire/build/include/sound/acp62_chip_offset_byte.h +#lib/modules/KVER-ipfire/build/include/sound/acp63_chip_offset_byte.h #lib/modules/KVER-ipfire/build/include/sound/ad1816a.h #lib/modules/KVER-ipfire/build/include/sound/ad1843.h #lib/modules/KVER-ipfire/build/include/sound/adau1373.h diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index 6262f5e57..0300e7779 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -16002,7 +16002,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/sound/ac97/regs.h #lib/modules/KVER-ipfire/build/include/sound/ac97_codec.h #lib/modules/KVER-ipfire/build/include/sound/aci.h -#lib/modules/KVER-ipfire/build/include/sound/acp62_chip_offset_byte.h +#lib/modules/KVER-ipfire/build/include/sound/acp63_chip_offset_byte.h #lib/modules/KVER-ipfire/build/include/sound/ad1816a.h #lib/modules/KVER-ipfire/build/include/sound/ad1843.h #lib/modules/KVER-ipfire/build/include/sound/adau1373.h diff --git a/lfs/linux b/lfs/linux index a95c6aea4..989c51189 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.1.27 +VER = 6.1.28 ARM_PATCHES = 6.1.y-ipfire2 @@ -76,7 +76,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 5d7ec9a6a2652abbe4afb70174a63f58d495291d522087f9adb33864063ce54e219fd6e426793077a346338ccb4d9d753a60cb76b448146fb592ff17c2618792 +$(DL_FILE)_BLAKE2 = f840274d9e1c5af90292bce6afb8b8b1a81b4f8ef82691a1cf28ca2d6cf680913c2668ddb086e1fa4ba4112e9d8118a674231374c14a06a911ddb3d2cf8ac3fb arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) @@ -144,12 +144,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Fix external module compile cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-6.0-fix_external_module_build.patch - # Fix pmc compile dependency errors - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-6.0.7-platform-x86-amd-Fix-pmc-compile-dependency-errors.patch - - # Patch netfilter CVE-2023-32233 - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch - ifeq "$(BUILD_ARCH)" "aarch64" # Apply Arm-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1 diff --git a/src/patches/linux/linux-6.0.7-platform-x86-amd-Fix-pmc-compile-dependency-errors.patch b/src/patches/linux/linux-6.0.7-platform-x86-amd-Fix-pmc-compile-dependency-errors.patch deleted file mode 100644 index d890c24c0..000000000 --- a/src/patches/linux/linux-6.0.7-platform-x86-amd-Fix-pmc-compile-dependency-errors.patch +++ /dev/null @@ -1,63 +0,0 @@ -From: Yupeng Li <liyupeng(a)zbhlos.com> -To: Shyam-sundar.S-k(a)amd.com, hdegoede(a)redhat.com, markgross(a)kernel.org -Cc: platform-driver-x86(a)vger.kernel.org, linux-kernel(a)vger.kernel.org, - caizp2008(a)163.com, Yupeng Li <liyupeng(a)zbhlos.com> -Subject: [PATCH 1/1] platform/x86/amd: Fix pmc compile dependency errors. -Date: Wed, 26 Oct 2022 15:25:31 +0800 - -When disabled CONFIG_SUSPEND and CONFIG_DEBUG_FS, get_metrics_table -and amd_pmc_idlemask_read is defined under two conditions of this, -pmc build with implicit declaration of function error.Some build error -messages are as follows: - - CC [M] drivers/platform/x86/amd/pmc.o -drivers/platform/x86/amd/pmc.c: In function ‘smu_fw_info_show’: -drivers/platform/x86/amd/pmc.c:436:6: error: implicit declaration of function ‘get_metrics_table’ [-Werror=implicit-function-declaration] - 436 | if (get_metrics_table(dev, &table)) - | ^~~~~~~~~~~~~~~~~ -drivers/platform/x86/amd/pmc.c: In function ‘amd_pmc_idlemask_show’: -drivers/platform/x86/amd/pmc.c:508:8: error: implicit declaration of function ‘amd_pmc_idlemask_read’; did you mean ‘amd_pmc_idlemask_show’? [-Werror=implicit-function-declaration] - 508 | rc = amd_pmc_idlemask_read(dev, NULL, s); - | ^~~~~~~~~~~~~~~~~~~~~ - | amd_pmc_idlemask_show -cc1: some warnings being treated as errors - -Signed-off-by: Yupeng Li <liyupeng(a)zbhlos.com> -Reviewed-by: Caicai <caizp2008(a)163.com> ---- - drivers/platform/x86/amd/pmc.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/platform/x86/amd/pmc.c b/drivers/platform/x86/amd/pmc.c -index ce859b300712..2b08039921b8 100644 ---- a/drivers/platform/x86/amd/pmc.c -+++ b/drivers/platform/x86/amd/pmc.c -@@ -433,8 +433,10 @@ static int smu_fw_info_show(struct seq_file *s, void *unused) - struct smu_metrics table; - int idx; - -+#if defined(CONFIG_SUSPEND) || defined(CONFIG_DEBUG_FS) - if (get_metrics_table(dev, &table)) - return -EINVAL; -+#endif - - seq_puts(s, "\n=== SMU Statistics ===\n"); - seq_printf(s, "Table Version: %d\n", table.table_version); -@@ -503,11 +505,12 @@ static int amd_pmc_idlemask_show(struct seq_file *s, void *unused) - if (rc) - return rc; - } -- - if (dev->major > 56 || (dev->major >= 55 && dev->minor >= 37)) { -+#if defined(CONFIG_SUSPEND) || defined(CONFIG_DEBUG_FS) - rc = amd_pmc_idlemask_read(dev, NULL, s); - if (rc) - return rc; -+#endif - } else { - seq_puts(s, "Unsupported SMU version for Idlemask\n"); - } --- -2.34.1 - - diff --git a/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch b/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch deleted file mode 100644 index cd75de5c2..000000000 --- a/src/patches/linux/linux-6.3-netfilter_nftables_deactivate_anonymus_set.patch +++ /dev/null @@ -1,121 +0,0 @@ -From c1592a89942e9678f7d9c8030efa777c0d57edab Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso <pablo(a)netfilter.org> -Date: Tue, 2 May 2023 10:25:24 +0200 -Subject: netfilter: nf_tables: deactivate anonymous set from preparation phase - -Toggle deleted anonymous sets as inactive in the next generation, so -users cannot perform any update on it. Clear the generation bitmask -in case the transaction is aborted. - -The following KASAN splat shows a set element deletion for a bound -anonymous set that has been already removed in the same transaction. - -[ 64.921510] ================================================================== -[ 64.923123] BUG: KASAN: wild-memory-access in nf_tables_commit+0xa24/0x1490 [nf_tables] -[ 64.924745] Write of size 8 at addr dead000000000122 by task test/890 -[ 64.927903] CPU: 3 PID: 890 Comm: test Not tainted 6.3.0+ #253 -[ 64.931120] Call Trace: -[ 64.932699] <TASK> -[ 64.934292] dump_stack_lvl+0x33/0x50 -[ 64.935908] ? nf_tables_commit+0xa24/0x1490 [nf_tables] -[ 64.937551] kasan_report+0xda/0x120 -[ 64.939186] ? nf_tables_commit+0xa24/0x1490 [nf_tables] -[ 64.940814] nf_tables_commit+0xa24/0x1490 [nf_tables] -[ 64.942452] ? __kasan_slab_alloc+0x2d/0x60 -[ 64.944070] ? nf_tables_setelem_notify+0x190/0x190 [nf_tables] -[ 64.945710] ? kasan_set_track+0x21/0x30 -[ 64.947323] nfnetlink_rcv_batch+0x709/0xd90 [nfnetlink] -[ 64.948898] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink] - -Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> ---- - include/net/netfilter/nf_tables.h | 1 + - net/netfilter/nf_tables_api.c | 12 ++++++++++++ - net/netfilter/nft_dynset.c | 2 +- - net/netfilter/nft_lookup.c | 2 +- - net/netfilter/nft_objref.c | 2 +- - 5 files changed, 16 insertions(+), 3 deletions(-) - -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 3ed21d2d56590..2e24ea1d744c2 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -619,6 +619,7 @@ struct nft_set_binding { - }; - - enum nft_trans_phase; -+void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set); - void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, - struct nft_set_binding *binding, - enum nft_trans_phase phase); -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 8b6c61a2196cb..59fb8320ab4d7 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -5127,12 +5127,24 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, - } - } - -+void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set) -+{ -+ if (nft_set_is_anonymous(set)) -+ nft_clear(ctx->net, set); -+ -+ set->use++; -+} -+EXPORT_SYMBOL_GPL(nf_tables_activate_set); -+ - void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set, - struct nft_set_binding *binding, - enum nft_trans_phase phase) - { - switch (phase) { - case NFT_TRANS_PREPARE: -+ if (nft_set_is_anonymous(set)) -+ nft_deactivate_next(ctx->net, set); -+ - set->use--; - return; - case NFT_TRANS_ABORT: -diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c -index 274579b1696e0..bd19c7aec92ee 100644 ---- a/net/netfilter/nft_dynset.c -+++ b/net/netfilter/nft_dynset.c -@@ -342,7 +342,7 @@ static void nft_dynset_activate(const struct nft_ctx *ctx, - { - struct nft_dynset *priv = nft_expr_priv(expr); - -- priv->set->use++; -+ nf_tables_activate_set(ctx, priv->set); - } - - static void nft_dynset_destroy(const struct nft_ctx *ctx, -diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c -index cecf8ab90e58f..03ef4fdaa460b 100644 ---- a/net/netfilter/nft_lookup.c -+++ b/net/netfilter/nft_lookup.c -@@ -167,7 +167,7 @@ static void nft_lookup_activate(const struct nft_ctx *ctx, - { - struct nft_lookup *priv = nft_expr_priv(expr); - -- priv->set->use++; -+ nf_tables_activate_set(ctx, priv->set); - } - - static void nft_lookup_destroy(const struct nft_ctx *ctx, -diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c -index cb37169608bab..a48dd5b5d45b1 100644 ---- a/net/netfilter/nft_objref.c -+++ b/net/netfilter/nft_objref.c -@@ -185,7 +185,7 @@ static void nft_objref_map_activate(const struct nft_ctx *ctx, - { - struct nft_objref_map *priv = nft_expr_priv(expr); - -- priv->set->use++; -+ nf_tables_activate_set(ctx, priv->set); - } - - static void nft_objref_map_destroy(const struct nft_ctx *ctx, --- -cgit - -- 2.34.1

1 0

[PATCH] checkrootfiles: fix checks on hosts with newer grep
by Arne Fitzenreiter 16 May '23

16 May '23

newer grep versions ignore * in --exclude work around this by excluding all arch specific directories with --exclude-dir Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- tools/checkrootfiles | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tools/checkrootfiles b/tools/checkrootfiles index a2712808b..05b16f368 100755 --- a/tools/checkrootfiles +++ b/tools/checkrootfiles @@ -34,30 +34,30 @@ if [ "${?}" == "0" ]; then fi grep -r '/x86_64' ./config/rootfiles/ --exclude gcc --exclude rust-libc \ - --exclude rust-ppv-lite86 --exclude rust-memchr --exclude *linux* \ + --exclude rust-ppv-lite86 --exclude rust-memchr --exclude-dir aarch64 --exclude-dir riscv64 --exclude-dir x86_64 \ --exclude update.sh \ --exclude-dir oldcore --exclude-dir x86_64 >/dev/null 2>&1 if [ "${?}" == "0" ]; then echo "Error! '/x86_64' in rootfiles files found!" grep -r '/x86_64' ./config/rootfiles/ --exclude gcc --exclude rust-libc \ - --exclude rust-ppv-lite86 --exclude rust-memchr --exclude *linux* \ + --exclude rust-ppv-lite86 --exclude rust-memchr --exclude-dir aarch64 --exclude-dir riscv64 --exclude-dir x86_64 \ --exclude update.sh \ --exclude-dir oldcore --exclude-dir x86_64 echo "Replace by xxxMACHINExxx !" fi -grep -r '/aarch64' ./config/rootfiles/ --exclude gcc --exclude rust-libc --exclude gdb --exclude liburcu --exclude gdb --exclude-dir oldcore --exclude-dir aarch64 >/dev/null 2>&1 +grep -r '/aarch64' ./config/rootfiles/ --exclude gcc --exclude rust-libc --exclude gdb --exclude liburcu --exclude gdb --exclude-dir oldcore --exclude-dir aarch64 --exclude-dir riscv64 --exclude-dir x86_64 >/dev/null 2>&1 if [ "${?}" == "0" ]; then echo "Error! '/aarch64' in rootfiles files found!" grep -r '/aarch64' ./config/rootfiles/ --exclude gcc --exclude rust-libc \ - --exclude-dir oldcore --exclude-dir aarch64 + --exclude-dir oldcore --exclude-dir aarch64 --exclude-dir riscv64 --exclude-dir x86_64 echo "Replace by xxxMACHINExxx !" fi -grep -r '/riscv64' ./config/rootfiles/ --exclude gcc --exclude rust-libc --exclude gdb --exclude liburcu --exclude go --exclude-dir oldcore --exclude-dir riscv64 >/dev/null 2>&1 +grep -r '/riscv64' ./config/rootfiles/ --exclude gcc --exclude rust-libc --exclude gdb --exclude liburcu --exclude go --exclude-dir oldcore --exclude-dir aarch64 --exclude-dir riscv64 --exclude-dir x86_64 >/dev/null 2>&1 if [ "${?}" == "0" ]; then echo "Error! '/riscv64' in rootfiles files found!" grep -r '/riscv64' ./config/rootfiles/ --exclude gcc --exclude rust-libc --exclude go \ - --exclude-dir oldcore --exclude-dir riscv64 + --exclude-dir oldcore --exclude-dir aarch64 --exclude-dir riscv64 --exclude-dir x86_64 echo "Replace by xxxMACHINExxx !" fi -- 2.38.1

1 0

[PATCH] rsnapshot: New addon
by Jon Murphy 15 May '23

15 May '23

- What is it? rsnapshot is a filesystem snapshot utility based on rsync. rsnapshot makes it easy to make periodic snapshots of the ipfire device. The code makes extensive use of hard links whenever possible, to greatly reduce the disk space required. See: https://rsnapshot.org - Why is it needed? Rsnapshot backups run multiple times per day (e.g., once per day up to 24 times per day). Rsnapshot is much easier to configure, setup and use than the borg backup add-on. (I found borg somewhat confusing). Rsnapshot completes each backup very fast. Unlike borg, rsnapshot does not compress each backup before storage. During a complete rebuild, borg backup need installation of the borg add-on to recover archived files. Rsnapshot backups can be copied directly from the backup drive. Current backups (backup.pl or borg) could corrupt sqlite3 databases by running a backup during a database write. This add-on includes a script specifically for sqlite backups. - IPFire Wiki In process at: https://wiki.ipfire.org/addons/rsnapshot Thanks to Gerd for creating a first build and a nice template for me! Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/backup/includes/rsnapshot | 1 + config/rootfiles/packages/rsnapshot | 17 +++ config/rsnapshot/backup_sqlite.sh | 40 +++++ config/rsnapshot/rsnapshot-daily | 8 + config/rsnapshot/rsnapshot-hourly | 8 + config/rsnapshot/rsnapshot-monthly | 8 + config/rsnapshot/rsnapshot-weekly | 8 + config/rsnapshot/rsnapshot-yearly | 8 + config/rsnapshot/rsnapshot.conf | 218 ++++++++++++++++++++++++++++ lfs/rsnapshot | 114 +++++++++++++++ make.sh | 1 + 11 files changed, 431 insertions(+) create mode 100644 config/backup/includes/rsnapshot create mode 100644 config/rootfiles/packages/rsnapshot create mode 100644 config/rsnapshot/backup_sqlite.sh create mode 100644 config/rsnapshot/rsnapshot-daily create mode 100644 config/rsnapshot/rsnapshot-hourly create mode 100644 config/rsnapshot/rsnapshot-monthly create mode 100644 config/rsnapshot/rsnapshot-weekly create mode 100644 config/rsnapshot/rsnapshot-yearly create mode 100644 config/rsnapshot/rsnapshot.conf create mode 100644 lfs/rsnapshot diff --git a/config/backup/includes/rsnapshot b/config/backup/includes/rsnapshot new file mode 100644 index 000000000..4d1b48a5a --- /dev/null +++ b/config/backup/includes/rsnapshot @@ -0,0 +1 @@ +/etc/rsnapshot.conf diff --git a/config/rootfiles/packages/rsnapshot b/config/rootfiles/packages/rsnapshot new file mode 100644 index 000000000..d907a615f --- /dev/null +++ b/config/rootfiles/packages/rsnapshot @@ -0,0 +1,17 @@ +etc/fcron.daily/rsnapshot-daily +etc/fcron.hourly/rsnapshot-hourly +etc/fcron.monthly/rsnapshot-monthly +etc/fcron.weekly/rsnapshot-weekly +etc/rsnapshot.conf +etc/rsnapshot.conf.default +usr/bin/rsnapshot +usr/bin/rsnapshot-diff +#usr/share/man/man1/rsnapshot-diff.1 +#usr/share/man/man1/rsnapshot.1 +var/ipfire/backup/addons/includes/rsnapshot +var/ipfire/backup/bin/backup_sqlite.sh +var/ipfire/backup/bin/rsnapshot-daily +var/ipfire/backup/bin/rsnapshot-hourly +var/ipfire/backup/bin/rsnapshot-monthly +var/ipfire/backup/bin/rsnapshot-weekly +var/ipfire/backup/bin/rsnapshot-yearly diff --git a/config/rsnapshot/backup_sqlite.sh b/config/rsnapshot/backup_sqlite.sh new file mode 100644 index 000000000..3ed54e49d --- /dev/null +++ b/config/rsnapshot/backup_sqlite.sh @@ -0,0 +1,40 @@ +#!/bin/bash +set -e +set -u +#set -x + +############################################################################## +# backup_sqlite.sh +# +# http://www.rsnapshot.org/ +# +# This is a simple shell script to backup a sqlite database with rsnapshot. +# +# This script simply needs to dump a file into the current working directory. +# rsnapshot handles everything else. +# +# The assumption is that this will be invoked from rsnapshot. +# See: +# https://rsnapshot.org/rsnapshot/docs/docbook/rest.html#backup-script +# +# Please remember that these backup scripts will be invoked as the user +# running rsnapshot. Make sure your backup scripts are owned by root, +# and not writable by anyone else. +# If you fail to do this, anyone with write access to these backup scripts +# will be able to put commands in them that will be run as the root user. +# If they are malicious, they could take over your server. +# +# chown root:root backup_sqlite.sh +# chmod 700 backup_sqlite.sh +# +############################################################################## + +umask 0077 + +# backup the database +/bin/find /var -iname *.db -exec bash -c ' /usr/bin/file {} | /bin/grep -q "SQLite 3" && /usr/bin/sqlite3 {} ".backup $(/usr/bin/basename {})" ' \; + +# make the backup readable only by root +#/bin/chmod 600 filename.db + +exit diff --git a/config/rsnapshot/rsnapshot-daily b/config/rsnapshot/rsnapshot-daily new file mode 100644 index 000000000..99e560adc --- /dev/null +++ b/config/rsnapshot/rsnapshot-daily @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG daily + +exit diff --git a/config/rsnapshot/rsnapshot-hourly b/config/rsnapshot/rsnapshot-hourly new file mode 100644 index 000000000..8dc2cd75f --- /dev/null +++ b/config/rsnapshot/rsnapshot-hourly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG sync && /usr/bin/rsnapshot -c $CONFIG hourly + +exit diff --git a/config/rsnapshot/rsnapshot-monthly b/config/rsnapshot/rsnapshot-monthly new file mode 100644 index 000000000..9c658250d --- /dev/null +++ b/config/rsnapshot/rsnapshot-monthly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG monthly + +exit diff --git a/config/rsnapshot/rsnapshot-weekly b/config/rsnapshot/rsnapshot-weekly new file mode 100644 index 000000000..f5b18530d --- /dev/null +++ b/config/rsnapshot/rsnapshot-weekly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG weekly + +exit diff --git a/config/rsnapshot/rsnapshot-yearly b/config/rsnapshot/rsnapshot-yearly new file mode 100644 index 000000000..218e9ee84 --- /dev/null +++ b/config/rsnapshot/rsnapshot-yearly @@ -0,0 +1,8 @@ +#!/bin/bash +set -e + +CONFIG=/etc/rsnapshot.conf + +/usr/bin/rsnapshot -c $CONFIG yearly + +exit diff --git a/config/rsnapshot/rsnapshot.conf b/config/rsnapshot/rsnapshot.conf new file mode 100644 index 000000000..cdec0404b --- /dev/null +++ b/config/rsnapshot/rsnapshot.conf @@ -0,0 +1,218 @@ +################################################# +# rsnapshot.conf - rsnapshot configuration file # +################################################# +# # +# PLEASE BE AWARE OF THE FOLLOWING RULE: # +# # +# This file requires tabs between elements # +# # +################################################# + +####################### +# CONFIG FILE VERSION # +####################### + +config_version 1.2 + +########################### +# SNAPSHOT ROOT DIRECTORY # +########################### + +# All snapshots will be stored under this root directory. +# +snapshot_root /mnt/hdd/snapshots/ + +# If no_create_root is enabled, rsnapshot will not automatically create the +# snapshot_root directory. This is particularly useful if you are backing +# up to removable media, such as a FireWire or USB drive. +# +no_create_root 1 + +################################# +# EXTERNAL PROGRAM DEPENDENCIES # +################################# + +# LINUX USERS: Be sure to uncomment "cmd_cp". This gives you extra features. +# EVERYONE ELSE: Leave "cmd_cp" commented out for compatibility. +# +# See the README file or the man page for more details. +# +cmd_cp /bin/cp + +# uncomment this to use the rm program instead of the built-in perl routine. +# +cmd_rm /bin/rm + +# rsync must be enabled for anything to work. This is the only command that +# must be enabled. +# +cmd_rsync /usr/bin/rsync + +# Uncomment this to enable remote ssh backups over rsync. +# +#cmd_ssh /usr/bin/ssh + +# Comment this out to disable syslog support. +# +cmd_logger /usr/bin/logger + +# Uncomment this to specify the path to "du" for disk usage checks. +# If you have an older version of "du", you may also want to check the +# "du_args" parameter below. +# +cmd_du /usr/bin/du + +# Uncomment this to specify the path to rsnapshot-diff. +# +cmd_rsnapshot_diff /usr/bin/rsnapshot-diff + +# Specify the path to a script (and any optional arguments) to run right +# before rsnapshot syncs files +# +#cmd_preexec /path/to/preexec/script + +# Specify the path to a script (and any optional arguments) to run right +# after rsnapshot syncs files +# +#cmd_postexec /path/to/postexec/script + + +######################################### +# BACKUP LEVELS / INTERVALS # +# Must be unique and in ascending order # +# e.g. alpha, beta, gamma, etc. # +######################################### + +retain hourly 2 # 2 backups in one day (every 12 hours) +#retain hourly 24 # 24 backups in one day +retain daily 7 # 7 backups in one week +retain weekly 4 # 4 backups in one month +retain monthly 12 # 12 backups in one year +retain yearly 2 # 2 backups total + +#retain alpha 6 # 6 backups in one beta +#retain beta 7 # 7 backups in one gamma +#retain gamma 4 # you get the idea! +#retain delta 3 + +############################################ +# GLOBAL OPTIONS # +# All are optional, with sensible defaults # +############################################ + +# Verbose level, 1 through 5. +# 1 Quiet Print fatal errors only +# 2 Default Print errors and warnings only +# 3 Verbose Show equivalent shell commands being executed +# 4 Extra Verbose Show extra verbose information +# 5 Debug mode Everything +# +verbose 2 + +# Same as "verbose" above, but controls the amount of data sent to the +# logfile, if one is being used. The default is 3. +# +loglevel 2 + +# If you enable this, data will be written to the file you specify. The +# amount of data written is controlled by the "loglevel" parameter. +# +#logfile /var/log/rsnapshot.log + +# If enabled, rsnapshot will write a lockfile to prevent two instances +# from running simultaneously (and messing up the snapshot_root). +# If you enable this, make sure the lockfile directory is not world +# writable. Otherwise anyone can prevent the program from running. +# +lockfile /run/rsnapshot.pid + +# By default, rsnapshot check lockfile, check if PID is running +# and if not, consider lockfile as stale, then start +# Enabling this stop rsnapshot if PID in lockfile is not running +# +#stop_on_stale_lockfile 0 + +# Default rsync args. All rsync commands have at least these options set. +# +# Note: This is the exception to the rule of "requires tabs between elements" +# tab between "rsync_long_args" and "--delete" +# space between all other arguments +# +# rsync_long_args<tab>--delete<space>--numeric-ids<space>--relative +# +#rsync_short_args -a +#rsync_long_args --delete --numeric-ids --relative --delete-excluded + +# ssh has no args passed by default, but you can specify some here. +# +#ssh_args -p 22 + +# Default arguments for the "du" program (for disk space reporting). +# The GNU version of "du" is preferred. See the man page for more details. +# If your version of "du" doesn't support the -h flag, try -k flag instead. +# +#du_args -csh + +# If this is enabled, rsync won't span filesystem partitions within a +# backup point. This essentially passes the -x option to rsync. +# The default is 0 (off). +# +#one_fs 0 + +# The include and exclude parameters, if enabled, simply get passed directly +# to rsync. If you have multiple include/exclude patterns, put each one on a +# separate line. Please look up the --include and --exclude options in the +# rsync man page for more details on how to specify file name patterns. +# +exclude .cache/ +exclude /var/cache +#include ??? +#exclude ??? + +# The include_file and exclude_file parameters, if enabled, simply get +# passed directly to rsync. Please look up the --include-from and +# --exclude-from options in the rsync man page for more details. +# +#include_file /path/to/include/file +#exclude_file /path/to/exclude/file + +# If your version of rsync supports --link-dest, consider enabling this. +# This is the best way to support special files (FIFOs, etc) cross-platform. +# The default is 0 (off). +# +link_dest 1 + +# When sync_first is enabled, it changes the default behaviour of rsnapshot. +# Normally, when rsnapshot is called with its lowest interval +# (i.e.: "rsnapshot alpha"), it will sync files AND rotate the lowest +# intervals. With sync_first enabled, "rsnapshot sync" handles the file sync, +# and all interval calls simply rotate files. See the man page for more +# details. The default is 0 (off). +# +sync_first 1 + +# If enabled, rsnapshot will move the oldest directory for each interval +# to [interval_name].delete, then it will remove the lockfile and delete +# that directory just before it exits. The default is 0 (off). +# +#use_lazy_deletes 0 + +# Number of rsync re-tries. If you experience any network problems or +# network card issues that tend to cause ssh to fail with errors like +# "Corrupted MAC on input", for example, set this to a non-zero value +# to have the rsync operation re-tried. +# +#rsync_numtries 0 + + +############################### +### BACKUP POINTS / SCRIPTS ### +############################### + +# LOCALHOST +backup /etc/ localhost/ +backup /var/ localhost/ +backup /root/ localhost/ + +backup_script /var/ipfire/backup/bin/backup_sqlite.sh localhost/sqlite3/ + diff --git a/lfs/rsnapshot b/lfs/rsnapshot new file mode 100644 index 000000000..174eff452 --- /dev/null +++ b/lfs/rsnapshot @@ -0,0 +1,114 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2023 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +SUMMARY = filesystem backup & snapshot utility + +VER = 1.4.5 + +THISAPP = rsnapshot-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +PROG = rsnapshot +PAK_VER = 1 + +DEPS = rsync + +SERVICES = + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_BLAKE2 = 2a668aa16991b2b4e611c6204cdcd0e8c9593e5f0af5ea89e787a578e73b6f5987514cd7d0252bb78aea1b157ef85aea947686111ca9e3befdb2a8cef0aa9ecd + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +b2 : $(subst %,%_BLAKE2,$(objects)) + +dist: + @$(PAK) + +############################################################################### +# Downloading, checking, b2sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_BLAKE2,$(objects)) : + @$(B2SUM) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + cd $(DIR_APP) && [ -x "configure" ] || sh ./autogen.sh + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --sysconfdir=/etc + + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + + # Add conf file to /etc directory + cp -vf $(DIR_CONF)/rsnapshot/rsnapshot.conf /etc + + # install fcron scripts and backup sqlite script + install -v -m 755 $(DIR_CONF)/rsnapshot/{rsnapshot-hourly,rsnapshot-daily} \ + $(DIR_CONF)/rsnapshot/{rsnapshot-weekly,rsnapshot-monthly} \ + $(DIR_CONF)/rsnapshot/{rsnapshot-yearly,backup_sqlite.sh} \ + -t /var/ipfire/backup/bin + + # link rsnapshot interval scripts to various fcron folders + ln -svf /var/ipfire/backup/bin/rsnapshot-hourly /etc/fcron.hourly + ln -svf /var/ipfire/backup/bin/rsnapshot-daily /etc/fcron.daily + ln -svf /var/ipfire/backup/bin/rsnapshot-weekly /etc/fcron.weekly + ln -svf /var/ipfire/backup/bin/rsnapshot-monthly /etc/fcron.monthly + #ln -svf /var/ipfire/backup/bin/rsnapshot-yearly /etc/fcron.??? + + # Install backup definition + cp -vf $(DIR_CONF)/backup/includes/rsnapshot /var/ipfire/backup/addons/includes/rsnapshot + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 3b7f9850c..1b6b1e253 100755 --- a/make.sh +++ b/make.sh @@ -1709,6 +1709,7 @@ buildipfire() { lfsmake2 perl-Imager-QRCode lfsmake2 perl-MIME-Base32 lfsmake2 perl-URI-Encode + lfsmake2 rsnapshot } buildinstaller() { -- 2.30.2

2 1

Source URL for zabbix_agentd?
by Peter Müller 13 May '23

13 May '23

Hello Robin, with regards to your Zabbix patchset, where did the source tarball come from? I'm currently struggling to find a download URL that provides a tarball with the same checksum as the LFS file. There does not seem to be away to download only the Zabbix agent from the vendor's homepage (or I missed it). Thanks for giving me a hint. Will include the URL in the LFS file as a comment then, to avoid bothering you a second time. Thanks, and best regards, Peter Müller P.S.: And yes, I should have checked this before amending your patch, but my under-caffeinated self missed that the other day. :-/

2 1

[PATCH] lvm2: housekeeping - remove invalid configure option
by Adolf Belka 11 May '23

11 May '23

- Since lvmetad was removed then the configure option --enable-lvmetad is no longer valid. A warning is now shown - configure: WARNING: unrecognized options: --enable-lvmetad Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/lvm2 | 1 - 1 file changed, 1 deletion(-) diff --git a/lfs/lvm2 b/lfs/lvm2 index 5b39f05f5..2f1e921fc 100644 --- a/lfs/lvm2 +++ b/lfs/lvm2 @@ -81,7 +81,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --enable-pkgconfig \ --with-udevdir=/lib/udev/rules.d \ --with-default-locking-dir=/run/lvm \ - --enable-lvmetad \ --enable-udev_rules \ --enable-udev_sync cd $(DIR_APP) && make $(MAKETUNING) -- 2.40.1

1 1

[PATCH] initscripts: removal of lvmetad initscript
by Adolf Belka 11 May '23

11 May '23

- With the last update of lvm2 lvmetad was removed from lvm2. I did not recognise that lvmetad had been setup as an automatic initscript, so it no longer works as the binary is no longer provided. - This patch removes the lvmetad initscript, the reference to lvmetad in the initscript lfs file and the lvmetad initscript entries in the rootfile for each architecture. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/aarch64/initscripts | 2 - config/rootfiles/common/riscv64/initscripts | 2 - config/rootfiles/common/x86_64/initscripts | 2 - lfs/initscripts | 3 +- src/initscripts/system/lvmetad | 53 --------------------- 5 files changed, 1 insertion(+), 61 deletions(-) delete mode 100755 src/initscripts/system/lvmetad diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts index dc6c0fd24..e2a8a11d5 100644 --- a/config/rootfiles/common/aarch64/initscripts +++ b/config/rootfiles/common/aarch64/initscripts @@ -29,7 +29,6 @@ etc/rc.d/init.d/functions etc/rc.d/init.d/halt etc/rc.d/init.d/ipsec etc/rc.d/init.d/leds -etc/rc.d/init.d/lvmetad etc/rc.d/init.d/localnet etc/rc.d/init.d/modules etc/rc.d/init.d/mountfs @@ -171,7 +170,6 @@ etc/rc.d/rc6.d/S99reboot etc/rc.d/rcsysinit.d/S00mountkernfs etc/rc.d/rcsysinit.d/S01sysctl etc/rc.d/rcsysinit.d/S05modules -etc/rc.d/rcsysinit.d/S09lvmetad etc/rc.d/rcsysinit.d/S10udev etc/rc.d/rcsysinit.d/S19waitdrives etc/rc.d/rcsysinit.d/S25partresize diff --git a/config/rootfiles/common/riscv64/initscripts b/config/rootfiles/common/riscv64/initscripts index 1848f8ebc..0c12af138 100644 --- a/config/rootfiles/common/riscv64/initscripts +++ b/config/rootfiles/common/riscv64/initscripts @@ -29,7 +29,6 @@ etc/rc.d/init.d/functions etc/rc.d/init.d/halt etc/rc.d/init.d/ipsec etc/rc.d/init.d/leds -etc/rc.d/init.d/lvmetad etc/rc.d/init.d/localnet etc/rc.d/init.d/modules etc/rc.d/init.d/mountfs @@ -170,7 +169,6 @@ etc/rc.d/rc6.d/S99reboot etc/rc.d/rcsysinit.d/S00mountkernfs etc/rc.d/rcsysinit.d/S01sysctl etc/rc.d/rcsysinit.d/S05modules -etc/rc.d/rcsysinit.d/S09lvmetad etc/rc.d/rcsysinit.d/S10udev etc/rc.d/rcsysinit.d/S19waitdrives etc/rc.d/rcsysinit.d/S25partresize diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts index 1848f8ebc..0c12af138 100644 --- a/config/rootfiles/common/x86_64/initscripts +++ b/config/rootfiles/common/x86_64/initscripts @@ -29,7 +29,6 @@ etc/rc.d/init.d/functions etc/rc.d/init.d/halt etc/rc.d/init.d/ipsec etc/rc.d/init.d/leds -etc/rc.d/init.d/lvmetad etc/rc.d/init.d/localnet etc/rc.d/init.d/modules etc/rc.d/init.d/mountfs @@ -170,7 +169,6 @@ etc/rc.d/rc6.d/S99reboot etc/rc.d/rcsysinit.d/S00mountkernfs etc/rc.d/rcsysinit.d/S01sysctl etc/rc.d/rcsysinit.d/S05modules -etc/rc.d/rcsysinit.d/S09lvmetad etc/rc.d/rcsysinit.d/S10udev etc/rc.d/rcsysinit.d/S19waitdrives etc/rc.d/rcsysinit.d/S25partresize diff --git a/lfs/initscripts b/lfs/initscripts index 55f0066e5..0312d8ae4 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -155,7 +155,6 @@ $(TARGET) : ln -sf ../init.d/mountkernfs /etc/rc.d/rcsysinit.d/S00mountkernfs ln -sf ../init.d/sysctl /etc/rc.d/rcsysinit.d/S01sysctl ln -sf ../init.d/modules /etc/rc.d/rcsysinit.d/S05modules - ln -sf ../init.d/lvmetad /etc/rc.d/rcsysinit.d/S09lvmetad ln -sf ../init.d/udev /etc/rc.d/rcsysinit.d/S10udev ln -sf ../init.d/waitdrives /etc/rc.d/rcsysinit.d/S19waitdrives ln -sf ../init.d/partresize /etc/rc.d/rcsysinit.d/S25partresize diff --git a/src/initscripts/system/lvmetad b/src/initscripts/system/lvmetad deleted file mode 100755 index 87cf87d33..000000000 --- a/src/initscripts/system/lvmetad +++ /dev/null @@ -1,53 +0,0 @@ -#!/bin/sh -############################################################################### -# # -# IPFire.org - A linux based firewall # -# Copyright (C) 2007-2022 IPFire Team <info(a)ipfire.org> # -# # -# This program is free software: you can redistribute it and/or modify # -# it under the terms of the GNU General Public License as published by # -# the Free Software Foundation, either version 3 of the License, or # -# (at your option) any later version. # -# # -# This program is distributed in the hope that it will be useful, # -# but WITHOUT ANY WARRANTY; without even the implied warranty of # -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # -# GNU General Public License for more details. # -# # -# You should have received a copy of the GNU General Public License # -# along with this program. If not, see <http://www.gnu.org/licenses/>. # -# # -############################################################################### - -. /etc/sysconfig/rc -. ${rc_functions} - -case "${1}" in - start) - # Create diretory for control socket - mkdir -p /run/lvm - - boot_mesg "Starting LVM2 Metadata Daemon..." - loadproc /usr/sbin/lvmetad - ;; - - stop) - boot_mesg "Stopping LVM2 Metadata Daemon..." - killproc /usr/sbin/lvmetad - ;; - - restart) - ${0} stop - sleep 1 - ${0} start - ;; - - status) - statusproc /usr/sbin/lvmetad - ;; - - *) - echo "Usage: ${0} {start|stop|restart|status}" - exit 1 - ;; -esac -- 2.40.1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development May 2023