IPFire-SCM April 2022

ipfire-scm@lists.ipfire.org

1 participants
55 discussions

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 3baefafee476f8f18ae36b6f8c59a70f399e0396
by Michael Tremer 19 Apr '22

19 Apr '22

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1a4e1bc3205d04fb94878696a3eadddf9a3a0ab6
by Arne Fitzenreiter 19 Apr '22

19 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1a4e1bc3205d04fb94878696a3eadddf9a3a0ab6 (commit) from 56fb66438d3c4d41d691c18e6ef55558708b3a9c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1a4e1bc3205d04fb94878696a3eadddf9a3a0ab6 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 19 10:11:44 2022 +0200 core167: ship xfsprogs previous builds of mkfs.xfs links against libinih.so.0 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/125 => core/167}/filelists/xfsprogs | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/125 => core/167}/filelists/xfsprogs (100%) Difference in files: diff --git a/config/rootfiles/core/167/filelists/xfsprogs b/config/rootfiles/core/167/filelists/xfsprogs new file mode 120000 index 000000000..91032964d --- /dev/null +++ b/config/rootfiles/core/167/filelists/xfsprogs @@ -0,0 +1 @@ +../../../common/xfsprogs \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 56fb66438d3c4d41d691c18e6ef55558708b3a9c
by Arne Fitzenreiter 19 Apr '22

19 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 56fb66438d3c4d41d691c18e6ef55558708b3a9c (commit) from 31592610cb7c26b2df56a3b82c14c9dba0ac19a9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 56fb66438d3c4d41d691c18e6ef55558708b3a9c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 19 09:11:59 2022 +0200 core167: ship pcmciautils previous build is linked against libsysfs.so.1 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/66 => core/167}/filelists/pcmciautils | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/66 => core/167}/filelists/pcmciautils (100%) Difference in files: diff --git a/config/rootfiles/core/167/filelists/pcmciautils b/config/rootfiles/core/167/filelists/pcmciautils new file mode 120000 index 000000000..7cbf8218c --- /dev/null +++ b/config/rootfiles/core/167/filelists/pcmciautils @@ -0,0 +1 @@ +../../../common/pcmciautils \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 31592610cb7c26b2df56a3b82c14c9dba0ac19a9
by Arne Fitzenreiter 18 Apr '22

18 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 31592610cb7c26b2df56a3b82c14c9dba0ac19a9 (commit) from 9a271cf7a8886c09854bdd69e636f1ef56280b1d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 31592610cb7c26b2df56a3b82c14c9dba0ac19a9 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Mon Apr 18 10:27:46 2022 +0200 core167: ship elinks elinks need to be shipped because previuos builds search the old libidn.so.11 Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/141 => core/167}/filelists/elinks | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/141 => core/167}/filelists/elinks (100%) Difference in files: diff --git a/config/rootfiles/core/167/filelists/elinks b/config/rootfiles/core/167/filelists/elinks new file mode 120000 index 000000000..10db4dd8f --- /dev/null +++ b/config/rootfiles/core/167/filelists/elinks @@ -0,0 +1 @@ +../../../common/elinks \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 66ff5ffec85347f36abb7c173c66e8f9a23371b6
by Michael Tremer 13 Apr '22

13 Apr '22

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9a271cf7a8886c09854bdd69e636f1ef56280b1d
by Peter Müller 13 Apr '22

13 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 9a271cf7a8886c09854bdd69e636f1ef56280b1d (commit) from 74fe5c8673d346fd92af79697e018ca8f5c0348e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9a271cf7a8886c09854bdd69e636f1ef56280b1d Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Wed Apr 13 11:39:31 2022 +0000 cdrom: Symlink /etc/mtab to /proc/self/mounts See cad2ce78dde6d3df70c1bbde011bb677b8df9ae4 for details. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: lfs/cdrom | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Difference in files: diff --git a/lfs/cdrom b/lfs/cdrom index f35ff6a35..ff4821fb5 100644 --- a/lfs/cdrom +++ b/lfs/cdrom @@ -149,7 +149,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Clear mtab (prevents .journal problems) rm -vf /etc/mtab - echo > /etc/mtab + ln -s /proc/self/mounts /etc/mtab # Create filelist for packaging. BUILDTARGET="$(BUILDTARGET)" BUILD_ARCH="$(BUILD_ARCH)" KVER="$(KVER)" \ hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 74fe5c8673d346fd92af79697e018ca8f5c0348e
by Peter Müller 13 Apr '22

13 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 74fe5c8673d346fd92af79697e018ca8f5c0348e (commit) from 9132bdd7484ce8eb1305aeb4894dd40e721e3f75 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 74fe5c8673d346fd92af79697e018ca8f5c0348e Author: Peter Müller <peter.mueller(a)ipfire.org> Date: Wed Apr 13 11:32:48 2022 +0000 libloc: Fix rootfile Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/libloc | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/common/libloc b/config/rootfiles/common/libloc index 955e91cde..65c95e98b 100644 --- a/config/rootfiles/common/libloc +++ b/config/rootfiles/common/libloc @@ -1,6 +1,7 @@ usr/bin/location #usr/bin/location-importer #usr/include/libloc +#usr/include/libloc/address.h #usr/include/libloc/as-list.h #usr/include/libloc/as.h #usr/include/libloc/compat.h hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 5bfdb4e5398d697bc7dfafd4c91ef38c4b610d68
by Michael Tremer 13 Apr '22

13 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 5bfdb4e5398d697bc7dfafd4c91ef38c4b610d68 (commit) via cad867506d768bb049ee7083bdfdeaf8a9e8cce4 (commit) via cad2ce78dde6d3df70c1bbde011bb677b8df9ae4 (commit) via 2506def0a603ea4111bfb0f87794bd5a9c9a48fd (commit) via e0da038fc9d5f970150976715ef9d5d28f48092b (commit) via 0db4fbe1b521db9f2f62b5a3229dcd8fb5d974f4 (commit) via 423e2e7f92e4baba13dab98160c87f13087960b7 (commit) via 1e0314afdfd26566605fb3ca735e239023bc3d31 (commit) via c8d047f562f5aef6769ee44380dec81332cb904e (commit) via 95229400b3cdc093e648cd20b9da48d151bdae83 (commit) via f4dca7f1afd184dcf1c23325ac079af0f490816b (commit) via bc82eb79b111eb2dbca250530e8a7171fb86e46c (commit) from 24c8e6a6df46745963afd1f9f67fca0350f477c6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5bfdb4e5398d697bc7dfafd4c91ef38c4b610d68 Merge: 24c8e6a6d cad867506 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 13 08:11:05 2022 +0000 Merge branch 'next' ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/libloc | 2 +- config/rootfiles/core/167/filelists/files | 3 + .../{oldcore/148 => core/167}/filelists/libloc | 0 .../{oldcore/111 => core/167}/filelists/vnstat | 0 .../{oldcore/100 => core/167}/filelists/xz | 0 config/rootfiles/core/167/update.sh | 72 ++++++++++++++++- lfs/libloc | 8 +- lfs/stage2 | 3 +- lfs/xz | 1 + src/initscripts/system/mountfs | 6 -- src/initscripts/system/partresize | 6 -- src/patches/xzgrep-ZDI-CAN-16587.patch | 94 ++++++++++++++++++++++ 12 files changed, 176 insertions(+), 19 deletions(-) copy config/rootfiles/{oldcore/148 => core/167}/filelists/libloc (100%) copy config/rootfiles/{oldcore/111 => core/167}/filelists/vnstat (100%) copy config/rootfiles/{oldcore/100 => core/167}/filelists/xz (100%) create mode 100644 src/patches/xzgrep-ZDI-CAN-16587.patch Difference in files: diff --git a/config/rootfiles/common/libloc b/config/rootfiles/common/libloc index c7335c7ef..955e91cde 100644 --- a/config/rootfiles/common/libloc +++ b/config/rootfiles/common/libloc @@ -18,7 +18,7 @@ usr/bin/location #usr/lib/libloc.la #usr/lib/libloc.so usr/lib/libloc.so.1 -usr/lib/libloc.so.1.0.1 +usr/lib/libloc.so.1.0.2 usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/Location.pm #usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Location #usr/lib/perl5/site_perl/5.32.1/xxxMACHINExxx-linux-thread-multi/auto/Location/.packlist diff --git a/config/rootfiles/core/167/filelists/files b/config/rootfiles/core/167/filelists/files index 7e85b24ac..18f533e93 100644 --- a/config/rootfiles/core/167/filelists/files +++ b/config/rootfiles/core/167/filelists/files @@ -1,7 +1,9 @@ etc/collectd.conf etc/inittab.d etc/rc.d/init.d/firewall +etc/rc.d/init.d/mountfs etc/rc.d/init.d/pakfire +etc/rc.d/init.d/partresize etc/sysctl.conf lib/udev/network-hotplug-bridges srv/web/ipfire/cgi-bin/connections.cgi @@ -10,6 +12,7 @@ srv/web/ipfire/cgi-bin/getrrdimage.cgi srv/web/ipfire/cgi-bin/ids.cgi srv/web/ipfire/cgi-bin/location-block.cgi usr/lib/firewall/rules.pl +usr/lib/perl5/site_perl/5.32.1/Net/IP.pm usr/local/bin/backupiso usr/sbin/unbound-dhcp-leases-bridge var/ipfire/backup/include diff --git a/config/rootfiles/core/167/filelists/libloc b/config/rootfiles/core/167/filelists/libloc new file mode 120000 index 000000000..ff4a92429 --- /dev/null +++ b/config/rootfiles/core/167/filelists/libloc @@ -0,0 +1 @@ +../../../common/libloc \ No newline at end of file diff --git a/config/rootfiles/core/167/filelists/vnstat b/config/rootfiles/core/167/filelists/vnstat new file mode 120000 index 000000000..2e2e6100b --- /dev/null +++ b/config/rootfiles/core/167/filelists/vnstat @@ -0,0 +1 @@ +../../../common/vnstat \ No newline at end of file diff --git a/config/rootfiles/core/167/filelists/xz b/config/rootfiles/core/167/filelists/xz new file mode 120000 index 000000000..734e926c7 --- /dev/null +++ b/config/rootfiles/core/167/filelists/xz @@ -0,0 +1 @@ +../../../common/xz \ No newline at end of file diff --git a/config/rootfiles/core/167/update.sh b/config/rootfiles/core/167/update.sh index fdcb843cf..0f98f1757 100644 --- a/config/rootfiles/core/167/update.sh +++ b/config/rootfiles/core/167/update.sh @@ -26,11 +26,61 @@ core=167 +exit_with_error() { + # Set last succesfull installed core. + echo $(($core-1)) > /opt/pakfire/db/core/mine + # force fsck at next boot, this may fix free space on xfs + touch /forcefsck + # don't start pakfire again at error + killall -KILL pak_update + /usr/bin/logger -p syslog.emerg -t ipfire \ + "core-update-${core}: $1" + exit $2 +} + # Remove old core updates from pakfire cache to save space... for (( i=1; i<=$core; i++ )); do rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire done + +KVER="xxxKVERxxx" + +# Backup uEnv.txt if exist +if [ -e /boot/uEnv.txt ]; then + cp -vf /boot/uEnv.txt /boot/uEnv.txt.org +fi + +# Do some sanity checks. +case $(uname -r) in + *-ipfire*) + # Ok. + ;; + *) + exit_with_error "ERROR cannot update. No IPFire Kernel." 1 + ;; +esac + +# Check diskspace on root +ROOTSPACE=`df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1` + +if [ $ROOTSPACE -lt 100000 ]; then + exit_with_error "ERROR cannot update because not enough free space on root." 2 + exit 2 +fi + +# Remove the old kernel +rm -rf /boot/System.map-* +rm -rf /boot/config-* +rm -rf /boot/ipfirerd-* +rm -rf /boot/initramfs-* +rm -rf /boot/vmlinuz-* +rm -rf /boot/uImage-* +rm -rf /boot/zImage-* +rm -rf /boot/uInit-* +rm -rf /boot/dtb-* +rm -rf /lib/modules + # Remove files rm -rvf \ /bin/setserial \ @@ -272,7 +322,6 @@ rm -rvf \ /usr/lib/libxslt.so \ /usr/lib/pango \ /usr/lib/perl5/site_perl/5.30.0 \ - /usr/lib/perl5/site_perl/5.32.1/Net/IP.pm \ /usr/lib/python3.8/ensurepip/_bundled/pip-19.2.3-py2.py3-none-any.whl \ /usr/lib/python3.8/idlelib/Icons/idle.icns \ /usr/lib/python3.8/lib2to3/Grammar3.8.1.final.0.pickle \ @@ -337,6 +386,13 @@ hardlink -c -vv /lib/firmware # Regenerate all initrds dracut --regenerate-all --force +# Replace /etc/mtab by symlink as mount no longer writes it +rm -vf /etc/mtab +ln -vs /proc/self/mounts /etc/mtab + +# Export the location database again and reload the firewall engine +/usr/local/bin/update-location-database + # Rebuild IPS rules perl -e "require '/var/ipfire/ids-functions.pl'; &IDS::oinkmaster();" /etc/init.d/suricata reload @@ -362,6 +418,20 @@ if [ -e "/opt/pakfire/db/installed/meta-nano" ] && [ -e "/opt/pakfire/db/meta/me /opt/pakfire/db/rootfiles/nano fi +# remove lm_sensor config after collectd was started +# to reserch sensors at next boot with updated kernel +rm -f /etc/sysconfig/lm_sensors + +# Upadate Kernel version uEnv.txt +if [ -e /boot/uEnv.txt ]; then + sed -i -e "s/KVER=.*/KVER=${KVER}/g" /boot/uEnv.txt +fi + +# call user update script (needed for some arm boards) +if [ -e /boot/pakfire-kernel-update ]; then + /boot/pakfire-kernel-update ${KVER} +fi + # This update needs a reboot... touch /var/run/need_reboot diff --git a/lfs/libloc b/lfs/libloc index c9b82383a..71939a966 100644 --- a/lfs/libloc +++ b/lfs/libloc @@ -24,8 +24,8 @@ include Config -VER = 0.9.11 -DB_DATE = 2022-02-16 +VER = 0.9.13 +DB_DATE = 2022-04-12 THISAPP = libloc-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -43,8 +43,8 @@ objects = $(DL_FILE) \ $(DL_FILE) = https://source.ipfire.org/releases/libloc/$(DL_FILE) location-$(DB_DATE).db.xz = https://location.ipfire.org/databases/1/archive/location-$(DB_DATE).db.xz -$(DL_FILE)_BLAKE2 = 46df0dc058235ede47c103c9be5882f50b688c80613c2bdf6f3bc40a2effff67e3ef77cd28142dc3b3fb832689a345e8840fe466738e7ae151698e98c17a68ed -location-$(DB_DATE).db.xz_BLAKE2 = 9ba0ae5bbabef1a0f692cee11515796d754b2f83aa21c2a2730b4d04249606fe00df856dad08fbdfdad3fad6b06c902b36e3a7717181ce0fac4738b46737b5b4 +$(DL_FILE)_BLAKE2 = 5fccd6f0564899499939c63af8975f20b1f7d5267a8cf6c15e14ab377b9d5c008ae5e154c804ac6a1106471aaeebac97dc4ebe6b70fc1e59f416fe2cc02c52a7 +location-$(DB_DATE).db.xz_BLAKE2 = 8634405ddba8c38d4512ec586722faaeccb295b8bfe7778e52e7bb60dfe804c6a3ae201d04a43d200e1118cf5fed05ef3eada59e2dd6386fe37023274ccb6795 install : $(TARGET) diff --git a/lfs/stage2 b/lfs/stage2 index 9f93babe2..39697a848 100644 --- a/lfs/stage2 +++ b/lfs/stage2 @@ -87,7 +87,8 @@ endif cp -rvf $(DIR_SRC)/config/etc/* /etc; [ ! -d "$(DIR_SRC)/config/etc-$(BUILD_ARCH)" ] || cp -rvf $(DIR_SRC)/config/etc-$(BUILD_ARCH)/* /etc cp -rvf $(DIR_SRC)/config/lib/* /lib; - touch /etc/{fs,m}tab + touch /etc/fstab + ln -s /proc/self/mounts /etc/mtab echo "$(NAME) v$(VERSION) - $(SLOGAN)" > /etc/issue echo "===============================" >> /etc/issue echo "\n running on \s \r \m" >> /etc/issue diff --git a/lfs/xz b/lfs/xz index 586fbc90f..9345df954 100644 --- a/lfs/xz +++ b/lfs/xz @@ -75,6 +75,7 @@ $(subst %,%_BLAKE2,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + cd $(DIR_APP) && patch -p1 -i $(DIR_SRC)/src/patches/xzgrep-ZDI-CAN-16587.patch cd $(DIR_APP) && ./configure --prefix=$(PREFIX) cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install diff --git a/src/initscripts/system/mountfs b/src/initscripts/system/mountfs index b1533d6a2..81ed729c1 100644 --- a/src/initscripts/system/mountfs +++ b/src/initscripts/system/mountfs @@ -31,12 +31,6 @@ case "${1}" in # Remove fsck-related file system watermarks. rm -f /fastboot /forcefsck - boot_mesg "Create /etc/mtab..." - > /etc/mtab - mount -f / || failed=1 - (exit ${failed}) - evaluate_retval - # This will mount all filesystems that do not have _netdev in # their option list. _netdev denotes a network filesystem. boot_mesg "Mounting remaining file systems..." diff --git a/src/initscripts/system/partresize b/src/initscripts/system/partresize index 7605b9e2b..147405e1e 100644 --- a/src/initscripts/system/partresize +++ b/src/initscripts/system/partresize @@ -30,12 +30,6 @@ case "${1}" in mount -o remount,rw / > /dev/null evaluate_retval - boot_mesg "Create /etc/mtab..." - > /etc/mtab - mount -f / || failed=1 - (exit ${failed}) - evaluate_retval - # check if serial console enabled scon="off"; if [ ! "$(grep "console=ttyS0" /proc/cmdline)" == "" ]; then diff --git a/src/patches/xzgrep-ZDI-CAN-16587.patch b/src/patches/xzgrep-ZDI-CAN-16587.patch new file mode 100644 index 000000000..406ded590 --- /dev/null +++ b/src/patches/xzgrep-ZDI-CAN-16587.patch @@ -0,0 +1,94 @@ +From 69d1b3fc29677af8ade8dc15dba83f0589cb63d6 Mon Sep 17 00:00:00 2001 +From: Lasse Collin <lasse.collin(a)tukaani.org> +Date: Tue, 29 Mar 2022 19:19:12 +0300 +Subject: [PATCH] xzgrep: Fix escaping of malicious filenames (ZDI-CAN-16587). + +Malicious filenames can make xzgrep to write to arbitrary files +or (with a GNU sed extension) lead to arbitrary code execution. + +xzgrep from XZ Utils versions up to and including 5.2.5 are +affected. 5.3.1alpha and 5.3.2alpha are affected as well. +This patch works for all of them. + +This bug was inherited from gzip's zgrep. gzip 1.12 includes +a fix for zgrep. + +The issue with the old sed script is that with multiple newlines, +the N-command will read the second line of input, then the +s-commands will be skipped because it's not the end of the +file yet, then a new sed cycle starts and the pattern space +is printed and emptied. So only the last line or two get escaped. + +One way to fix this would be to read all lines into the pattern +space first. However, the included fix is even simpler: All lines +except the last line get a backslash appended at the end. To ensure +that shell command substitution doesn't eat a possible trailing +newline, a colon is appended to the filename before escaping. +The colon is later used to separate the filename from the grep +output so it is fine to add it here instead of a few lines later. + +The old code also wasn't POSIX compliant as it used \n in the +replacement section of the s-command. Using \<newline> is the +POSIX compatible method. + +LC_ALL=C was added to the two critical sed commands. POSIX sed +manual recommends it when using sed to manipulate pathnames +because in other locales invalid multibyte sequences might +cause issues with some sed implementations. In case of GNU sed, +these particular sed scripts wouldn't have such problems but some +other scripts could have, see: + + info '(sed)Locale Considerations' + +This vulnerability was discovered by: +cleemy desu wayo working with Trend Micro Zero Day Initiative + +Thanks to Jim Meyering and Paul Eggert discussing the different +ways to fix this and for coordinating the patch release schedule +with gzip. +--- + src/scripts/xzgrep.in | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/src/scripts/xzgrep.in b/src/scripts/xzgrep.in +index b180936..e5186ba 100644 +--- a/src/scripts/xzgrep.in ++++ b/src/scripts/xzgrep.in +@@ -180,22 +180,26 @@ for i; do + { test $# -eq 1 || test $no_filename -eq 1; }; then + eval "$grep" + else ++ # Append a colon so that the last character will never be a newline ++ # which would otherwise get lost in shell command substitution. ++ i="$i:" ++ ++ # Escape & \ | and newlines only if such characters are present ++ # (speed optimization). + case $i in + (*' + '* | *'&'* | *'\'* | *'|'*) +- i=$(printf '%s\n' "$i" | +- sed ' +- $!N +- $s/[&\|]/\\&/g +- $s/\n/\\n/g +- ');; ++ i=$(printf '%s\n' "$i" | LC_ALL=C sed 's/[&\|]/\\&/g; $!s/$/\\/');; + esac +- sed_script="s|^|$i:|" ++ ++ # $i already ends with a colon so don't add it here. ++ sed_script="s|^|$i|" + + # Fail if grep or sed fails. + r=$( + exec 4>&1 +- (eval "$grep" 4>&-; echo $? >&4) 3>&- | sed "$sed_script" >&3 4>&- ++ (eval "$grep" 4>&-; echo $? >&4) 3>&- | ++ LC_ALL=C sed "$sed_script" >&3 4>&- + ) || r=2 + exit $r + fi >&3 5>&- +-- +2.35.1 + hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. cad867506d768bb049ee7083bdfdeaf8a9e8cce4
by Michael Tremer 13 Apr '22

13 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via cad867506d768bb049ee7083bdfdeaf8a9e8cce4 (commit) from cad2ce78dde6d3df70c1bbde011bb677b8df9ae4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit cad867506d768bb049ee7083bdfdeaf8a9e8cce4 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Apr 13 08:10:16 2022 +0000 c167: Ship vnstat vnstat is linked against libgd which has had an SO bump and therefore needs to be shipped again. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/{oldcore/111 => core/167}/filelists/vnstat | 0 1 file changed, 0 insertions(+), 0 deletions(-) copy config/rootfiles/{oldcore/111 => core/167}/filelists/vnstat (100%) Difference in files: diff --git a/config/rootfiles/core/167/filelists/vnstat b/config/rootfiles/core/167/filelists/vnstat new file mode 120000 index 000000000..2e2e6100b --- /dev/null +++ b/config/rootfiles/core/167/filelists/vnstat @@ -0,0 +1 @@ +../../../common/vnstat \ No newline at end of file hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 95229400b3cdc093e648cd20b9da48d151bdae83
by Arne Fitzenreiter 12 Apr '22

12 Apr '22

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 95229400b3cdc093e648cd20b9da48d151bdae83 (commit) from f1b067357224363b138eb8e2b74822051adbc9ef (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 95229400b3cdc093e648cd20b9da48d151bdae83 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Tue Apr 12 11:35:20 2022 +0200 core167: add code needed for kernel update remove the old kernel and reconfigure bootscripts for arm boards and run user scripts to switch to a new kernel. Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/167/update.sh | 64 +++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) Difference in files: diff --git a/config/rootfiles/core/167/update.sh b/config/rootfiles/core/167/update.sh index fdcb843cf..ca2e5920c 100644 --- a/config/rootfiles/core/167/update.sh +++ b/config/rootfiles/core/167/update.sh @@ -26,11 +26,61 @@ core=167 +exit_with_error() { + # Set last succesfull installed core. + echo $(($core-1)) > /opt/pakfire/db/core/mine + # force fsck at next boot, this may fix free space on xfs + touch /forcefsck + # don't start pakfire again at error + killall -KILL pak_update + /usr/bin/logger -p syslog.emerg -t ipfire \ + "core-update-${core}: $1" + exit $2 +} + # Remove old core updates from pakfire cache to save space... for (( i=1; i<=$core; i++ )); do rm -f /var/cache/pakfire/core-upgrade-*-$i.ipfire done + +KVER="xxxKVERxxx" + +# Backup uEnv.txt if exist +if [ -e /boot/uEnv.txt ]; then + cp -vf /boot/uEnv.txt /boot/uEnv.txt.org +fi + +# Do some sanity checks. +case $(uname -r) in + *-ipfire*) + # Ok. + ;; + *) + exit_with_error "ERROR cannot update. No IPFire Kernel." 1 + ;; +esac + +# Check diskspace on root +ROOTSPACE=`df / -Pk | sed "s| * | |g" | cut -d" " -f4 | tail -n 1` + +if [ $ROOTSPACE -lt 100000 ]; then + exit_with_error "ERROR cannot update because not enough free space on root." 2 + exit 2 +fi + +# Remove the old kernel +rm -rf /boot/System.map-* +rm -rf /boot/config-* +rm -rf /boot/ipfirerd-* +rm -rf /boot/initramfs-* +rm -rf /boot/vmlinuz-* +rm -rf /boot/uImage-* +rm -rf /boot/zImage-* +rm -rf /boot/uInit-* +rm -rf /boot/dtb-* +rm -rf /lib/modules + # Remove files rm -rvf \ /bin/setserial \ @@ -362,6 +412,20 @@ if [ -e "/opt/pakfire/db/installed/meta-nano" ] && [ -e "/opt/pakfire/db/meta/me /opt/pakfire/db/rootfiles/nano fi +# remove lm_sensor config after collectd was started +# to reserch sensors at next boot with updated kernel +rm -f /etc/sysconfig/lm_sensors + +# Upadate Kernel version uEnv.txt +if [ -e /boot/uEnv.txt ]; then + sed -i -e "s/KVER=.*/KVER=${KVER}/g" /boot/uEnv.txt +fi + +# call user update script (needed for some arm boards) +if [ -e /boot/pakfire-kernel-update ]; then + /boot/pakfire-kernel-update ${KVER} +fi + # This update needs a reboot... touch /var/run/need_reboot hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM April 2022