This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, master has been updated via b14b37ba67eb52e1423781a329e3ea459a1334f5 (commit) via 975bd8bc17421a4a72b8263be99d8cce6fe5606d (commit) from e7fcf874e7f36d82e5e8c5fd54d8ea321b852186 (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit b14b37ba67eb52e1423781a329e3ea459a1334f5 Author: Arne Fitzenreiter arne_f@ipfire.org Date: Fri Apr 10 21:41:14 2020 +0200

OpenSSH: fix login on i?86

glibc calls clock_nanosleep_time64 syscall even if it not defined in the headers for this arch and the seccomp filter kills the process with because an unknown syscall.

Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org

commit 975bd8bc17421a4a72b8263be99d8cce6fe5606d Author: Arne Fitzenreiter arne_f@ipfire.org Date: Fri Apr 10 16:23:09 2020 +0200

Revert "Revert "OpenSSH: update to 8.2p1""

This reverts commit e7fcf874e7f36d82e5e8c5fd54d8ea321b852186.

-----------------------------------------------------------------------

Summary of changes: config/rootfiles/common/openssh | 2 ++ lfs/openssh | 7 ++++--- .../OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch | 13 +++++++++++++ 3 files changed, 19 insertions(+), 3 deletions(-) create mode 100644 src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch

Difference in files: diff --git a/config/rootfiles/common/openssh b/config/rootfiles/common/openssh index b41190a47..f2f8ea6c5 100644 --- a/config/rootfiles/common/openssh +++ b/config/rootfiles/common/openssh @@ -21,6 +21,7 @@ usr/bin/ssh-keyscan usr/lib/openssh/sftp-server usr/lib/openssh/ssh-keysign usr/lib/openssh/ssh-pkcs11-helper +usr/lib/openssh/ssh-sk-helper usr/sbin/sshd #usr/share/man/man1/scp.1 #usr/share/man/man1/sftp.1 @@ -35,4 +36,5 @@ usr/sbin/sshd #usr/share/man/man8/sftp-server.8 #usr/share/man/man8/ssh-keysign.8 #usr/share/man/man8/ssh-pkcs11-helper.8 +#usr/share/man/man8/ssh-sk-helper.8 #usr/share/man/man8/sshd.8 diff --git a/lfs/openssh b/lfs/openssh index 64e72d654..2f3eda74f 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2019 IPFire Team info@ipfire.org # +# Copyright (C) 2007-2020 IPFire Team info@ipfire.org # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@

include Config

-VER = 8.1p1 +VER = 8.2p1

THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE)

$(DL_FILE) = $(DL_FROM)/$(DL_FILE)

-$(DL_FILE)_MD5 = 513694343631a99841e815306806edf0 +$(DL_FILE)_MD5 = 3076e6413e8dbe56d33848c1054ac091

install : $(TARGET)

@@ -71,6 +71,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) cd $(DIR_APP) && sed -i "s/lkrb5 -ldes/lkrb5/" configure + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch cd $(DIR_APP) && ./configure \ --prefix=/usr \ --sysconfdir=/etc/ssh \ diff --git a/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch b/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch new file mode 100644 index 000000000..5199872d9 --- /dev/null +++ b/src/patches/OpenSSH-8.2p1_glibc-2.31_clock_nanosleep_time64.patch @@ -0,0 +1,13 @@ +diff -Naur openssh-8.2p1.org/sandbox-seccomp-filter.c openssh-8.2p1/sandbox-seccomp-filter.c +--- openssh-8.2p1.org/sandbox-seccomp-filter.c 2020-04-10 18:14:56.152309584 +0200 ++++ openssh-8.2p1/sandbox-seccomp-filter.c 2020-04-10 21:05:45.827921765 +0200 +@@ -253,6 +253,9 @@ + #endif + #ifdef __NR_clock_nanosleep_time64 + SC_ALLOW(__NR_clock_nanosleep_time64), ++#else ++ /* on i586 glibc call syscall 407 which is not defined */ ++ SC_ALLOW(407), + #endif + #ifdef __NR_clock_gettime64 + SC_ALLOW(__NR_clock_gettime64),

hooks/post-receive -- IPFire 2.x development tree