This CVE is about TOCTOU (time-of-check time-of-use)
race condition when copying and removing directory trees
which had very low severity problem and marked as closed
and won't fix. Therefore whitelisted CVE-2013-4235.
Master, gatesgarth and dunfell all have shadow version 4.81.
Hence, this is applicable for master, gatesgarth and dunfell. Link: https://bugzilla.redhat.com/show_bug.cgi?id=884658 Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 4 Mar 2021 12:00:43 +0000 (12:00 +0000)]
ptest-packagelists: remove libinput-ptest
The libinput ptests are very sensitive to system load, and will fail
if events from the kernel don't arrive sufficiently fast (from 20ms to
200ms depending on the test).
This is by design as input processing is inherently time-sensitive and
to avoid code bugs the test suite considers timing problems fatal.
As this is causing a large proportion of ptest runs to fail in libinput,
disable the execution of these tests for now.
[ YOCTO #14164 ]
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit adds an optional layerid argument which can
be passed to the bitbake-layers create-layer command.
This allows for creation of a layer with a layer id
different to that of the layer's name. The default
behaviour of the command where the layer's id is set
to the layer's name is still retained.
Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stefan Schmidt [Thu, 4 Mar 2021 19:35:40 +0000 (20:35 +0100)]
systemd-conf: do not ask for DHCP if configured on kernel command line
In cases where we configure the IP address and more on the kernel
command line with ip= we should not ask for DHCP with systemd-networkd
later on. We have such a setup with our runqemu script.
With this match in place we can also deploy this unit on qemu systems.
Signed-off-by: Stefan Schmidt <stefan.schmidt@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 3 Mar 2021 21:33:41 +0000 (21:33 +0000)]
libinput: less parallism to increase chances the test suite works
Discussion with the libinput maintainer has confirmed that many of the
libinput test cases need to run on a relatively unloaded system,
because input handling is by definition time-sensitive and any
event mismatches are considered a failure to avoid broken code hiding.
We can't expect libinput to run on an otherside unloaded machine
because the autobuilder ptests execute in a qemu at the same time
as builds can be happening. We can however reduce the amount of
parallellism happening in the libinput test suite to give it a better
chance of succeeding.
This may not be enough, but it's worth a go.
[ YOCTO #14164 ]
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
rpm: split build and extra functionality into separate packages
Having all the rpm build related tools in the main package requires
adding runtime dependencies on perl and python3-core, so adding
rpm to a target image can pull quite many unneeded packages to satisfy
the dependencies.
This splits all the build related tools into rpm-build and moves the
bash, perl and python3-core runtime dependencies to that package.
Also, the rpmsign tool is split into rpm-sign and rpm2archive (only
built if archive is in PACKAGECONFIG) into rpm-archive. These are
separate packages since they are not really related to building, so
do not belong in rpm-build, but are not necessarily wanted in
target images when rpm is included.
Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Stefan Ghinea [Wed, 3 Mar 2021 18:53:08 +0000 (20:53 +0200)]
wpa-supplicant: fix CVE-2021-27803
A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant
before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests.
It could result in denial of service or other impact (potentially
execution of arbitrary code), for an attacker within radio range.
Jon Mason [Wed, 3 Mar 2021 18:29:45 +0000 (13:29 -0500)]
runqemu: use "raw" instead of "bin" for ovmf
bin is not an acceptable format for qemu and will throw an error is set.
The correct format in this case is raw.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Change-Id: I9d78e356d39ecb15bef886c19870b029d9badd65 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Martin Jansa [Tue, 2 Mar 2021 19:32:29 +0000 (20:32 +0100)]
glib-2.0: call os.path.normpath on THISDIR
* some build environments have relative paths in THISDIR, e.g. from OEROOT set in:
https://github.com/96boards/oe-rpb-manifest/blob/1e3345c26c56f77f3a15a3978f412a25955d2606/conf/bblayers.conf#L4
and then the paths in filename normalized in:
filename = os.path.normpath(os.path.join(path, meson.cross.d, element))
don't match.
* COREBASE used here before didn't have this issue because the value is already
normalized when set in:
meta/conf/layer.conf:COREBASE = '${@os.path.normpath("${LAYERDIR}/../")}'
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The systemd-nspawn@.service file uses the following line to try
loading the tun, loop and dm-mod kernel modules, in a non fatal way:
ExecStartPre=-/sbin/modprobe -abq tun loop dm-mod
A non-zero return code from modprobe will not stop the service from
starting, but it would be convenient to inform the user about this
optional support, so add these modules to RRECOMMENDS.
Signed-off-by: Vivien Didelot <vdidelot@pbsc.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Martin Jansa [Tue, 2 Mar 2021 09:25:02 +0000 (10:25 +0100)]
coreutils: use u-a for base32
* busybox 1.33.0 added base32 applet and now do_rootfs for read-only images is failing with:
do_rootfs: busybox.postinst returned 1, marking as unpacked only, configuration required on target.
ERROR: image-devel-1.0-r2 do_rootfs: Postinstall scriptlets of ['busybox'] have failed. If the intention is to defer them to first boot,
then please place them into pkg_postinst_ontarget_${PN} ().
Deferring to first boot via 'exit 1' is no longer supported.
Details of the failure are in image-devel/1.0-r2/temp/log.do_rootfs.
and log.do_rootfs shows:
update-alternatives: Error: not linking image-devel/1.0-r2/rootfs/usr/bin/base32 to /usr/bin/busybox.nosuid since image-devel/1.0-r2/rootfs/usr/bin/base32 exists and is not a link
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 2 Mar 2021 11:12:09 +0000 (11:12 +0000)]
python3-cython: Remove build paths from debug sources
There are build paths which are in generated sources injected
into ${PN}-src. These are in generated files and don't influence the
binary output. As such we can correct them at do_package time by
tweaking in an appropriately injected function. This fixes
the reproducbility of the recipe.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Dorinda [Mon, 1 Mar 2021 14:42:56 +0000 (15:42 +0100)]
scripts/oe-debuginfod: script that fetches package manager directory
Added a script that fetches the package manager directory and runs the elfutils-native debuginfod on DEPLOY_DIR
Added a check to ensure that PACKAGECONFIG options is set in local.conf
Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Modern dosfstools automatically determines the appropriate size
and will error out if something that doesn't make sense is
supplied on the command line.
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Jate Sujjavanich [Sat, 27 Feb 2021 00:40:10 +0000 (00:40 +0000)]
iputils: Fix cap_net_raw for installed binaries
Add libcap-native to libcap PACKAGECONFIG making native setcap available
during the build. This assures its availability during install and prevents
meson from searching absolute paths and the resulting possible host
contamination.
Move -DNO_SETCAP_OR_SUID=true to the libcap PACKAGECONFIG negative case
This will prevent possible non-determinism for the setuid case.
Signed-off-by: Jate Sujjavanich <jatedev@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Mike Crowe [Sun, 28 Feb 2021 12:20:54 +0000 (12:20 +0000)]
gcc-sanitizers: Move content from gcclibdir into libdir
In e9e5744ba8b0d43c8b874d365f83071ce20bf0a1, Khem Raj wrote:
> OE does not use the traditional /usr/lib/gcc prefix to store
> gcc-runtime it basically is moved into libdir, however some newer
> files were installed by newer versions of gcc especially libgomp (
> omp.h openacc.h ) into gcclibdir, so we have content in both
> directories, this confuses other tools which are trying to guess the
> gcc installation and its runtime location, since now we have two
> directories, the tools either choose one or other and we get
> inconsistent behavior, e.g. clang for aarch64 uses /usr/lib but same
> clang for riscv64 chose /usr/lib/gcc
> This change ensures that OE ends up with single valid location for gcc
> runtime files
I think that the same thing needs to happen in gcc-sanitizers.inc,
otherwise I get errors like:
| .../recipe-sysroot/usr/include/gpg-error-64.h:884:11: fatal error: sanitizer/lsan_interface.h: No such file or directory
when attempting to compile with sanitizers enabled.
FILES_${PN} needs updating to match too.
Signed-off-by: Mike Crowe <mac@mcrowe.com> Cc: Khem Raj <raj.khem@gmail.com> Cc: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 26 Feb 2021 14:24:26 +0000 (14:24 +0000)]
selftest/reproducible: Add ability to pull some objects from sstate
When debugging why a single recipe doesn't reproduce, its a pain
to wait for the world to rebuild from scratch. Update the selftest
to allow this to be configured, for example you could set
targets as ['perf'] and sstate_targets as ['virtual/kernel']
and then it should only be rebuilding perf in the test rather than
things like the toolchain (parts of the kernel may be unavoiable
as they're not in sstate).
Khem Raj [Sat, 27 Feb 2021 07:41:30 +0000 (23:41 -0800)]
llvm: Fix build with c++17
Fixes
/benchmark_register.h:17:30: error: 'numeric_limits' is not a member of 'std'
| static const T kmax = std::numeric_limits<T>::max();
| ^~~~~~~~~~~~~~
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wang Mingyu [Sat, 27 Feb 2021 04:48:13 +0000 (12:48 +0800)]
ccache: upgrade 4.1 -> 4.2
0001-Improve-SIMD-detection-735.patch
0001-blake3-Remove-asm-checks-for-sse-avx.patch
0002-Always-use-64bit-to-print-time_t.patch
removed since they'are included in 4.2
-License-Update: Copyright year updated to 2021.
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 28 Feb 2021 12:05:14 +0000 (12:05 +0000)]
gstreamer1.0-python: Set internal python library path correcty
The library hardcodes paths to the python library internally and currently
these are build paths. Fix this to use the correct target path and
fix reproducibility in the process.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 27 Feb 2021 14:15:24 +0000 (14:15 +0000)]
bootchart2: Fix manpage reproducibility issue
The compressed docs contained a timestamp of the original file which
meant the SDE clamping during package creation didn't work. The
benefits of compression are minor, decompress the files to avoid
the reproducibility issues.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Martin Jansa [Thu, 25 Feb 2021 17:45:16 +0000 (18:45 +0100)]
glib-2.0: replace THISDIR instead of COREBASE in find_meson_cross_files --cross-file paths
* COREBASE works correctly only as long as this recipe is inside of
COREBASE directory and leaves the full absolute paths if you copy
this recipe into your own layer (e.g. to backport newer version)
* use THISDIR as all FILESPATH should be relative to that, unless
there is a .bbappend not only extending FILESPATH, but also adding
meson.cross.d files there (at which point it also didn't work with
COREBASE replacements as well already) - show an ERROR in such case,
I don't think it's common scenario to spend more time to support that.
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diego Santa Cruz [Fri, 26 Feb 2021 11:33:32 +0000 (12:33 +0100)]
createrepo-c: set path to magic database for native and nativesdk
The modifyrepo_c tool can use the magic database for input files
(e.g., if the file has no recognized extension) and fails if none
can be found.
This adds a wrapper that sets MAGIC to point to the proper place,
it also sets up MAGIC in the createrepo_c wrapper since that tool
also takes input files.
Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Khem Raj [Thu, 25 Feb 2021 23:29:16 +0000 (15:29 -0800)]
oeqa/pam: Need shadow installed for the tests
Distros may not use shadow for login manager
secondly login --help returns 1 only with shadow provided login
utility, with busybox it returns normal 0, the testcase clearly
assumes shadow being part of image, therefore add needed
checks to ensure the pre-requisites are met
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
