mirror of
https://github.com/MiyooCFW/buildroot.git
synced 2025-09-27 22:24:19 +03:00
bump version to 2022.02.9
add miyoo_defconfig
This commit is contained in:
tiopex
@@ -1,90 +0,0 @@
|
||||
From e74dd1d96753b0538192143adf58d04fcd3b242b Mon Sep 17 00:00:00 2001
|
||||
From: Matthias Gerstner <mgerstner@suse.de>
|
||||
Date: Fri, 14 Aug 2020 22:14:36 -0700
|
||||
Subject: [PATCH] Correct multiple security issues that are present if the tcsd
|
||||
is started by root instead of the tss user.
|
||||
|
||||
Patch fixes the following 3 CVEs:
|
||||
|
||||
CVE-2020-24332
|
||||
If the tcsd daemon is started with root privileges,
|
||||
the creation of the system.data file is prone to symlink attacks
|
||||
|
||||
CVE-2020-24330
|
||||
If the tcsd daemon is started with root privileges,
|
||||
it fails to drop the root gid after it is no longer needed
|
||||
|
||||
CVE-2020-24331
|
||||
If the tcsd daemon is started with root privileges,
|
||||
the tss user has read and write access to the /etc/tcsd.conf file
|
||||
|
||||
Authored-by: Matthias Gerstner <mgerstner@suse.de>
|
||||
Signed-off-by: Debora Velarde Babb <debora@linux.ibm.com>
|
||||
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
||||
---
|
||||
src/tcs/ps/tcsps.c | 2 +-
|
||||
src/tcsd/svrside.c | 1 +
|
||||
src/tcsd/tcsd_conf.c | 10 +++++-----
|
||||
3 files changed, 7 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/tcs/ps/tcsps.c b/src/tcs/ps/tcsps.c
|
||||
index e47154b..85d45a9 100644
|
||||
--- a/src/tcs/ps/tcsps.c
|
||||
+++ b/src/tcs/ps/tcsps.c
|
||||
@@ -72,7 +72,7 @@ get_file()
|
||||
}
|
||||
|
||||
/* open and lock the file */
|
||||
- system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR, 0600);
|
||||
+ system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR|O_NOFOLLOW, 0600);
|
||||
if (system_ps_fd < 0) {
|
||||
LogError("system PS: open() of %s failed: %s",
|
||||
tcsd_options.system_ps_file, strerror(errno));
|
||||
diff --git a/src/tcsd/svrside.c b/src/tcsd/svrside.c
|
||||
index 1ae1636..1c12ff3 100644
|
||||
--- a/src/tcsd/svrside.c
|
||||
+++ b/src/tcsd/svrside.c
|
||||
@@ -473,6 +473,7 @@ main(int argc, char **argv)
|
||||
}
|
||||
return TCSERR(TSS_E_INTERNAL_ERROR);
|
||||
}
|
||||
+ setgid(pwd->pw_gid);
|
||||
setuid(pwd->pw_uid);
|
||||
#endif
|
||||
#endif
|
||||
diff --git a/src/tcsd/tcsd_conf.c b/src/tcsd/tcsd_conf.c
|
||||
index a31503d..ea8ea13 100644
|
||||
--- a/src/tcsd/tcsd_conf.c
|
||||
+++ b/src/tcsd/tcsd_conf.c
|
||||
@@ -743,7 +743,7 @@ conf_file_init(struct tcsd_config *conf)
|
||||
#ifndef SOLARIS
|
||||
struct group *grp;
|
||||
struct passwd *pw;
|
||||
- mode_t mode = (S_IRUSR|S_IWUSR);
|
||||
+ mode_t mode = (S_IRUSR|S_IWUSR|S_IRGRP);
|
||||
#endif /* SOLARIS */
|
||||
TSS_RESULT result;
|
||||
|
||||
@@ -798,15 +798,15 @@ conf_file_init(struct tcsd_config *conf)
|
||||
}
|
||||
|
||||
/* make sure user/group TSS owns the conf file */
|
||||
- if (pw->pw_uid != stat_buf.st_uid || grp->gr_gid != stat_buf.st_gid) {
|
||||
+ if (stat_buf.st_uid != 0 || grp->gr_gid != stat_buf.st_gid) {
|
||||
LogError("TCSD config file (%s) must be user/group %s/%s", tcsd_config_file,
|
||||
- TSS_USER_NAME, TSS_GROUP_NAME);
|
||||
+ "root", TSS_GROUP_NAME);
|
||||
return TCSERR(TSS_E_INTERNAL_ERROR);
|
||||
}
|
||||
|
||||
- /* make sure only the tss user can manipulate the config file */
|
||||
+ /* make sure only the tss user can read (but not manipulate) the config file */
|
||||
if (((stat_buf.st_mode & 0777) ^ mode) != 0) {
|
||||
- LogError("TCSD config file (%s) must be mode 0600", tcsd_config_file);
|
||||
+ LogError("TCSD config file (%s) must be mode 0640", tcsd_config_file);
|
||||
return TCSERR(TSS_E_INTERNAL_ERROR);
|
||||
}
|
||||
#endif /* SOLARIS */
|
||||
--
|
||||
2.20.1
|
||||
|
||||
24
package/trousers/0003-Fix-build-with-LibreSSL-2-7.patch
Normal file
24
package/trousers/0003-Fix-build-with-LibreSSL-2-7.patch
Normal file
@@ -0,0 +1,24 @@
|
||||
Fix build with LibreSSL 2.7
|
||||
|
||||
LibreSSL 2.7 implemented OpenSSL 1.1 API
|
||||
|
||||
See also: https://reviews.freebsd.org/D14849#change-KhYbRXBMIBod
|
||||
|
||||
Cheers,
|
||||
Bernard Spil (brnrd@FreeBSD.org)
|
||||
|
||||
[Retrieved (and backported) from:
|
||||
https://sourceforge.net/p/trousers/bugs/234]
|
||||
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
||||
|
||||
--- ./src/trspi/crypto/openssl/rsa.c.orig 2016-11-23 12:26:19 UTC
|
||||
+++ ./src/trspi/crypto/openssl/rsa.c
|
||||
@@ -38,7 +38,7 @@
|
||||
#define DEBUG_print_openssl_errors()
|
||||
#endif
|
||||
|
||||
-#if (OPENSSL_VERSION_NUMBER < 0x10100001L) || defined(LIBRESSL_VERSION_NUMBER)
|
||||
+#if (OPENSSL_VERSION_NUMBER < 0x10100001L) || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20700000L)
|
||||
static int
|
||||
RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d)
|
||||
{
|
||||
@@ -1,41 +0,0 @@
|
||||
From c9b8c4434f3b11bae4f7e72c3aec5b4f3459eecc Mon Sep 17 00:00:00 2001
|
||||
From: Jerry Snitselaar <jsnitsel@redhat.com>
|
||||
Date: Wed, 18 Mar 2020 14:10:35 -0700
|
||||
Subject: [PATCH] trousers: resolve build failure
|
||||
|
||||
The global variables tcsd_sa_chld and tcsd_sa_int in tcsd.h are
|
||||
causing build failures in latest Fedora release:
|
||||
|
||||
/usr/bin/ld: ../../src/tcs/libtcs.a(libtcs_a-tcsi_changeauth.o):/builddir/build/BUILD/trousers-0.3.13/src/tcs/../include/tcsd.h:169: multiple definition of `tcsd_sa_chld'; tcsd-svrside.o:/builddir/build/BUILD/trousers-0.3.13/src/tcsd/../../src/include/tcsd.h:169: first defined here
|
||||
/usr/bin/ld: ../../src/tcs/libtcs.a(libtcs_a-tcsi_changeauth.o):/builddir/build/BUILD/trousers-0.3.13/src/tcs/../include/tcsd.h:168: multiple definition of `tcsd_sa_int'; tcsd-svrside.o:/builddir/build/BUILD/trousers-0.3.13/src/tcsd/../../src/include/tcsd.h:168: first defined here
|
||||
|
||||
They are no longer used since 9b40e581470b ("Improved daemon's signal
|
||||
handling") so just remove them.
|
||||
|
||||
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
|
||||
Signed-off-by: Debora Velarde Babb <debora@linux.ibm.com>
|
||||
[Retrieved from:
|
||||
https://sourceforge.net/p/trousers/trousers/ci/c9b8c4434f3b11bae4f7e72c3aec5b4f3459eecc]
|
||||
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
|
||||
---
|
||||
src/include/tcsd.h | 6 ------
|
||||
1 file changed, 6 deletions(-)
|
||||
|
||||
diff --git a/src/include/tcsd.h b/src/include/tcsd.h
|
||||
index 5b9462b..f5c286e 100644
|
||||
--- a/src/include/tcsd.h
|
||||
+++ b/src/include/tcsd.h
|
||||
@@ -164,10 +164,4 @@ TSS_RESULT tcsd_thread_create(int, char *);
|
||||
void *tcsd_thread_run(void *);
|
||||
void thread_signal_init();
|
||||
|
||||
-/* signal handling */
|
||||
-#ifndef __APPLE__
|
||||
-struct sigaction tcsd_sa_int;
|
||||
-struct sigaction tcsd_sa_chld;
|
||||
-#endif
|
||||
-
|
||||
#endif
|
||||
--
|
||||
2.28.0
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# http://sourceforge.net/projects/trousers/files/trousers/0.3.14/
|
||||
sha1 9ca2cc9e1179465f6c5d9055e2b855e25031b85a trousers-0.3.14.tar.gz
|
||||
md5 4a476b4f036dd20a764fb54fc24edbec trousers-0.3.14.tar.gz
|
||||
# http://sourceforge.net/projects/trousers/files/trousers/0.3.15/
|
||||
sha1 75cd40e17c9385299e50ff2099905865442b59f1 trousers-0.3.15.tar.gz
|
||||
md5 eb1b02e98c7d360749b9076196db3f0f trousers-0.3.15.tar.gz
|
||||
# Locally computed
|
||||
sha256 ce50713a261d14b735ec9ccd97609f0ad5ce69540af560e8c3ce9eb5f2d28f47 trousers-0.3.14.tar.gz
|
||||
sha256 1ad596d12e7471549663c03e280b5b5d084a2e853fb86e4d766109818f9d7dae LICENSE
|
||||
sha256 1e5be93e518372acf1d92d2f567d01a46fdb0b730487e544e6fb896c59cac77f trousers-0.3.15.tar.gz
|
||||
sha256 1ad596d12e7471549663c03e280b5b5d084a2e853fb86e4d766109818f9d7dae LICENSE
|
||||
|
||||
@@ -4,18 +4,16 @@
|
||||
#
|
||||
################################################################################
|
||||
|
||||
TROUSERS_VERSION = 0.3.14
|
||||
TROUSERS_VERSION = 0.3.15
|
||||
TROUSERS_SITE = http://downloads.sourceforge.net/project/trousers/trousers/$(TROUSERS_VERSION)
|
||||
TROUSERS_LICENSE = BSD-3-Clause
|
||||
TROUSERS_LICENSE_FILES = LICENSE
|
||||
TROUSERS_CPE_ID_VENDOR = trustedcomputinggroup
|
||||
TROUSERS_INSTALL_STAGING = YES
|
||||
# Need autoreconf because of a patch touching configure.in and Makefile.am
|
||||
TROUSERS_AUTORECONF = YES
|
||||
TROUSERS_DEPENDENCIES = host-pkgconf openssl
|
||||
|
||||
# 0003-Correct-multiple-security-issues-that-are-present-if.patch
|
||||
TROUSERS_IGNORE_CVES += CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
|
||||
|
||||
ifeq ($(BR2_PACKAGE_LIBICONV),y)
|
||||
TROUSERS_DEPENDENCIES += libiconv
|
||||
endif
|
||||
|
||||
Reference in New Issue
Block a user