Enhancements/Bugs closed WW32!
Stephen Jolley
All,
Thanks,
Stephen K. Jolley Yocto Project Program Manager ( Cell: (208) 244-4460 * Email: sjolley.yp.pm@...
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Current high bug count owners for Yocto Project 3.2
Stephen Jolley
All,
Thanks,
Stephen K. Jolley Yocto Project Program Manager ( Cell: (208) 244-4460 * Email: sjolley.yp.pm@...
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Yocto Project Newcomer & Unassigned Bugs - Help Needed
Stephen Jolley
All,
The triage team is starting to try and collect up and classify bugs which a newcomer to the project would be able to work on in a way which means people can find them. They're being listed on the triage page under the appropriate heading:
https://wiki.yoctoproject.org/wiki/Bug_Triage#Newcomer_Bugs
The idea is these bugs should be straight forward for a person to help work on who doesn't have deep experience with the project. If anyone can help, please take ownership of the bug and send patches! If anyone needs help/advice there are people on irc who can likely do so, or some of the more experienced contributors will likely be happy to help too.
Also, the triage team meets weekly and does its best to handle the bugs reported into the Bugzilla. The number of people attending that meeting has fallen, as have the number of people available to help fix bugs. One of the things we hear users report is they don't know how to help. We (the triage team) are therefore going to start reporting out the currently 340 unassigned or newcomer bugs.
We're hoping people may be able to spare some time now and again to help out with these. Bugs are split into two types, "true bugs" where things don't work as they should and "enhancements" which are features we'd want to add to the system. There are also roughly four different "priority" classes right now, “3.1”, “3.2, "3.99" and "Future", the more pressing/urgent issues being in "3.1" and then “3.2”.
Please review this link and if a bug is something you would be able to help with either take ownership of the bug, or send me (sjolley.yp.pm@...) an e-mail with the bug number you would like and I will assign it to you (please make sure you have a Bugzilla account). The list is at: https://wiki.yoctoproject.org/wiki/Bug_Triage_Archive#Unassigned_or_Newcomer_Bugs
Thanks,
Stephen K. Jolley Yocto Project Program Manager ( Cell: (208) 244-4460 * Email: sjolley.yp.pm@...
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
did you look at
toggle quoted message
Show quoted text
https://github.com/kraj/meta-openwrt/blob/master/recipes-networking/ipset/ipset_6.38.bb On Mon, Aug 17, 2020 at 10:14 AM Rob Prowel <rprowel@...> wrote:
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[meta-security][PATCH] trousers: Several Security fixes
From: Armin Kuster <akuster@...>
Fixes: CVE-2020-24332 CVE-2020-24330 CVE-2020-24331 Signed-off-by: Armin Kuster <akuster@...> --- ...-security-issues-that-are-present-if.patch | 94 +++++++++++++++++++ meta-tpm/recipes-tpm/trousers/trousers_git.bb | 1 + 2 files changed, 95 insertions(+) create mode 100644 meta-tpm/recipes-tpm/trousers/files/0001-Correct-multiple-security-issues-that-are-present-if.patch diff --git a/meta-tpm/recipes-tpm/trousers/files/0001-Correct-multiple-security-issues-that-are-present-if.patch b/meta-tpm/recipes-tpm/trousers/files/0001-Correct-multiple-security-issues-that-are-present-if.patch new file mode 100644 index 0000000..72c81d1 --- /dev/null +++ b/meta-tpm/recipes-tpm/trousers/files/0001-Correct-multiple-security-issues-that-are-present-if.patch @@ -0,0 +1,94 @@ +From e74dd1d96753b0538192143adf58d04fcd3b242b Mon Sep 17 00:00:00 2001 +From: Matthias Gerstner <mgerstner@...> +Date: Fri, 14 Aug 2020 22:14:36 -0700 +Subject: [PATCH] Correct multiple security issues that are present if the tcsd + is started by root instead of the tss user. + +Patch fixes the following 3 CVEs: + +CVE-2020-24332 +If the tcsd daemon is started with root privileges, +the creation of the system.data file is prone to symlink attacks + +CVE-2020-24330 +If the tcsd daemon is started with root privileges, +it fails to drop the root gid after it is no longer needed + +CVE-2020-24331 +If the tcsd daemon is started with root privileges, +the tss user has read and write access to the /etc/tcsd.conf file + +Authored-by: Matthias Gerstner <mgerstner@...> +Signed-off-by: Debora Velarde Babb <debora@...> + +Upstream-Status: Backport +CVE: CVE-2020-24332 +CVE: CVE-2020-24330 +CVE: CVE-2020-24331 + +Signed-off-by: Armin Kuster <akuster@...> + +--- + src/tcs/ps/tcsps.c | 2 +- + src/tcsd/svrside.c | 1 + + src/tcsd/tcsd_conf.c | 10 +++++----- + 3 files changed, 7 insertions(+), 6 deletions(-) + +Index: git/src/tcs/ps/tcsps.c +=================================================================== +--- git.orig/src/tcs/ps/tcsps.c ++++ git/src/tcs/ps/tcsps.c +@@ -72,7 +72,7 @@ get_file() + } + + /* open and lock the file */ +- system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR, 0600); ++ system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR|O_NOFOLLOW, 0600); + if (system_ps_fd < 0) { + LogError("system PS: open() of %s failed: %s", + tcsd_options.system_ps_file, strerror(errno)); +Index: git/src/tcsd/svrside.c +=================================================================== +--- git.orig/src/tcsd/svrside.c ++++ git/src/tcsd/svrside.c +@@ -473,6 +473,7 @@ main(int argc, char **argv) + } + return TCSERR(TSS_E_INTERNAL_ERROR); + } ++ setgid(pwd->pw_gid); + setuid(pwd->pw_uid); + #endif + #endif +Index: git/src/tcsd/tcsd_conf.c +=================================================================== +--- git.orig/src/tcsd/tcsd_conf.c ++++ git/src/tcsd/tcsd_conf.c +@@ -743,7 +743,7 @@ conf_file_init(struct tcsd_config *conf) + #ifndef SOLARIS + struct group *grp; + struct passwd *pw; +- mode_t mode = (S_IRUSR|S_IWUSR); ++ mode_t mode = (S_IRUSR|S_IWUSR|S_IRGRP); + #endif /* SOLARIS */ + TSS_RESULT result; + +@@ -798,15 +798,15 @@ conf_file_init(struct tcsd_config *conf) + } + + /* make sure user/group TSS owns the conf file */ +- if (pw->pw_uid != stat_buf.st_uid || grp->gr_gid != stat_buf.st_gid) { ++ if (stat_buf.st_uid != 0 || grp->gr_gid != stat_buf.st_gid) { + LogError("TCSD config file (%s) must be user/group %s/%s", tcsd_config_file, +- TSS_USER_NAME, TSS_GROUP_NAME); ++ "root", TSS_GROUP_NAME); + return TCSERR(TSS_E_INTERNAL_ERROR); + } + +- /* make sure only the tss user can manipulate the config file */ ++ /* make sure only the tss user can read (but not manipulate) the config file */ + if (((stat_buf.st_mode & 0777) ^ mode) != 0) { +- LogError("TCSD config file (%s) must be mode 0600", tcsd_config_file); ++ LogError("TCSD config file (%s) must be mode 0640", tcsd_config_file); + return TCSERR(TSS_E_INTERNAL_ERROR); + } + #endif /* SOLARIS */ diff --git a/meta-tpm/recipes-tpm/trousers/trousers_git.bb b/meta-tpm/recipes-tpm/trousers/trousers_git.bb index fe8f557..95e821b 100644 --- a/meta-tpm/recipes-tpm/trousers/trousers_git.bb +++ b/meta-tpm/recipes-tpm/trousers/trousers_git.bb @@ -16,6 +16,7 @@ SRC_URI = " \ file://tcsd.service \ file://get-user-ps-path-use-POSIX-getpwent-instead-of-getpwe.patch \ file://0001-build-don-t-override-localstatedir-mandir-sysconfdir.patch \ + file://0001-Correct-multiple-security-issues-that-are-present-if.patch \ " S = "${WORKDIR}/git" -- 2.17.1 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
Rob Prowel <rprowel@...>
On 2020-08-17 13:13, Rob Prowel wrote:
I'm trying to add the ipset utility to my arm build so that I can group IP/ports for use in tc and netfilter. I was able to update the vendor supplied iptools2 recipe to install tc and iptables, but ipset is a fresh recipe, not included in another existing layer.As a followup... Some of the inheritance and dependencies of the thread referenced openWRT bb file was necessary to make it work. Should note that inheriting autotools hopelessly breaks the build, but as shown below, the ipset utility is correctly staged in my target image, with no errors or warnings. Thanks, all! # -------------------------------------------------------------------- DEPENDS = "libtool libmnl" RDEPENDS_${PN} = "kernel-module-ip-set" SRC_URI = "file://ipset-7.6.tar.bz2;name=tar" SRC_URI[md5sum] = "e107b679c3256af795261cece864d6d9" # inherit autotools pkgconfig module-base inherit pkgconfig module-base S = "${WORKDIR}/ipset-7.6" EXTRA_OECONF += "-with-kbuild=${KBUILD_OUTPUT} --with-ksource=${STAGING_KERNEL_DIR}" do_configure(){ ./configure --prefix=/ --host=arm-vendor-linuxeabi } do_compile(){ make DESTDIR=${D} } do_install(){ oe_runmake install DESTDIR=${D} rm -rf ${D}/share rm -rf ${D}/include rm -rf ${D}/lib } |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
Alexander Kanavin
DEPENDS adds the dependencies into $WORKDIR/recipe-sysroot, and native pkg-config looks there for .pc files in that directory. Alex On Mon, 17 Aug 2020 at 21:31, Rob Prowel <rprowel@...> wrote: On 2020-08-17 14:25, Alexander Kanavin wrote: |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
Rob Prowel <rprowel@...>
On 2020-08-17 15:38, Konrad Weihmann wrote:
Did you had a look at https://github.com/kraj/meta-openwrt/blob/master/recipes-networking/ipset/ipset_6.38.bb yet?Thanks for the suggestion, but that breaks it worse than the "from scratch" recipe. At the point I was at, I just need to know how to "correctly" make PKG_CONFIG_PATH locate the libmnl.pc that already exists and is a requirement for other packages. Need a better explanation of environment variables that are available during the tasks phases. Since libmnl is already available then in theory it should just be pointing the PKG_CONFIG_PATH correctly. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
Konrad Weihmann <kweihmann@...>
Did you had a look at https://github.com/kraj/meta-openwrt/blob/master/recipes-networking/ipset/ipset_6.38.bb yet?
toggle quoted message
Show quoted text
That pretty much looks like the one you were looking for, but for an older version, right? Maybe you can try to use that recipe as a basis for your update package On 17.08.20 20:25, Alexander Kanavin wrote:
You need to add DEPENDS = "libmnl" maybe? |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
Rob Prowel <rprowel@...>
On 2020-08-17 14:25, Alexander Kanavin wrote:
You need to add DEPENDS = "libmnl" maybe?Tried both: DEPENDS and RDEPENDS. libmnl.pc does exist in another tree but not visible to the ipset and not sure what environment var is proper to bring it into the build for ipset.bb There is a temp/sysroots-components/... tree that contains the .pc file, but it's not visible to the ipset.bb recipe. How do I make it visible in a way that's not a hack? tmp/sysroots-components/cortexa9hf-neon/libmnl/usr/lib/pkgconfig/libmnl.pc is not visible under ${WORKDIR} On Mon, 17 Aug 2020 at 19:14, Rob Prowel <rprowel@...> wrote:I'm trying to add the ipset utility to my arm build so that I can group |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: pkg-config dependencies?
Alexander Kanavin
You need to add DEPENDS = "libmnl" maybe? RDEPENDS is needed for runtime things like script interpreters or supplementary data; plain library dependencies are build-time. Alex On Mon, 17 Aug 2020 at 19:14, Rob Prowel <rprowel@...> wrote: I'm trying to add the ipset utility to my arm build so that I can group |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
pkg-config dependencies?
Rob Prowel <rprowel@...>
I'm trying to add the ipset utility to my arm build so that I can group IP/ports for use in tc and netfilter. I was able to update the vendor supplied iptools2 recipe to install tc and iptables, but ipset is a fresh recipe, not included in another existing layer.
I'm adding the following in its bb file: # ----------------------------------------------------------------- SRC_URI = "file://ipset-7.6.tar.bz2" SRC_URI[md5sum] = "3a6f5952fd1bcf0eefb9c7c087acbfc9" inherit pkgconfig S = "${WORKDIR}/ipset-7.6" RDEPENDS_${PN} += "libmnl" FILES_${PN} = "" # list will be populated once I know what the package wants to install do_configure(){ ./configure --prefix=/ --host=arm-linuxeabi } do_compile(){ make DESTDIR=${D} } do_install(){ oe_runmake install DESTDIR=${D} } # ----------------------------------------------------------------- problem is that it depends on libmnl (which already exists as a lower layer recipe), and the ipset configure script barfs on pkg-config with the following message. | checking whether ln -s works... yes | checking for libmnl... no | configure: error: Package requirements (libmnl >= 1) were not met: | | No package 'libmnl' found | | Consider adjusting the PKG_CONFIG_PATH environment variable if you | installed software in a non-standard prefix. | | Alternatively, you may set the environment variables libmnl_CFLAGS | and libmnl_LIBS to avoid the need to call pkg-config. | See the pkg-config man page for more details. | WARNING: exit code 1 from a shell command. the PKG_CONFIG_PATH variable seems correct under devshell, but there is no libmnl.pc file in there. How do I force libmnl to create and stage a proper pkg-config .pc file where it needs to be? |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: [auh] [PATCH RESEND 5/5] consistent naming for upgradehelper.py
Quentin Schulz
On August 16, 2020 11:57:54 PM GMT+02:00, Alexander Kanavin <alex.kanavin@...> wrote:
Thanks, I have added this to AUH repo too now; I assume there are noNo change in any of the patches that I've resent. Quentin |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: QA notification for completed autobuilder build (yocto-3.0.4.rc1)
Richard Purdie
On Mon, 2020-08-17 at 09:48 +0200, Zoran Stojsavljevic wrote:
Yocto Project is an open source project and it accepts contributions toIntel and WR YP QA is planning for QA execution for YPWith all due respect... INTEL part I'll drop out. ;-) both code and in other work like QA from anyone. The QA process is publicly documented, publicly announced and anyone can help with ensuring our releases are up to the quality expected of us. It is perfectly reasonable that companies stepping forward like this to do work can refer to themselves by name. Cheers, Richard |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: QA notification for completed autobuilder build (yocto-3.0.4.rc1)
Sangeeta Jain
Apologies for the typo in mail earlier, Here’s the corrected one:
Hello All,
From: yocto@... <yocto@...>
On Behalf Of Zoran
Sent: Monday, 17 August, 2020 3:49 PM To: Jain, Sangeeta <sangeeta.jain@...> Cc: yocto@...; otavio@...; yi.zhao@...; Sangal, Apoorv <apoorv.sangal@...>; Yeoh, Ee Peng <ee.peng.yeoh@...>; Chan, Aaron Chun Yew <aaron.chun.yew.chan@...>; richard.purdie@...; akuster808@...; sjolley.yp.pm@... Subject: Re: [yocto] QA notification for completed autobuilder build (yocto-3.0.4.rc1)
> Intel and WR YP QA is planning for QA execution for YP > build yocto-3.0.3.rc2.
With all due respect... INTEL part I'll drop out. ;-)
Better to keep YOCTO as an Open Source project without mentioning ECO systems financing it... Correct?!
YOCTO is an (Force Major context) Open Source project... Isn't it?!
Yes, Yocto is an Open Source project. Reason behind mentioning the QA teams is to acknowledge that someone is working on it and which parts are covered in testing.
Thank you, Zoran Stojsavljevic _______
On Mon, Aug 17, 2020 at 9:09 AM Sangeeta Jain <sangeeta.jain@...> wrote:
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: QA notification for completed autobuilder build (yocto-3.0.4.rc1)
Zoran
> Intel and WR YP QA is planning for QA execution for YP > build yocto-3.0.3.rc2. With all due respect... INTEL part I'll drop out. ;-) Better to keep YOCTO as an Open Source project without mentioning ECO systems financing it... Correct?! YOCTO is an (Force Major context) Open Source project... Isn't it?! Thank you, Zoran Stojsavljevic _______ On Mon, Aug 17, 2020 at 9:09 AM Sangeeta Jain <sangeeta.jain@...> wrote: Hello All, |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: QA notification for completed autobuilder build (yocto-3.0.4.rc1)
Sangeeta Jain
Hello All,
toggle quoted message
Show quoted text
Intel and WR YP QA is planning for QA execution for YP build yocto-3.0.3.rc2. We are planning to execute following tests for this cycle: OEQA-manual tests for following module: 1. OE-Core 2. BSP-hw Runtime auto test for following platforms: 1. MinnowTurbot 32-bit 2. Coffee Lake 3. NUC 7 4. NUC 6 5. Edgerouter 6. MPC8315e-rdb 7. Beaglebone ETA for completion is next Wednesday, Aug 19. Thanks, Sangeeta -----Original Message----- |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: NO INTERNET ENVIRONMENT - USING PREMIRROR fails -> gstreamer1.0_1.12.2.bb:do_unpack failed due to a fetch issue
baranarman@...
Hi Martin,
I am still stuck with this issue, I understood that the autogen.sh is the point where it wants to update the common submodule. Even if BB_NO_NETWORK is set it still tries to access the https://anongit.freedesktop.org/git/gstreamer/common.git Which I think is quite surprising! But about the following lines, I don't know how to do the described thing. Usually it was failing in do_configure when building without access to this git repo, we were adding "common" git repo to SRC_URI explicitly to make sure that the right revision is always there with the gstreamer sources and managed with bitbake fetcher (so that it's used from downloads directory instead of the fetch from internet every single time gst* recipes are rebuilt for whatever reason).
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Re: [auh] [PATCH RESEND 5/5] consistent naming for upgradehelper.py
Alexander Kanavin
Thanks, I have added this to AUH repo too now; I assume there are no changes in the re-sent patchset otherwise? Alex On Sun, 16 Aug 2020 at 23:39, Quentin Schulz <foss@...> wrote: Rename upgradehelper.py into upgrade-helper.py since the conf file and the git |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[yocto-autobuilder-helper] [PATCH] scripts: run-auh: update upgrade-helper name
Quentin Schulz
Since https://lists.yoctoproject.org/g/yocto/message/50282 was merged in
autoupgrade-helper git repo, the python script isn't called upgradehelper.py anymore but upgrade-helper.py for consistency sake. Let's update the run-auh script so that it's still working. Signed-off-by: Quentin Schulz <foss@...> --- scripts/run-auh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/run-auh b/scripts/run-auh index 29a8044..7a9ab70 100755 --- a/scripts/run-auh +++ b/scripts/run-auh @@ -22,7 +22,7 @@ git fetch origin git checkout -B tmp-auh-upgrades origin/master source $poky_dir/oe-init-build-env $build_dir -$auh_dir/upgradehelper.py -e all +$auh_dir/upgrade-helper.py -e all # clean up to avoid the disk filling up rm -rf $build_dir/tmp/ -- 2.26.2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|