Commit Graph

1218 Commits

Author SHA1 Message Date
Hauke Mehrtens
d1427863ba uci: update to git HEAD
3cda251 file: Fix uci -m import command
5781664 remove internal usage of redundant uci_ptr.last

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-08-10 23:09:37 +02:00
Felix Fietkau
fdadfb633f ubus: update to the latest version
f787c97b3489 libubus: add missing uloop_fd_delete call in ubus_shutdown

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-08-10 19:09:42 +02:00
Rafał Miłecki
4a57e786a1 urngd: fix archived tar hash
Due to some hiccup my local urngd-2023-07-25-7aefb47b.tar.xz ended up
being different from archived one. Repackaging it locally confirmed the
previous hash was incorrect.

Fixes: c74b5e09e6 ("urngd: update to the latest master")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2023-07-30 12:42:43 +02:00
Jo-Philipp Wich
4987a409a7 procd: improve status reporting for partially running services
The existing implementation incorrectly reported `running` for services
without any instances or with all instances stopped/terminated.

Improve the default implementation of `/etc/init.d/* status` to properly
report services with not running instances. In case a service exists,
but without running instance, the status call will now report
"not running" with exit code 5. In case some instances are running and
some are stopped/terminated, the call will report "running (X/Y)" where
`X` denoted the amount of running instances and `Y` the amount of total
registered ones.

Ref: https://forum.openwrt.org/t/x/159443
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2023-07-27 13:31:18 +02:00
Rafał Miłecki
c74b5e09e6 urngd: update to the latest master
7aefb47 jitterentropy-rngd: update to the v1.2.0

What's interesting about jitterentropy-rngd v1.2.0 release is that it
bumps its copy of jitterentropy-library from v2.2.0 to the v3.0.0. That
bump includes a relevant commit 3130cd9 ("replace LSFR with SHA-3 256").

When initializing entropy jent calculates time delta. Time values are
obtained using clock_gettime() + CLOCK_REALTIME. There is no guarantee
from CLOCK_REALTIME of unique values and slow devices often return
duplicated ones.

A switch from jent_lfsr_time() to jent_hash_time() resulted in many less
cases of zero delta and avoids ECOARSETIME.

Long story short: on some system this fixes:
[    6.722725] urngd: jent-rng init failed, err: 2

This is important change for BCM53573 which doesn't include hwrng and
seems to have arch_timer running at 36,8 Hz.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2023-07-25 10:04:34 +02:00
Hauke Mehrtens
2486841c1b rpcd: update to latest git HEAD
c07ab2f iwinfo: update byte counter to 64bit

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-07-01 12:14:07 +02:00
Hauke Mehrtens
3596380987 procd: update to latest git HEAD
122a5e3 Revert "sysupgrade: print errno on failure"
2db8365 system: add RISC-V CPU info

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-06-25 22:48:55 +02:00
Hauke Mehrtens
9d8d65322c rpcd: update to latest git HEAD
31c3907 file: strengthen exec access control

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-06-25 22:48:55 +02:00
Linhui Liu
4c5a9da869 selinux-policy: update to 1.2.5
30d503a uci jsonfilter: pipe and leak
e13cb64 rpcd leds
144781f jsonfilter, luci, ubus
1210762 rpcd and all agents get fd's leaked
ab9227c rpcd
2f99e0e luci rpcd
b43aaf3 rpcd (enable/disable services) luci peeraddr
f20f03e rpcd
7bc74f6 rpcd reads all subj state and luci-bwc leaks
9634b17 adds inotify perms to anon_inode
3d3c17c adds bare anon_inode (linux 5.15)
7104b20 dnsmasq and luci
0de2c66 luci,rpcd, ucode, wpad
14f5cf9 luci and ucode
e3ce84c rpcd, ucode and cgiio loose ends
96a2401 misc updates
9fe0490 initscript: remove redundant rules
71bd77e allow all init scripts to log to logd
f697331 sandbox: make ttydev handling more robust
a471877 simplify pty tty console access
f738984 sandbox: also remove TIOSCTI from all ttydevs

Signed-off-by: Linhui Liu <liulinhui36@gmail.com>
2023-05-31 22:00:48 +02:00
Tianling Shen
7c83b6ac86 ca-certificates: Update to version 20230311
Update the ca-certificates and ca-bundle package from version 20211016 to
version 20230311.

Use TAR_OPTIONS instead of hacking Build/Prepare, refresh patches.

Debian change-log entry [1]:
|[...]
|[ Đoàn Trần Công Danh ]
|* ca-certificates: compat with non-GNU mktemp (closes: #1000847)
|
|[ Ilya Lipnitskiy ]
|* certdata2pem.py: use UTC time when checking cert validity
|
|[ Julien Cristau ]
|* Update Mozilla certificate authority bundle to version 2.60
|   The following certificate authorities were added (+):
|   + "Autoridad de Certificacion Firmaprofesional CIF A62634068"
|   + "Certainly Root E1"
|   + "Certainly Root R1"
|   + "D-TRUST BR Root CA 1 2020"
|   + "D-TRUST EV Root CA 1 2020"
|   + "DigiCert TLS ECC P384 Root G5"
|   + "DigiCert TLS RSA4096 Root G5"
|   + "E-Tugra Global Root CA ECC v3"
|   + "E-Tugra Global Root CA RSA v3"
|   + "HARICA TLS ECC Root CA 2021"
|   + "HARICA TLS RSA Root CA 2021"
|   + "HiPKI Root CA - G1"
|   + "ISRG Root X2"
|   + "Security Communication ECC RootCA1"
|   + "Security Communication RootCA3"
|   + "Telia Root CA v2"
|   + "TunTrust Root CA"
|   + "vTrus ECC Root CA"
|   + "vTrus Root CA"
|  The following certificate authorities were removed (-):
|  - "Cybertrust Global Root" (expired)
|  - "EC-ACC"
|  - "GlobalSign Root CA - R2" (expired)
|  - "Hellenic Academic and Research Institutions RootCA 2011"
|  - "Network Solutions Certificate Authority"
|  - "Staat der Nederlanden EV Root CA" (expired)
|* Drop trailing space from debconf template causing misformatting
|  (closes: #980821)
|
|[ Wataru Ashihara ]
|* Make certdata2pem.py compatible with cryptography >= 35 (closes: #1008244)
|[...]

[1]: https://metadata.ftp-master.debian.org/changelogs/main/c/ca-certificates/ca-certificates_20230311_changelog

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-05-27 22:51:18 +02:00
Tianling Shen
48ed07bc0b treewide: replace AUTORELEASE with real PKG_RELEASE
Based on Paul Fertser <fercerpav@gmail.com>'s guidance:
Change AUTORELEASE in rules.mk to:
```
AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile))
```

then update all affected packages by:
```
for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';);
do
	make package/$i/clean
done
```

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2023-05-18 11:35:29 +02:00
Christian Lamparter
1d49310fdb ath79: add Cisco Meraki MR18
Specifications:

SOC:    Atheros/Qualcomm QCA9557-AT4A @ 720MHz
RAM:    2x Winbond W9751G6KB-25 (128 MiB)
FLASH:  Hynix H27U1G8F2BTR-BC TSOP48 ONFI NAND (128 MiB)
WIFI1:  Atheros AR9550 5.0GHz (SoC)
WIFI2:  Atheros AR9582-AR1A 2.4GHz
WIFI2:  Atheros AR9582-AR1A 2.4GHz + 5GHz
PHYETH: Atheros AR8035-A, 802.3af PoE capable Atheros (1x Gigabit LAN)
LED:    1x Power-LED, 1 x RGB Tricolor-LED
INPUT:  One Reset Button
UART:   JP1 on PCB (Labeled UART), 3.3v-Level, 115200n8
        (VCC, RX, TX, GND - VCC is closest to the boot set jumper
	 under the console pins.)

Flashing instructions:

Depending on the installed firmware, there are vastly different
methods to flash a MR18. These have been documented on:
<https://openwrt.org/toh/meraki/mr18>

Tip:
Use an initramfs from a previous release and then use sysupgrade
to get to the later releases. This is because the initramfs can
no longer be built by the build-bots due to its size (>8 MiB).

Note on that:
Upgrades from AR71XX releases are possible, but they will
require the force sysupgrade option ( -F ).

Please backup your MR18's configuration before starting the
update. The reason here is that a lot of development happend
since AR71XX got removed, so I do advise to use the ( -n )
option for sysupgrade as well. This will cause the device
to drop the old AR71xx configuration and make a new
configurations from scratch.

Note on LEDs:
The LEDs has changed since AR71XX. The white LED is now used during
the boot and when upgrading instead of the green tricolor LED. The
technical reason is that currently the RGB-LED is brought up later
by a userspace daemon.

(added warning note about odm-caldata partition. remove initramfs -
it's too big to be built by the bots. MerakiNAND -> meraki-header.
sort nu801's targets)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2023-05-14 00:08:35 +02:00
Andre Heider
07730ff346
treewide: add support for "lto" in PKG_BUILD_FLAGS
This reduces open coding and allows to easily add a knob to enable
it treewide, where chosen packages can still opt-out via "no-lto".

Some packages used LTO, but not the linker plugin. This unifies 'em
all to attempt to produce better code.
Quoting man gcc(1):
"This improves the quality of optimization by exposing more code to the
link-time optimizer."

Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed
that every buildsystem uses +$(MAKE) correctly.

Signed-off-by: Andre Heider <a.heider@gmail.com>
2023-03-21 18:28:22 +01:00
Andre Heider
da3700988d
treewide: add support for "gc-sections" in PKG_BUILD_FLAGS
This reduces open coding and allows to easily add a knob to
enable it treewide, where chosen packages can still opt-out via
"no-gc-sections".

Note: libnl, mbedtls and opkg only used the CFLAGS part without the
LDFLAGS counterpart. That doesn't help at all if the goal is to produce
smaller binaries. I consider that an accident, and this fixes it.

Note: there are also packages using only the LDFLAGS part. I didn't
touch those, as gc might have been disabled via CFLAGS intentionally.

Signed-off-by: Andre Heider <a.heider@gmail.com>
2023-03-21 18:28:22 +01:00
Andre Heider
5c545bdb36
treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16
Keep backwards compatibility via PKG_USE_MIPS16 for now, as this is
used in all package feeds.

Signed-off-by: Andre Heider <a.heider@gmail.com>
2023-03-21 18:28:22 +01:00
Christian Marangi
6634fb00dd
rpcd: bump to latest git HEAD
d978830 rc: add option to get info for a single script in list method
632b4fc rc: add option to skip running check for list method
5577db9 rc: add support for scanning USE_PROCD and skip running if not supported
4de3f02 rc: fix and improve script scanning START and STOP

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-03-17 03:34:50 +01:00
Hauke Mehrtens
11822d8be2 uci: update to git HEAD
5de3871 cli: drop redundant uci_add_delta_path() call for -P
f49a2fd delta: simplify uci_load_delta() by using a helper
9b6605e uci: fix use-after-free uci_set on update option
b7ceda9 uci: maintain option position in uci_set
7e01d66 uci: optimize update option in uci_set
47697e6 uci: fix use-after-free uci_add_list
74f2797 uci: fix atomicity of uci_add_list
b2f3417 uci: maintain option position in uci_add_list
16e8a3b uci: fix memory leak uci_set on update section
ae61e1c uci: optimize update section in uci_set
04d0c46 uci: macro uci_alloc_element not in uci.h

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2023-03-05 16:39:24 +01:00
Rafał Miłecki
fdd1af9a44 fstools: update to the latest master
bfe882d libblkid-tiny: add exfat superblock support

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2023-02-28 10:05:19 +01:00
Daniel Golle
62e583ddb9 fstools: update to git HEAD
12155d3 libfstools: use class interface to iterate over ubi devices

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-02-15 03:27:35 +00:00
Christian Marangi
3ef655375a
fstools: bump to latest Git HEAD
14d535e partname: Correct fstools_partname_fallback_scan comparison

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-02-04 20:04:58 +01:00
Petr Štetiar
3d7d93cf65 ubus: fix wrong package mirror hash
I've somehow managed to commit wrong package mirror hash in commit 36076b5a40
("ubus: update to version 2022-06-15"), so lets fix it by using a proper
one.

Fixes: 36076b5a40 ("ubus: update to version 2022-06-15")
Reported-by: Andre Heider <a.heider@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-01-30 10:58:00 +01:00
Petr Štetiar
36076b5a40 ubus: update to version 2022-06-15
Update which contains just a following fix:

 * ubusd: add lookup command queuing support

   Defers and continues a client's lookup command to avoid unnecessary
   buffering under load.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2023-01-27 11:04:07 +01:00
Christian Marangi
114c168522
rpcd: bump libiwinfo abi requirement to >= 2023-01-21
Bump libiwinfo abi requirement to >= 2023-01-21 for rpcd.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-01-23 13:55:42 +01:00
Christian Marangi
fb7f4d4b54
fstool: bump to latest Git HEAD
1ea5855 partname: Introduce fstools_partname_fallback_scan option

While at it also drop AUTORELEASE from PKG_RELEASE.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-01-22 17:30:42 +01:00
Christian Marangi
5d409062a3
rpcd: update to latest Git HEAD
c0df2a7 iwinfo: add "band" and "mhz" to the scan output
06ad60f iwinfo: add "band" to the freqlist output
b32fd32 iwinfo: add flags to freqlist output

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-01-21 01:26:19 +01:00
Christian Marangi
bd0f9d8ffc
fstools: bump to latest Git HEAD
e9b59f0 partname: Ignore root=PARTUUID...

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2023-01-21 01:02:25 +01:00
Daniel Golle
f0a98bf048
procd: update to git HEAD
04d7570 jail: fs: don't overwrite existing mount target
 6b9629b jail: don't assume positive return value of creat
 190f13a init: attempt to mount efivarfs

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2023-01-16 22:05:01 +00:00
Hauke Mehrtens
f12bad6c19 tree-wide: Do not use package librt and libpthread
The libraries libpthread, libdl, libutil, libanl have been integrated
into the libc library in version 2.34. it is not needed to explicitly
link them any more.

Most of the functions have been moved from the librt.so into libc.so
some time ago already.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-12-29 18:50:24 +01:00
Jo-Philipp Wich
d15b1fbed7 rpcd: update to latest Git HEAD
7de4820 iwinfo: add "hwmodes_text" to the info output
b3f530b iwinfo: clean up rpc_iwinfo_call_hw_ht_mode()
c46ad61 iwinfo: reuse infos provided by libiwinfo
6c5e900 iwinfo: constify string map arg for rpc_iwinfo_call_int()

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-12-16 00:55:51 +01:00
Christian Marangi
ada4d0d0ab
iucode-tool: fix compile error with musl libc and USE_CPUID_DEVICE
Add patch to fix compilation error with USE_CPUID_DEVICE enabled and musl
used as libc. Musl doesn't add limits.h header by default and this is
required if USE_CPUID_DEVICE is used.

The package currently compile because fortify headers include limits.h
by default.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2022-12-04 13:21:46 +01:00
Andrew Ammerlaan
b2e83c16e1 procd: service: pass all arguments to service
Passing all arguments to /etc/init.d/$service restores the
behaviour of openwrt 21.02. This is relevant for services
such as etherwake which take more then one argument, e.g.:
"service etherwake start <list of devices to wake>"

Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
2022-11-13 21:51:10 +01:00
Daniel Golle
047d471317
procd: update to git HEAD
24f6bc4 jail: correctly check for null pointer
 93b2c2d jail: ignore missing .dynamic sect
 039b88f sysupgrade: print errno on failure

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-11-10 21:35:38 +00:00
Rafał Miłecki
8a4537d2a9 fstools: update to git HEAD
3affe9e block: try multiple NTFS filesystem implementations

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2022-11-10 14:09:07 +01:00
Daniel Golle
2c6b212a2f
fstools: update to git HEAD
ee54c6b libfstools: skip JFFS2 padding on block devices

Fixes config restore on the BPi R3 when using MMC storage.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-10-18 20:08:39 +01:00
Jo-Philipp Wich
db17c75271 rpcd: update to latest Git HEAD
8c852b6 ucode: write ucode runtime exceptions to stderr

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-10-15 00:39:48 +02:00
Jo-Philipp Wich
94129cbefb rpcd: update to latest Git HEAD
e80d0b2 ucode: pass-through `ubus_rpc_session` argument
0d02243 ucode: initialize module search path early

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-09-16 15:15:20 +02:00
Petr Štetiar
34ddd2e545 rpcd: bump version to 2022-08-24
gcc 10 with -O2 reports following:

 In function ‘strncpy’,
     inlined from ‘rpc_sys_packagelist’ at /opt/devel/openwrt/c-projects/rpcd/sys.c:244:4:
 /usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 128 equals destination size [-Werror=stringop-truncation]
   106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
       |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 In function ‘strncpy’,
     inlined from ‘rpc_sys_packagelist’ at /opt/devel/openwrt/c-projects/rpcd/sys.c:227:4:
 /usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 128 equals destination size [-Werror=stringop-truncation]
   106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
       |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Since it is not possible to avoid truncation by strncpy, it is necessary
to make sure the result of strncpy is properly NUL-terminated and the
NUL must be inserted explicitly, after strncpy has returned.

References: #10442
Reported-by: Alexey Smirnov <s.alexey@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2022-08-25 06:59:41 +02:00
Jo-Philipp Wich
66a360206e rpcd: update to latest Git HEAD
ae5afea ucode: parse ucode plugin scripts in raw mode, init search path

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-08-24 23:25:11 +02:00
Hauke Mehrtens
8456d06aa6 fstools: update to git HEAD
8c213b0 libfstools: Rename move_mount() function to ovl_move_mount() for glibc 2.36
81785c1 block: Do not include linux/fs.h any more

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-08-13 22:53:39 +02:00
Hauke Mehrtens
535bc61140 ubox: update to latest git HEAD
fa6cb9a kmodloader: fix bad realloc usage
4c7b720 kmodloader: fix GCC fanalyzer warnings

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2022-08-13 20:53:10 +02:00
Florian Eckert
885f04b305 fstools: add uci fstab section to conffiles for package block-mount
The command 'opkg search /etc/config/fstab' does not return a package
name for this config file. In order to know to which package this config
file belongs to, a 'conffiles' entry was made for this file to package
'block-mount'.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2022-08-12 22:07:09 +02:00
Christian Lamparter
e0e6444930 nu801: fix DEPENDS on bcm53xx
the tacked on @TARGET_bcm53xx causes warnings:
tmp/.config-package.in:14027:warning: ignoring unsupported character '@'
tmp/.config-package.in:26028:warning: ignoring unsupported character '@'

this was wrong.

Fixes: be1761fa14 ("nu801: add MR26 to the table")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-07-17 13:43:48 +02:00
Christian Marangi
e62d1edd6b
procd: update to git HEAD
ef5d3e3 jail: fix various ignoring return value compilation warning
8e4a956 jail: add WARNING macro to log non critical warning message

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2022-07-17 13:21:45 +02:00
Christian Marangi
d58ce80080
fstools: update to git HEAD
ebf7e90 libfstools: handle gzip return value in block_volume_format

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2022-07-17 13:21:45 +02:00
Christian Marangi
ef3d0a3029
ubox: update to latest git HEAD
46a33b8 kmodloader: fix compilation warning with not checking return of asprintf

Also switch PKG_RELEASE to AUTORELEASE.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2022-07-17 03:12:45 +02:00
Christian Lamparter
be1761fa14 nu801: add MR26 to the table
The MR26 uses a NU801 for the RGB-Leds. Make the LEDs
available.

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-07-15 15:21:44 +02:00
Josef Schlehofer
e21fea9289 opkg: update to 2022-02-24
Changes:
9c44557 opkg_remove: avoid remove pkg repeatly with option --force-removal-of-dependent-packages
2edcfad libopkg: set 'const' attribute for argv

This should fix the CI error in the packages repository, which happens with perl.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2022-06-27 00:57:15 +02:00
Daniel Golle
b641dadc13
fstools: update to git HEAD
93369be Revert "fstools: remove SELinux restorecon hack"

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-06-02 08:01:31 +01:00
Daniel Golle
1521d5f453
ubus: update to git HEAD
2f793a4 lua: add optional path filter to objects() method
 2bebf93 ubusd: handle invoke on event object without data

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-06-01 22:31:01 +01:00
Daniel Golle
4cbc26b212
procd: update to git HEAD
557c98e init: selinux: don't relabel virtual filesystems
 7a00968 init: only relabel rootfs if started from initramfs

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-06-01 20:49:01 +01:00
Christian 'Ansuel' Marangi
9b0f333f12 rpcd: update to latest Git HEAD
1c48257 iwinfo: fix compilation error with GCC 12

[remove extra change in Makefile]
Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
2022-06-01 15:24:06 +02:00
Christian 'Ansuel' Marangi
427a827d35 Revert "rpcd: update to latest Git HEAD"
This reverts commit 8885cf8827.
2022-06-01 15:21:34 +02:00
Christian 'Ansuel' Marangi
8885cf8827 rpcd: update to latest Git HEAD
1c48257 iwinfo: fix compilation error with GCC 12

Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
2022-06-01 14:46:04 +02:00
Dominick Grift
e01b1c22df selinux-policy: update to version 1.2.3
86ca9c6 devstatus: prints to terminal
95de949 deal with /rom/dev/console label inconsistencies
ab6b6ee uci: hack to deal with potentially mislabeled char files
acf9172 dnsmasq this can't be right
021db5b luci-app-tinyproxy
cf3a9c4 support/secmark: removes duplicate loopback rules
eeb2610 dhcp servers: recv dhcp client packets
d5a5fc3 more support/secmark "fixes"
35d8604 update support secmark
4c155c0 packets these were caused by labeling issues with loopback
fad35a5 nftables reads routing table
f9c5a04 umurmur: kill an mumur instance that does not run as root
10a10c6 mmc stordev make this consistent
ab3ec5b Makefile: sort with LC_ALL=C
b34eaa5 fwenv rules
8c2960f adds rfkill nodedev and some mmc partitions to stordev
5a9ffe9 rcboot runs fwenv with a transition
9954bf6 dnsmasq in case of tcp
ab66468 dnsmasq try this
5bfcb88 dnsmasq stubby not sure why this is happening
863f549 luci not sure why it recv and send server packets
d5cddb0 uhttpd sends sigkill luci cgi
44cc04d stubby: it does not maintain anything in there
db730b4 Adds stubby
ccbcf0e tor simplify network access
a308065 tor basic
a9c0163 znc loose ends
327a9af acme: allow acme_cleanup.sh to restart znc
4015614 basic znc
7ef14a2 support/secmark: clarify some things
3107afe README: todo qrencode
943035a README and secmark doc
4c90937 ttyd: fix that socket leak again
3239adf dnsmasq icmp packets and fix a tty leak issue
b41d38f Makefile: optimize
95d05b1 sandbox dontaudit ttyd leak
0b7d670 rpcd: reads mtu
e754bf1 opkg-lists try this
35fb530 opkg-lists: custom
4328754 opkg try to address mislabeled /tmp/opkg-lists
3e2385c rcnftqos
95eae2d ucode
c86d366 luci diagnostics
e10b443 rpcd packets and wireguard/luci
a25e020 igmpproxt packets
0106f00 luci
dcef79c nftqos related
3c9bc90 related to nft-qos and luci
f8502d4 dnsmasq more related to /usr/lib/dnsmasq/dhcp-script.sh
29a4271 dnsmasq: related to /usr/lib/dnsmasq/dhcp-script.sh
0c5805a some nft-qos
1100b41 adds a label for /tmp/.ujailnoafile
e141a83 initscript: i labeled ujail procd.execfile
a3b0302 Makefile: adds a default target + packets target
6a3f8ef label usign as opkg and label fwtool and sysupgrade
04d1cc7 sysupgrade: i meant don't do the fc spec
763bec0 sysupgrade: dont do /tmp/sysupgrade.img
af2306f adds a failsafe.tmpfile and labels validate_firmware_image
5b15760 fwenv: comment doesnt make sense
370ac3b fwenv: executes shell
67e3fcb fwenv: adds fw_setsys
544d211 adds procd execfile module to label procd related exec files
99d5f13 rclocalconffile: treat /etc/rc.button like /etc/rc.local
4dfd662 label uclient-fetch the same as wget
75d8212 osreleasemiscfile: adds /etc/device_info
0c1f116 adds a rcbuttonconffile for /etc/rc.button (base-files)
ccd23f8 adds a syslog.conffile for /etc/syslog.conf (busybox)
f790600 adds a libattr.conffile for /etc/xattr.conf
fcc028e fwenv: adds fwsys
1255470 xtables: various iptables alternatives
a7c4035 Revert "sqm: runs xtables, so also allow nftables"
0d331c3 sqm: runs xtables, so also allow nftables
f34076b acme: will run nftables in the near future
6217046 allow ssl.read types to read /tmp/etc/ssl/engines.cnf
d0deea3 fixes dns packets
8399efc Revert "sandbox: see if dontauditing this affects things"
73d716a sandbox: see if dontauditing this affects things
b5ee097 sandbox: also allow readinherited dropbear pipes
12ee46b iwinfo traverses /tmp/run/wpa_supplicant
4a4d724 agent.cil: also reads inherited dropbear pipes
d48013f support/secmark: i tightened my dns packet policy
645ad9e dns packets redone
4790b25 dnsnetpacket: fix obj macro template
d9fafff redo dns packets
0a68498 ttyd: leaks a netlink route socket
1d2e6be .gitattributes: remove todo
e1bb954 usbutil: reads bus sysfile symlinks
d275a32 support/secmark: clean it up a little
af5ce12 Makefile: exclude packet types in default make target
3caacdf support/secmark: document tunable/boolean
e3dd3e6 invalidpacketselinuxbool: make it build-time again
54f0ccf odhcpd packet fix
4a864ba contrib/secmark: add a big FAT warning
bead937 contrib/secmark: adds note about secmark support
146ae16 netpacket remove test
2ce9899 dns packets, odhcp6c raw packet, 4123 ntpnts for netnod
070a45f chrony and unbound packets
eba894f rawip socket packets cannot be labeled
656ae0b adds isakmp (500), ipsec-nat-t (4500) and rawip packet types
35325db adds igmp packet type
5cf444c adds icmp packet type
2e41304 sandbox some more packet access for sandbox net
12caad6 packet accesses
b8eb9a8 adds a trunkload of packet types
a42a336 move rules related to invalid netpeers and ipsec associations
a9e40e0 xtables/nftables allow relabelto all packet types
aa5a52c README: adds item to wish list
3a96eec experiment: simple label based packet filtering
26d6f95 nftables reads/writes fw pipes

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2022-05-21 22:27:01 +01:00
Daniel Golle
4509b790f0
fstools: update to git HEAD
9e11b37 fstools: remove SELinux restorecon hack

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-05-03 02:11:17 +01:00
Daniel Golle
fb01111866
procd: update to git HEAD
652e6df init: restore SELinux labels after policy is loaded

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-05-03 02:11:12 +01:00
Dominick Grift
4379457098 selinux-policy: update to version 1.1
try to clean up some labeling inconsistencies
iwinfo loose ends
ucode loose ends
Makefile: adjust mintesttgt (adds blockmount/blockd)
nftables: reads inherited netifd pipe
ucode: reads inherited netifd pipes
mountroot: fowner
sandbox: writes inherited dropbear pipes
unbound related to /tmp/etc/ssl
unbound loose ends
adds a sslconftmpfile for /tmp/etc/ssl
README: maintain a wish list in the README
iwinfo: netifd forgot write
gptfdisk loose ends
iwinfo: netifd wpad reads/writes inherited netifd fifo files
netifd (mac80211.sh) executes iwinfo
luci: executes wireguard
luci-cgi: audits xtables execute access
rcuhttpd: lists ssl certfile dirs
iwinfo, wifi,nftables usage of ttyd pty if available
urandomseed: seedrng needs cap_sys_admin
iwinfo iwinfo, nftables and some chronyd rules related to ntp nts server
nftables, wifi and adds iwinfo skel
nftables, rpcd, ucode
nftables, ucode and seedrng ucode, fw3/nftables, luci
adds ucode skel and some fw3/nftables related
urandomseed: some seedrng rules
fw3 adds some support for fw4
urandomseed: /etc/seedrng is for seed.credit
hotplugcal: runs ucode which is interpreter like
adds a nftables skeleton and makes xtables optional
agent: allow all agents to write inherited dropbear pipes
urandomseed: this seems to be replaced by seedrng
kmodloader: label /etc/modules.conf kmodloader.conffile
Revert "shelexecfile: remove auditallow rule"
Makefile: sort the modules to process by secilc
Moves back to git.defensec.nl
unbound odhcpd (ip) reads net proc
tcp dump
shelexecfile: remove auditallow rule
rrd.cil: fixes indent
Target rddtool from cgi-io instead of runnit it without transition
rrd.cil related
rrd, rpcd, cgiio clean ups related to luci-app-statistics
Rules for rrd files and luci-statistics
unboundcontrol ordering
Several missing permissions
blockmount, dnsmasq, hotplugcall, rpcd, unbound
adds mctp_socket (linux 5.15)
ip: forgot tc-tiny type transition to go along with the fc spec
ip: adds a fc spec for tc-tiny (called by sqm)
adds ttyACM fc spec and various assorted loose ends
.gitattributes: do not export the github workflows
workflow use selinux 3.3

project moved back to https://git.defensec.nl/selinux-policy.git

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2022-05-02 21:10:43 +01:00
Daniel Golle
4e8d095013
fstools: update to git HEAD
f0fc66a libfstools: check for overlay mounting errors
 128ecaf Update / fix extroot comments
 8a0ba3b libfstools: get rid of "extroot_prefix" global variable
 649cd3f libfstools: use variable for overlay mount-point
 922f1b3 libfstools: avoid segfault in find_mount_point
 ce5eacb libfstools: mtd: improve error handling
 898b328 blockd: restore device_move semantics
 0917d22 block: don't probe mtdblock on NAND (with legacy exceptions)

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-05-01 17:02:39 +01:00
Jason A. Donenfeld
a001630a1a urandom-seed: go back to seeding with shell script temporarily
This reverts commit 2edc017a6e.

We shouldn't be using a shell script here, but the SeedRNG integration
into OpenWRT requires a bit more thought. Etienne raised some important
points immediately after this was merged and planned to send some follow
up commits, but became busy with other things. The points he raised are
important enough that we should actually back this out until it's ready
to go, and then merge it as a cohesive unit. So let's revert this for
now, and come back to it later on.

Cc: Etienne Champetier <champetier.etienne@gmail.com>
Cc: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-04-14 10:12:34 +02:00
Daniel Golle
2c8873033e
procd: update to git HEAD
6343c3a procd: completely remove tmp-on-zram support
 5c5e63f uxc: fix potential NULL-pointer dereference
 eb03f03 jail: include necessary files for per-netns netifd instance

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-04-13 19:50:55 +01:00
Felix Fietkau
4ec10da2fe ubox: add example /etc/modules.conf + conffiles entry
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-04-07 12:01:56 +02:00
Felix Fietkau
0b98a55ad6 ubox: update to the latest version
b87a4fdca634 kmodloader: support loading module options and blacklist from /etc/modules.conf

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2022-04-05 21:28:32 +02:00
Jason A. Donenfeld
2edc017a6e urandom-seed: use seedrng for seeding the random number generator
The RNG can't actually be seeded from a shell script, due to the
reliance on ioctls. For this reason, the seedrng project provides a
basic script meant to be copy and pasted into projects like OpenWRT
and tweaked as needed: <https://git.zx2c4.com/seedrng/about/>.

This commit imports it into the urandom-seed package and wires up the
init scripts to call it. This also is a significant improvement over the
current init script, which does not robustly handle cleaning up of seeds
and syncing to prevent reuse. Additionally, the existing script creates
a new seed immediately after writing an old one, which means that the
amount of entropy might actually regress, due to failing to credit the
old seed.

Closes: https://github.com/openwrt/openwrt/issues/9570
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed missing INSTALL_DIR]
2022-03-28 09:27:56 +02:00
Christian Lamparter
eeb8fd4ce7 gpio-cdev: move kmod-leds-uleds dependency to MX100
The inclusion of the kmod-leds-uleds into the userspace
nu801 package causes a circular dependency inside the
buildsystem... which causes it to be picked regardless
of other DEPENDS values.

In case of the mx100, this could be solved by moving the
kmod-leds-uled dependency to the kmod-meraki-mx100.

Bonus: drop @!LINUX_5_4 from kmod-meraki-mx100
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-03-27 15:39:27 +02:00
Christian Lamparter
7368345450 gpio-cdev: provide HASH values for nu801
Chen Minqiang reported that he has troubles downloading nu801.
His logs showed the followin TLS Handshake failure.

|Checking out files from the git repository...
|Cloning into 'nu801-d9942c0c'...
|fatal: unable to access 'https://github.com/chunkeey/nu801.git/':
|  gnutls_handshake() failed: The TLS connection was non-properly terminated.
|Makefile:39: recipe for target '[...]/dl/nu801-d9942c0c.tar.xz' failed

This can be fixed by providing a PKG_MIRROR_HASH. The download
scripts will now be able to pull the source from OpenWrt's source
archive, which should be available through HTTP.

Reported-by: Chen Minqiang <ptpt52@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-03-27 15:38:51 +02:00
Chris Blake
3f874519b4 gpio-cdev: re-add nu801 userspace driver
This reverts commit 80b7a8a7f5.

Now that 5.10 is the default kernel for all platforms, we can
bring back the NU801 userspace driver for platforms that rely
on it. Currently it's used on the MX100 x86_64 target, but
other Meraki platforms use this controller.

Note that we also now change how we load nu801. The way we did
this previously with procd worked, but it meant it didn't load
until everything was up and working.

To fix this, let's call nu801 from boot and re-trigger the
preinit blink sequence. Since nu801 runs as a daemon this is
now something we can do.

Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
(removed empty line, currently only MX100 uses it so: @TARGET_x86)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2022-03-25 18:14:13 +01:00
Petr Štetiar
759886345d openwrt-keyring: add OpenWrt 22.03 GPG/usign keys
62471e693b4f usign: add 22.03 release build public key
 70817cffc905 gpg: add OpenWrt 22.03 signing key

Signed-off-by: Petr Štetiar <ynezz@true.cz>
2022-03-25 14:28:00 +01:00
Florian Eckert
b9017384ca procd: move service command to procd
The service command belongs to the procd and does not belong in the
shinit. In the course of the move, the script was also checked with
shellcheck and cleaned up.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2022-03-19 16:13:58 +01:00
Rui Salvaterra
247eaa4416 procd: remove support for mounting /tmp in zram
The /tmp directory is mounted as tmpfs. The tmpfs filesystem is backed by
anonymous memory, which means it can be swapped out at any time, if there is
memory pressure [1]. For this reason, a zram swap device is a much better
choice than mounting /tmp on zram, since it's able to compress all anonymous
memory, and not just the memory assigned to /tmp. We already have the zram-swap
package for this specific purpose, which means procd's tmp-on-zram is both
redundant and more limited.

A follow-up patch will remove support for mounting /tmp in zram from procd
itself.

[1] https://www.kernel.org/doc/Documentation/filesystems/tmpfs.txt

Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
2022-03-03 20:22:25 +00:00
Stijn Tintel
58212a6194 ubus: bump to git HEAD
66baa44 libubus: introduce new status messages
  b3cd5ab cli: use UBUS_STATUS_PARSE_ERROR
  584f56a cli: improve error logging for call command

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2022-02-28 16:18:37 +02:00
Sergey V. Lobanov
e6a4f30ed7 iucode-tool: fix host-compile on macos and non-x86 linux
iucode-tool/host is used by intel-microcode to manipulate with
microcode.bin file. iucode-tool requires cpuid.h at compile time
for autodection feature, but non-x86 build hosts does not have
this header file (e.g. ubuntu 20.04 aarch64) or this header
generates compile time error (#error macro) (e.g. macos arm64).

This patch provides compat cpuid.h to build iucode-tool/host on
non-x86 linux hosts and macos. CPU autodectection is not required
for intel-microcode package build so compat cpuid.h is ok for
OpenWrt purposes.

glibc and argp lib are not present in macos so iucode-tool/host
build fails. This patch adds argp-standalone/host as build
dependency if host os is macos.

Generated ucode (intel-microcode package) is exactly the same on
Linux x86_64 (Ubuntu 20.04), Linux aarch64 (Ubuntu 20.04) and
Darwin arm64 (MacOS 11.6) build hosts.

Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
2022-02-26 19:52:41 +01:00
Daniel Golle
48ace62114
procd: update to git HEAD
a87d010 uxc: remove unused printf parameter
 ad65249 instance: exit in case asprintf() fails

Build with glibc should again work after this commit.

Fixes: e9e61d76fd ("procd: update to git HEAD")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-02-19 00:11:55 +00:00
Daniel Golle
e9e61d76fd
procd: update to git HEAD
df1123e uxc: add support for user-defined settings
 0272c7c uxc: allow editing settings using 'create'
 a839518 uxc: clean up error handling

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-02-18 03:03:34 +00:00
Daniel Golle
5205010a54
procd: simplify uxc init script
'uxc boot' is inteded to be called multiple times, so there is not need
to guard the first call on boot -- the actual code anyway didn't do
that, so just remove it.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-02-13 23:31:27 +00:00
Jo-Philipp Wich
07eccc29ab rpcd: update to latest Git HEAD
909f2a0 ucode: adjust to latest ucode api
4c532bf ucode: add ucode interpreter plugin
9c6ba38 treewide: adjust ubus object type names
75a96dc build: honour CMake install prefix in hardcoded paths

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2022-02-07 11:44:37 +01:00
Daniel Golle
b6a2cee4b7
ubox: fix broken deferred start of logfile writer
Just use 'start' action which will have the desired effect instead of
trying to introduce a 'start_file' action which didn't work that way
because procd jshn magic would have to wrap around it.

Fixes: 88baf6ce2c ("ubox: only start log to file when filesystem has been mounted")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-01-31 15:03:25 +00:00
Daniel Golle
5d110c0161
procd: seccomp/jail: Fix build error on arm with glibc
From: Peter Lundkvist <peter.lundkvist@gmail.com>

This fixes the make_syscall_h.sh script to recognize both
__NR_Linux, used by mips, and __NR_SYSCALL_BASE and
__ARM_NR_BASE used by arm.

Run-tested on arm (ipq806x) and mips (ath79), both with glibc.
Compile-tested and checked resulting syscall_names.h file wuth
glibc: aarch64, powerpc, x86_64, i486
musl: arm, mips

Fixes: FS#4194, FS#4195

Signed-off-by: Peter Lundkvist <peter.lundkvist@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-01-31 00:10:42 +00:00
Daniel Golle
88baf6ce2c
ubox: only start log to file when filesystem has been mounted
If log_file is on an filesystem mounted using /etc/config/fstab we have
to wait for that to happen before starting the logread process.
Inhibit the start of the file-writer process and use a mount trigger to
fire it up once the filesystem actually becomes available.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-01-30 20:19:37 +00:00
Daniel Golle
6d76ec3872
procd: support generic mount triggers and clean up
Allow init scripts to trigger free-form actions by exposing
procd_add_action_mount_trigger.
Clean up mount trigger wrappers while at it to reduce code duplication.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-01-30 20:16:25 +00:00
Daniel Golle
8c31f6bcab
procd: update to git HEAD
ca6c35c uxc: usage message cosmetics
 e083dd4 uxc: fix two minor issues reported by Coverity
 35dfbff procd: jail/cgroups: correctly enable "rdma" when requested
 3b3ac64 procd: mount /dev with noexec
 ac2b8b3 procd: clean up /dev/pts mounts

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-01-12 19:17:21 +00:00
Daniel Golle
000825d792
opkg: update to git HEAD of 2022-01-09
db7fb64 libopkg: pkg_hash: prefer to-be-installed packages
 2edcfad libopkg: set 'const' attribute for argv

This should fix the ImageBuilder problems people are having since we
introduced the 'uci-firewall' providers.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2022-01-09 20:10:32 +00:00
Daniel Golle
15d0c4d5cd
procd: update to git HEAD
eb522fc uxc: consider uvol and etc location for configurations
 16a6ee9 uxc: integrate console into uxc
 129d050 remove ujail-console

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-12-20 02:23:47 +00:00
Daniel Golle
56b14fdeb2
procd: update to git HEAD
bb95fe8 jail: make sure jailed process is terminated

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-12-11 03:16:57 +00:00
Christian Lamparter
25bc66eb40 ca-certificates: fix python3-cryptography woes in certdata2pem.py
This patch is a revert of the upstream patch to Debian's ca-certificate
commit 033d52259172 ("mozilla/certdata2pem.py: print a warning for expired certificates.")

The reason is, that this change broke builds with the popular
Ubuntu 20.04 LTS (focal) releases which are shipping with an
older version of the python3-cryptography package that is not
compatible.

|Traceback (most recent call last):
|  File "certdata2pem.py", line 125, in <module>
|    cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
|TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend'
|make[5]: *** [Makefile:6: all] Error 1

...or if the python3-cryptography was missing all together:
|Traceback (most recent call last):
|  File "/certdata2pem.py", line 31, in <module>
|    from cryptography import x509
|ModuleNotFoundError: No module named 'cryptography'

More concerns were raised by Jo-Philipp Wich:
"We don't want the build to depend on the local system time anyway.
Right now it seems to be just a warning but I could imagine that
eventually certs are simply omitted of found to be expired at
build time which would break reproducibility."

Link: <https://github.com/openwrt/openwrt/commit/7c99085bd697>
Reported-by: Chen Minqiang <ptpt52@gmail.com>
Reported-by: Shane Synan <digitalcircuit36939@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-12-01 17:52:35 +01:00
Christian Lamparter
7c99085bd6 ca-certicficates: Update to version 20211016
Update the ca-certificates and ca-bundle package from version 20210119 to
version 20211016.

Debian change-log entry [1]:
|[...]
|[ Julien Cristau ]
|* mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority
|    bundle to version 2.50
|    The following certificate authorities were added (+):
|    + "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
|    + "GlobalSign Root R46"
|    + "GlobalSign Root E46"
|    + "GLOBALTRUST 2020"
|    + "ANF Secure Server Root CA"
|    + "Certum EC-384 CA"
|    + "Certum Trusted Root CA"
|    The following certificate authorities were removed (-):
|    - "QuoVadis Root CA"
|    - "Sonera Class 2 Root CA"
|    - "GeoTrust Primary Certification Authority - G2"
|    - "VeriSign Universal Root Certification Authority"
|    - "Chambers of Commerce Root - 2008"
|    - "Global Chambersign Root - 2008"
|    - "Trustis FPS Root CA"
|    - "Staat der Nederlanden Root CA - G3"
|  * Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
|[...]

[1] <https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20211016_changelog>

Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
2021-11-30 20:14:26 +01:00
Jo-Philipp Wich
50bc06e774 procd: setup /dev/stdin, /dev/stdout and /dev/stderr symlinks
Extend the hotplug.json ruleset to setup the common /dev/std{in,out,err}
symbolic links which are needed by some applications, e.g. nftables when
applying rulesets from stdin.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2021-11-23 14:03:39 +00:00
Daniel Golle
507f50df07
procd: update to git HEAD
8de12de system: add diskfree infos to ubus
 bf3fe0e service: move jail parsing to end of instance parser
 87b5836 procd: add full service shutdown prior to sysupgrade
 01ac2c4 procd: service_stop_all: also kill inittab actions

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-11-23 14:03:23 +00:00
Daniel Golle
c1ab687349
fstools: update to git HEAD
77c0288 fstools: fix a couple of minor code problems

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-11-20 21:09:59 +00:00
Daniel Golle
9224ddf72d
procd: update to git HEAD
9d1431e jail: allow passing environment variable to procd jailed process

Fixes dnsmasq in ujail which needs USER_SCRIPT env variable to be
passed to jailed process.

Reported-by: Bastian Bittorf <bb@npl.de>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-11-11 14:09:25 +00:00
Daniel Golle
32ba52e217
rpcd: reload rpcd on installation of rpcd-mod-*
When installing additional rpcd modules, a restart of rpcd is required.
This often confuses users as even after installing rpcd-mod-rpcsys the
relevant ubus objects are still missing until rpcd has been reloaded
(or the system has been rebooted, obviously).
Let rpcd-mod-* reload rpcd as post-install action.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-11-08 14:21:02 +00:00
Felix Fietkau
1cead21e8b procd: make rpcd dependency conditional
Avoids building rpcd when not needed

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-04 16:54:31 +01:00
Stijn Tintel
f5cdf9cb78 procd: bump to git HEAD
0ee8e73 trigger: use uloop_timeout_remaining64

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2021-11-04 15:01:53 +02:00
Stijn Tintel
6a7388f673 rpcd: bump to git HEAD
20bf958 session: use uloop_timeout_remaining64
 d11ffe9 session: use blobmsg_get_u64 for RPC_DUMP_EXPIRES

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2021-11-04 14:58:31 +02:00
Daniel Golle
fab84bf18c
procd: update to git HEAD
1056fc4 jail: elf: Use 64 bit variables for elf offsets
 c1976e5 jail: elf: Remove MIPS 64 warning

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-11-01 18:20:24 +00:00
Daniel Golle
d05eae9249
fstools: update to git HEAD
19fd7fc libfstools: make sure file is closed on error
 d390744 libfstools: use uevent instead of relying on custom kernel patch

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-11-01 18:01:08 +00:00
Felix Fietkau
d7843fd7ef ubus: update to the latest version
b743a331421d ubusd: log ACL init errors
2099bb3ad997 libubus: use list_empty/list_first_entry in ubus_process_pending_msg
ef038488edc3 libubus: process pending messages in data handler if stack depth is 0
a72457b61df0 libubus: increase stack depth for processing obj msgs

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2021-11-01 12:00:21 +01:00
Dominick Grift
04c5bcd074 selinux-policy: update to version 1.0
wifi: writes to terminal
hotplugcall and sqm read class sysfile symlinks
unbound and sqm related loose ends
support/example: policycoreutils host-compile is required
TODO: this was wrong and it is actually needed
linguist detectable does not work this way
linguist-detectable
updates README
adds workflows
adds a note about persistent /var option

project moved to https://github.com/DefenSec/selinux-policy

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
2021-10-28 22:15:02 +01:00
Hauke Mehrtens
eeeb9b7496 uci: update to git HEAD
cmake: Allow override of install directories

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2021-10-22 23:51:51 +02:00
Hauke Mehrtens
0ca81ff047 procd: update to git HEAD
jail: Fix build with glibc

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2021-10-22 23:51:50 +02:00
Daniel Golle
333f93333e
procd: update to git HEAD
9b1e035 jail: netifd: code cosmetics
 d2a2ecc jail: netifd: fix error handling issue reported by coverity
 e1d7cee jail: netifd: check target netns fd before using it
 59f7699 uxc: add missing 'break' statement

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2021-10-17 21:58:47 +01:00