Upgrade to buildroot 2024.02

2026-07-22 01:13:00 +02:00 · 2024-04-09 19:38:39 +02:00
parent f6f52bcf16
commit 1caedbfe6f
23 changed files with 452 additions and 29 deletions
@@ -0,0 +1,97 @@
+From 7e93dca4dab6bdbb39fd7f7c0f436839a1eb626e Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Wed, 5 Jul 2023 22:38:56 +0200
+Subject: [PATCH 1/2] adduser: clarify adduser -D behavior and add -d for SSH
+ key login
+Organization: Addiva Elektronik
+
+Clarify that -D locks the account (!), then add -d to create an account
+for which password login is disabled (*) but the user can log in with
+SSH keys.
+
+This also adjusts the long option --disabled-password, which was mapped
+to -D, probably mistakenly.  With this change BusyBox adduser behaves
+the same as Debian's --disabled-login and --disabled-password.
+
+Fixes #10981
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ loginutils/adduser.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/loginutils/adduser.c b/loginutils/adduser.c
+index d3c795afa..cf6a0264a 100644
+--- a/loginutils/adduser.c
+++ b/loginutils/adduser.c
+@@ -62,7 +62,8 @@
+ //usage:     "\n	-s SHELL	Login shell"
+ //usage:     "\n	-G GRP		Group"
+ //usage:     "\n	-S		Create a system user"
+-//usage:     "\n	-D		Don't assign a password"
+//usage:     "\n	-D		Don't assign a password (locked account)"
+//usage:     "\n	-d		Like -D but allow login using SSH keys"
+ //usage:     "\n	-H		Don't create home directory"
+ //usage:     "\n	-u UID		User id"
+ //usage:     "\n	-k SKEL		Skeleton directory (/etc/skel)"
+@@ -82,10 +83,11 @@
+ #define OPT_SHELL          (1 << 2)
+ #define OPT_GID            (1 << 3)
+ #define OPT_DONT_SET_PASS  (1 << 4)
+-#define OPT_SYSTEM_ACCOUNT (1 << 5)
+-#define OPT_DONT_MAKE_HOME (1 << 6)
+-#define OPT_UID            (1 << 7)
+-#define OPT_SKEL           (1 << 8)
+#define OPT_DISABLED_PASS  (1 << 5)
+#define OPT_SYSTEM_ACCOUNT (1 << 6)
+#define OPT_DONT_MAKE_HOME (1 << 7)
+#define OPT_UID            (1 << 8)
+#define OPT_SKEL           (1 << 9)
+ 
+ /* remix */
+ /* recoded such that the uid may be passed in *p */
+@@ -168,7 +170,8 @@ static const char adduser_longopts[] ALIGN1 =
+ 		"gecos\0"               Required_argument "g"
+ 		"shell\0"               Required_argument "s"
+ 		"ingroup\0"             Required_argument "G"
+-		"disabled-password\0"   No_argument       "D"
+		"disabled-password\0"   No_argument       "d"
+		"disabled-login\0"      No_argument       "D"
+ 		"empty-password\0"      No_argument       "D"
+ 		"system\0"              No_argument       "S"
+ 		"no-create-home\0"      No_argument       "H"
+@@ -202,10 +205,10 @@ int adduser_main(int argc UNUSED_PARAM, char **argv)
+ 	pw.pw_dir = NULL;
+ 
+ 	opts = getopt32long(argv, "^"
+-			"h:g:s:G:DSHu:k:"
+			"h:g:s:G:DdSHu:k:"
+ 			/* at least one and at most two non-option args */
+ 			/* disable interactive passwd for system accounts */
+-			"\0" "-1:?2:SD",
+			"\0" "-1:?2:SDd",
+ 			adduser_longopts,
+ 			&pw.pw_dir, &pw.pw_gecos, &pw.pw_shell,
+ 			&usegroup, &uid, &skel
+@@ -263,7 +266,8 @@ int adduser_main(int argc UNUSED_PARAM, char **argv)
+ 	 * 8. unix date when login expires (i.e. when it may no longer be used)
+ 	 */
+ 	/* fields:     2 3  4 5     6 78 */
+-	p = xasprintf("!:%u:0:99999:7:::", (unsigned)(time(NULL)) / (24*60*60));
+	p = xasprintf("%c:%u:0:99999:7:::", (opts & OPT_DISABLED_PASS) ? '*' : '!',
+			(unsigned)(time(NULL)) / (24*60*60));
+ 	/* ignore errors: if file is missing we suppose admin doesn't want it */
+ 	update_passwd(bb_path_shadow_file, pw.pw_name, p, NULL);
+ 	if (ENABLE_FEATURE_CLEAN_UP)
+@@ -305,7 +309,7 @@ int adduser_main(int argc UNUSED_PARAM, char **argv)
+ 		}
+ 	}
+ 
+-	if (!(opts & OPT_DONT_SET_PASS)) {
+	if (!(opts & (OPT_DONT_SET_PASS | OPT_DISABLED_PASS))) {
+ 		/* interactively set passwd */
+ 		passwd_wrapper(pw.pw_name);
+ 	}
+-- 
+2.34.1
+
@@ -0,0 +1,55 @@
+From 2a1462d9f6a117cf1a5ae531d36143bd0a55d533 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Wed, 5 Jul 2023 23:48:14 +0200
+Subject: [PATCH 2/2] login: add support for shadow passwords
+Organization: Addiva Elektronik
+
+login, on fallback from PAM, or when PAM support is not enabled, checks
+pw->pw_passwd for locked ("!") or passwordless ("*") accounts.  However,
+on systems with shadow passwords the first character will always be "x".
+
+This patch adds shadow password support from the passwd tool, letting
+the user end up in "Login incorrect" rather than the "login: bad salt"
+case, which could be used by an attacker to guess the state of accounts.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ loginutils/login.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/loginutils/login.c b/loginutils/login.c
+index b02be2176..0e7f20844 100644
+--- a/loginutils/login.c
+++ b/loginutils/login.c
+@@ -345,6 +345,11 @@ int login_main(int argc UNUSED_PARAM, char **argv)
+ #endif
+ #if ENABLE_LOGIN_SESSION_AS_CHILD
+ 	pid_t child_pid;
+#endif
+#if ENABLE_FEATURE_SHADOWPASSWDS
+	/* Using _r function to avoid pulling in static buffers */
+	struct spwd spw, *result = NULL;
+	char buffer[256];
+ #endif
+ 	IF_FEATURE_UTMP(pid_t my_pid;)
+ 
+@@ -493,6 +498,16 @@ int login_main(int argc UNUSED_PARAM, char **argv)
+ 			goto fake_it;
+ 		}
+ 
+#if ENABLE_FEATURE_SHADOWPASSWDS
+		if (getspnam_r(pw->pw_name, &spw, buffer, sizeof(buffer), &result)
+		    || !result || strcmp(result->sp_namp, pw->pw_name)) {
+			strcpy(username, "UNKNOWN");
+			goto fake_it;
+		} else {
+			pw->pw_passwd = result->sp_pwdp;
+		}
+#endif
+
+ 		if (pw->pw_passwd[0] == '!' || pw->pw_passwd[0] == '*')
+ 			goto auth_failed;
+ 
+-- 
+2.34.1
+
@@ -0,0 +1,155 @@
+diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
+index adb75f7d..611ab413 100644
+--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
+@@ -829,6 +829,7 @@ enum br_boolopt_id {
+ 	BR_BOOLOPT_NO_LL_LEARN,
+ 	BR_BOOLOPT_MCAST_VLAN_SNOOPING,
+ 	BR_BOOLOPT_MST_ENABLE,
+	BR_BOOLOPT_MCAST_FLOOD_ALWAYS,
+ 	BR_BOOLOPT_MAX
+ };
+ 
+diff --git a/ip/iplink_bridge.c b/ip/iplink_bridge.c
+index 6b70ffbb..c83f55b0 100644
+--- a/ip/iplink_bridge.c
+++ b/ip/iplink_bridge.c
+@@ -40,6 +40,7 @@ static void print_explain(FILE *f)
+ 		"		  [ vlan_default_pvid VLAN_DEFAULT_PVID ]\n"
+ 		"		  [ vlan_stats_enabled VLAN_STATS_ENABLED ]\n"
+ 		"		  [ vlan_stats_per_port VLAN_STATS_PER_PORT ]\n"
+		"		  [ mcast_flood_always ENABLED ]\n"
+ 		"		  [ mcast_snooping MULTICAST_SNOOPING ]\n"
+ 		"		  [ mcast_vlan_snooping MULTICAST_VLAN_SNOOPING ]\n"
+ 		"		  [ mcast_router MULTICAST_ROUTER ]\n"
+@@ -79,6 +80,18 @@ void br_dump_bridge_id(const struct ifla_bridge_id *id, char *buf, size_t len)
+ 	snprintf(buf, len, "%.2x%.2x.%s", id->prio[0], id->prio[1], eaddr);
+ }
+ 
+static void set_boolopt(struct br_boolopt_multi *bm, enum br_boolopt_id opt,
+			bool set)
+{
+	__u32 bit = 1 << opt;
+
+	bm->optmask |= 1 << opt;
+	if (set)
+		bm->optval |= bit;
+	else
+		bm->optval &= ~bit;
+}
+
+ static int bridge_parse_opt(struct link_util *lu, int argc, char **argv,
+ 			    struct nlmsghdr *n)
+ {
+@@ -221,17 +234,21 @@ static int bridge_parse_opt(struct link_util *lu, int argc, char **argv,
+ 
+ 			addattr8(n, 1024, IFLA_BR_MCAST_SNOOPING, mcast_snoop);
+ 		} else if (strcmp(*argv, "mcast_vlan_snooping") == 0) {
+-			__u32 mcvl_bit = 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
+-			__u8 mcast_vlan_snooping;
+			__u8 val;
+ 
+ 			NEXT_ARG();
+-			if (get_u8(&mcast_vlan_snooping, *argv, 0))
+			if (get_u8(&val, *argv, 0))
+ 				invarg("invalid mcast_vlan_snooping", *argv);
+-			bm.optmask |= 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
+-			if (mcast_vlan_snooping)
+-				bm.optval |= mcvl_bit;
+-			else
+-				bm.optval &= ~mcvl_bit;
+
+			set_boolopt(&bm, BR_BOOLOPT_MCAST_VLAN_SNOOPING, val);
+		} else if (strcmp(*argv, "mcast_flood_always") == 0) {
+			__u8 val;
+
+			NEXT_ARG();
+			if (get_u8(&val, *argv, 0))
+				invarg("invalid mcast_flood_always", *argv);
+
+			set_boolopt(&bm, BR_BOOLOPT_MCAST_FLOOD_ALWAYS, val);
+ 		} else if (matches(*argv, "mcast_query_use_ifaddr") == 0) {
+ 			__u8 mcast_qui;
+ 
+@@ -607,21 +624,39 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
+ 			   rta_getattr_u8(tb[IFLA_BR_MCAST_SNOOPING]));
+ 
+ 	if (tb[IFLA_BR_MULTI_BOOLOPT]) {
+-		__u32 mcvl_bit = 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
+-		__u32 no_ll_learn_bit = 1 << BR_BOOLOPT_NO_LL_LEARN;
+ 		struct br_boolopt_multi *bm;
+		int opt;
+ 
+ 		bm = RTA_DATA(tb[IFLA_BR_MULTI_BOOLOPT]);
+-		if (bm->optmask & no_ll_learn_bit)
+-			print_uint(PRINT_ANY,
+-				   "no_linklocal_learn",
+-				   "no_linklocal_learn %u ",
+-				    !!(bm->optval & no_ll_learn_bit));
+-		if (bm->optmask & mcvl_bit)
+-			print_uint(PRINT_ANY,
+-				   "mcast_vlan_snooping",
+-				   "mcast_vlan_snooping %u ",
+-				    !!(bm->optval & mcvl_bit));
+		for (opt = 0; opt < BR_BOOLOPT_MAX; opt++) {
+			__u32 bit = 1 << opt;
+			__u32 val = !!(bm->optval & bit);
+
+			if (!(bm->optmask & bit))
+				continue;
+
+			switch (opt) {
+			case BR_BOOLOPT_NO_LL_LEARN:
+				print_uint(PRINT_ANY,
+					   "no_linklocal_learn",
+					   "no_linklocal_learn %u ", val);
+				break;
+			case BR_BOOLOPT_MCAST_VLAN_SNOOPING:
+				print_uint(PRINT_ANY,
+					   "mcast_vlan_snooping",
+					   "mcast_vlan_snooping %u ", val);
+				break;
+			case BR_BOOLOPT_MST_ENABLE:
+				print_uint(PRINT_ANY,
+					   "mst_enabled",
+					   "mst_enabled %u ", val);
+				break;
+			case BR_BOOLOPT_MCAST_FLOOD_ALWAYS:
+				print_uint(PRINT_ANY,
+					   "mcast_flood_always",
+					   "mcast_flood_always %u ", val);
+			}
+		}
+ 	}
+ 
+ 	if (tb[IFLA_BR_MCAST_ROUTER])
+diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
+index 6764a9ad..8f77c5ad 100644
+--- a/man/man8/ip-link.8.in
+++ b/man/man8/ip-link.8.in
+@@ -1642,6 +1642,8 @@ the following additional arguments are supported:
+ ] [
+ .BI vlan_stats_per_port " VLAN_STATS_PER_PORT "
+ ] [
+.BI mcast_flood_always " ENABLED "
+] [
+ .BI mcast_snooping " MULTICAST_SNOOPING "
+ ] [
+ .BI mcast_vlan_snooping " MULTICAST_VLAN_SNOOPING "
+@@ -1778,6 +1780,16 @@ or disable
+ .RI ( VLAN_STATS_PER_PORT " == 0) "
+ per-VLAN per-port stats accounting. Can be changed only when there are no port VLANs configured.
+ 
+.BI mcast_flood_always " ENABLED "
+- always
+.RI ( ENABLED " > 0) "
+flood unknown multicast according to per-port
+.BI mcast_flood
+settings.  By default
+.RI ( ENABLED " == 0). "
+the bridge only floods until it has learned of a querier, or takes on
+the role itself.
+
+ .BI mcast_snooping " MULTICAST_SNOOPING "
+ - turn multicast snooping on
+ .RI ( MULTICAST_SNOOPING " > 0) "
@@ -0,0 +1,36 @@
+diff --git a/src/daemon/lldpd.c b/src/daemon/lldpd.c
+index c7f1082..25a8319 100644
+--- a/src/daemon/lldpd.c
+++ b/src/daemon/lldpd.c
+@@ -1572,6 +1572,8 @@ lldpd_main(int argc, char *argv[], char *envp[])
+ 	struct group *group;
+ 	uid_t uid;
+ 	gid_t gid;
+#else
+	struct group *group;
+ #endif
+ 
+ 	saved_argv = argv;
+@@ -1777,6 +1779,8 @@ lldpd_main(int argc, char *argv[], char *envp[])
+ 		    "no " PRIVSEP_GROUP
+ 		    " group for privilege separation, please create it");
+ 	gid = group->gr_gid;
+#else
+	group = getgrnam("wheel");
+ #endif
+ 
+ 	/* Create and setup socket */
+@@ -1815,6 +1819,13 @@ lldpd_main(int argc, char *argv[], char *envp[])
+ 	if (chmod(ctlname, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP) ==
+ 	    -1)
+ 		log_warn("main", "unable to chmod control socket");
+#else
+	if (group) {
+		if (chown(ctlname, -1, group->gr_gid))
+			log_warn("main", "unable to chown control socket");
+		else
+			chmod(ctlname, 0770);
+	}
+ #endif
+ 
+ 	/* Create associated advisory lock file */
@@ -0,0 +1,12 @@
+diff -ru openresolv-3.12.0.orig/resolvconf.in openresolv-3.12.0/resolvconf.in
+--- openresolv-3.12.0.orig/resolvconf.in	2020-12-27 19:05:10.000000000 +0100
+++ openresolv-3.12.0/resolvconf.in	2023-03-27 00:19:03.365164029 +0200
+@@ -315,6 +315,8 @@
+ 			then
+ 				/usr/bin/systemctl restart $1.service
+ 			fi'
+	elif [ -x /sbin/initctl ]; then
+		RESTARTCMD="/sbin/initctl -bnq restart \$1"
+ 	elif [ -x /sbin/rc-service ] &&
+ 	     { [ -s /libexec/rc/init.d/softlevel ] ||
+ 	     [ -s /run/openrc/softlevel ]; }
@@ -0,0 +1,12 @@
+diff --git a/src/bundle.c b/src/bundle.c
+index 05ec358..d5888d4 100644
+--- a/src/bundle.c
+++ b/src/bundle.c
+@@ -1313,6 +1313,7 @@ static gboolean is_remote_scheme(const gchar *scheme)
+ {
+ 	return (g_strcmp0(scheme, "http") == 0) ||
+ 	       (g_strcmp0(scheme, "https") == 0) ||
+	       (g_strcmp0(scheme, "tftp") == 0) ||
+ 	       (g_strcmp0(scheme, "sftp") == 0) ||
+ 	       (g_strcmp0(scheme, "ftp") == 0) ||
+ 	       (g_strcmp0(scheme, "ftps") == 0);
@@ -0,0 +1,84 @@
+diff --git a/src/main.c b/src/main.c
+index 8e851b4..62d0bec 100644
+--- a/src/main.c
+++ b/src/main.c
+@@ -9,6 +9,7 @@
+ #include <locale.h>
+ #include <stdio.h>
+ #include <string.h>
+#include <syslog.h>
+ #include <sys/ioctl.h>
+ #include <unistd.h>
+ 
+@@ -2183,6 +2184,38 @@ static gboolean unknown_start(int argc, char **argv)
+ 	return TRUE;
+ }
+ 
+static int log_level(GLogLevelFlags level)
+{
+	if (level & G_LOG_FLAG_FATAL)
+		return LOG_EMERG;
+	if (level & G_LOG_FLAG_RECURSION)
+		return LOG_ALERT;
+	if (level & G_LOG_LEVEL_CRITICAL)
+		return LOG_CRIT;
+	if (level & G_LOG_LEVEL_ERROR)
+		return LOG_ERR;
+	if (level & G_LOG_LEVEL_WARNING)
+		return LOG_WARNING;
+	if (level & G_LOG_LEVEL_MESSAGE)
+		return LOG_NOTICE;
+	if (level & G_LOG_LEVEL_INFO)
+		return LOG_INFO;
+	if (level & G_LOG_LEVEL_DEBUG)
+		return LOG_DEBUG;
+
+	/* Fallback to INFO for unknown levels */
+	return LOG_INFO;
+}
+
+static void syslog_handler(const gchar *domain, GLogLevelFlags level, const gchar *message, gpointer arg)
+{
+	/* unused */
+	(void)domain;
+	(void)arg;
+
+	syslog(log_level(level), "%s", message);
+}
+
+ typedef enum  {
+ 	UNKNOWN = 0,
+ 	INSTALL,
+@@ -2370,7 +2403,7 @@ static void create_option_groups(void)
+ 
+ static void cmdline_handler(int argc, char **argv)
+ {
+-	gboolean help = FALSE, debug = FALSE, version = FALSE;
+	gboolean help = FALSE, debug = FALSE, use_syslog = FALSE, version = FALSE;
+ 	g_autofree gchar *confpath = NULL, *keyring = NULL, *mount = NULL;
+ 	char *cmdarg = NULL;
+ 	g_autoptr(GOptionContext) context = NULL;
+@@ -2383,6 +2416,7 @@ static void cmdline_handler(int argc, char **argv)
+ 		{"intermediate", '\0', G_OPTION_FLAG_HIDDEN, G_OPTION_ARG_FILENAME_ARRAY, &intermediate, "intermediate CA file or PKCS#11 URL", "PEMFILE|PKCS11-URL"},
+ 		{"mount", '\0', 0, G_OPTION_ARG_FILENAME, &mount, "mount prefix", "PATH"},
+ 		{"debug", 'd', 0, G_OPTION_ARG_NONE, &debug, "enable debug output", NULL},
+		{"syslog", 's', 0, G_OPTION_ARG_NONE, &use_syslog, "use syslog instead of stdout", NULL},
+ 		{"version", '\0', 0, G_OPTION_ARG_NONE, &version, "display version", NULL},
+ 		{"help", 'h', 0, G_OPTION_ARG_NONE, &help, "display help and exit", NULL},
+ 		{0}
+@@ -2500,6 +2534,15 @@ static void cmdline_handler(int argc, char **argv)
+ 		g_message("Debug log domains: '%s'", domains);
+ 	}
+ 
+	if (use_syslog) {
+		GLogLevelFlags levels = G_LOG_LEVEL_MASK | G_LOG_FLAG_FATAL | G_LOG_FLAG_RECURSION;
+		const char *ident = "rauc";
+
+		/* XXX: facility should be configurable */
+		openlog(ident, LOG_PID | LOG_NOWAIT, LOG_LOCAL0);
+		g_log_set_handler(ident, levels, syslog_handler, NULL);
+	}
+
+ 	/* get first parameter without dashes */
+ 	for (gint i = 1; i <= argc; i++) {
+ 		if (argv[i] && !g_str_has_prefix(argv[i], "-")) {
@@ -1,28 +0,0 @@
-From 6ca6a793c59fb22d66ad59aac93396351df74115 Mon Sep 17 00:00:00 2001
-From: Tobias Waldekranz <tobias@waldekranz.com>
-Date: Fri, 30 Oct 2020 11:10:44 +0100
-Subject: [PATCH] DSA: Correctly determine VID
-
-The 4 MSBs of the VID is stored in the lower nibble of the tag's third
-byte.
-
-Previously the priority bits where folded into the VID space, e.g. a
-packet with VID=1 and priority 6 was printed as having a VID of
-1537 (0x601).
---
- print-dsa.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/print-dsa.c b/print-dsa.c
-index e45dc53fb..1ed9acf67 100644
--- a/print-dsa.c
-+++ b/print-dsa.c
-@@ -83,7 +83,7 @@
- #define DSA_RX_SNIFF(tag) TOK(tag, 1, 0x04, 2)
- #define DSA_CFI(tag) TOK(tag, 1, 0x01, 0)
- #define DSA_PRI(tag) TOK(tag, 2, 0xe0, 5)
-#define DSA_VID(tag) ((u_short)((TOK(tag, 2, 0xe0, 5) << 8) | (TOK(tag, 3, 0xff, 0))))
-+#define DSA_VID(tag) ((u_short)((TOK(tag, 2, 0x0f, 0) << 8) | (TOK(tag, 3, 0xff, 0))))
- #define DSA_CODE(tag) ((TOK(tag, 1, 0x06, 1) << 1) | TOK(tag, 2, 0x10, 4))
- 
- #define EDSA_LEN 8