From cb0b5d9dc435fe4d4eb89629a9a93311bed841bd Mon Sep 17 00:00:00 2001 From: Changhyeok Bae Date: Wed, 31 May 2017 02:39:38 +0000 Subject: Upgrade to pyro MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit u-boot: v2017.01 dlt-daemon: Remove gzipnative inheritance - gzipnative.bbclass is removed in pyro branch. - See ab0f46400c113c0d893be872727a67739d5e794d in poky. gpm: Remove bbappend file - upstream(meta-openembedded) is using git(v1.99.7) and this is not required anymore. gnutls: Remove bbappend file - The patch is already applied in upstream. agl-image-minimal: Remove ROOTFS_PKGMANAGE_BOOTSTRAP - ROOTFS_PKGMANAGE_BOOTSTRAP is removed in upstream. - Please see 529244ee212fe14019e35a5f163fab705ddbf141 in poky. freetype: Change hash value for v2.7.1 binary shadow: Remove shadow_%.bbappend - It's already applied upstream poky. Remove nativesdk-packagegroup-sdk-host.bbappend - It's already applied in upstream poky. faac: Remove bbappend file - It's already applied meta-openembedded upstream. pulseaudio: Change bbappend naming - Upstream yocto provides pulseaudio v10.0. weston: re-create patch to apply new version (v2.0.0) - Remove 0001-compositor-drm.c-Launch-without-input-devices.patch because it's already applied in new version. mesa: Remove 12.0.3 recipe and fix build error for qemux86-64 - Yocto upstream supports 17.0.2 and v12.0.3 is not required anymore in raspberrypi - Error: | configure: error: --enable-gallium-llvm selected but llvm-config is not found wayland-ivi-extension: Upgrade to latest master version - Due to weston upgrade, wayland-ivi-extension should be upgraded. packagegroup-ivi-common-core-multimedia: Remove alsa-lib - alsa-lib has empty package and it's not required anymore. Add agl-driver and agl-passenger in group and passwd - Parsing Error: agl-users: groupname agl-passenger does not have a static ID defined. poky-agl.conf: Change gstreamer default version to v1.10.x - Yocto upstream moves gstreamer to v1.10.4. af-main: Fix build error - Error: file /usr/local conflicts between attempted installs of af-main-1.0-r0.corei7_64 and base-files-3.0.14-r89.qemux86_64 intel-corei7-64: Change gstreamer-vaapi-1.0 name - gstreamer-vaapi-1.0 is moved to oe-core and its name is changed to gstreamer1.0-vaapi. linux-raspberrypi: Drop 4.4 bbappend - The upstream meta-raspberrypi doesn't support v4.4 anymore. - CVE patches are not required anymore. glibc: Remove bbappend - The bug-20116 is already applied in 2.25 cynara,security-manager: Fix build error - cynara: Replace bb.data to d - security-manager: Temporarily use 'no' in APPLY variable u-boot-ota: Add SRC_URI - In pyro, SRC_URI and S is moved from .inc to .bb linux-yocto: Remove 4.8 and 4.4 bbappend - Yocto 2.3 (Pyro) doesn't support v4.8 kernel anymore. - CVE patches in meta-agl-bsp are already applied in Yocto 2.3. tcf-agent: Remove bbappend file - This change is merged to upstream poky (pyro) bluez5: Remove recipe and add .bbappend - Yocto 2.3 (Pyro) already has same version. - bluetooth.conf file is added in .bbappend python-pycrypto: Remove recipe - meta-openembedded (Pyro) already has same version. meta-agl-bsp/classes/image.bbclass: Arrange for pyro - image.bbclass is taken from poky/meta/classes/image.bbclass and only changed IMAGE_TYPE_vm variable. libsoup: Fix native build error temporarily v2 (jsmoeller): meta-agl-bsp/meta-ti: - workaround patches in meta-ti/recipes-arago/gstreamer/gstreamer1.0-plugins-bad_%.bbappend - fix old python code in meta-ti/recipes-arago/ipumm-fw/ipumm-fw_3.00.13.00.bb - workaround patches in meta-ti/recipes-arago/weston/weston_%.bbappend - make specific to dra7xx-evm: -- meta-ti/recipes-bsp/alsa-state/alsa-state.bbappend -- meta-ti/recipes-bsp/u-boot/u-boot-ti-staging_%.bbappend -- rename meta-ti/recipes-multimedia/pulseaudio/pulseaudio/dra7xx-evm-set-default-sink-source.patch -- rename meta-ti/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend TODO/FIXME's in: - meta-agl-bsp/meta-ti/recipes-arago/gstreamer/gstreamer1.0-plugins-bad_%.bbappend - meta-agl-bsp/meta-ti/recipes-arago/weston/weston_%.bbappend - meta-agl-bsp/meta-ti/recipes-multimedia/pulseaudio/pulseaudio_%.bbappend - meta-ti/recipes-bsp/u-boot/u-boot-ti-staging_%.bbappend Bug-AGL: SPEC-646 Change-Id: I4162ae887d3334e9102575e3724483aa25f4bd9c Signed-off-by: Changhyeok Bae Signed-off-by: Jan-Simon Möller Reviewed-on: https://gerrit.automotivelinux.org/gerrit/10457 --- .../0001-Smack-File-receive-for-sockets.patch | 65 ---------------------- .../0002-smack-fix-cache-of-access-labels.patch | 43 -------------- ...ack-ignore-null-signal-in-smack_task_kill.patch | 39 ------------- 3 files changed, 147 deletions(-) delete mode 100644 meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0001-Smack-File-receive-for-sockets.patch delete mode 100644 meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0002-smack-fix-cache-of-access-labels.patch delete mode 100644 meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0003-Smack-ignore-null-signal-in-smack_task_kill.patch (limited to 'meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi') diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0001-Smack-File-receive-for-sockets.patch b/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0001-Smack-File-receive-for-sockets.patch deleted file mode 100644 index 4021e5d38..000000000 --- a/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0001-Smack-File-receive-for-sockets.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 2b206c36b16e72cfe41cd22448d8527359ffd962 Mon Sep 17 00:00:00 2001 -From: Casey Schaufler -Date: Mon, 7 Dec 2015 14:34:32 -0800 -Subject: [PATCH 1/4] Smack: File receive for sockets - -The existing file receive hook checks for access on -the file inode even for UDS. This is not right, as -the inode is not used by Smack to make access checks -for sockets. This change checks for an appropriate -access relationship between the receiving (current) -process and the socket. If the process can't write -to the socket's send label or the socket's receive -label can't write to the process fail. - -This will allow the legitimate cases, where the -socket sender and socket receiver can freely communicate. -Only strangly set socket labels should cause a problem. - -Signed-off-by: Casey Schaufler ---- - security/smack/smack_lsm.c | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index ff81026..b20ef06 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -1860,12 +1860,34 @@ static int smack_file_receive(struct file *file) - int may = 0; - struct smk_audit_info ad; - struct inode *inode = file_inode(file); -+ struct socket *sock; -+ struct task_smack *tsp; -+ struct socket_smack *ssp; - - if (unlikely(IS_PRIVATE(inode))) - return 0; - - smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); - smk_ad_setfield_u_fs_path(&ad, file->f_path); -+ -+ if (S_ISSOCK(inode->i_mode)) { -+ sock = SOCKET_I(inode); -+ ssp = sock->sk->sk_security; -+ tsp = current_security(); -+ /* -+ * If the receiving process can't write to the -+ * passed socket or if the passed socket can't -+ * write to the receiving process don't accept -+ * the passed socket. -+ */ -+ rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad); -+ rc = smk_bu_file(file, may, rc); -+ if (rc < 0) -+ return rc; -+ rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad); -+ rc = smk_bu_file(file, may, rc); -+ return rc; -+ } - /* - * This code relies on bitmasks. - */ --- -2.7.4 - diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0002-smack-fix-cache-of-access-labels.patch b/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0002-smack-fix-cache-of-access-labels.patch deleted file mode 100644 index c516f3aa5..000000000 --- a/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0002-smack-fix-cache-of-access-labels.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 99267706991ab84bd44ceaea9a7ec886bbdd58e0 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jos=C3=A9=20Bollo?= -Date: Tue, 12 Jan 2016 21:23:40 +0100 -Subject: [PATCH 2/4] smack: fix cache of access labels -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Before this commit, removing the access property of -a file, aka, the extended attribute security.SMACK64 -was not effictive until the cache had been cleaned. - -This patch fixes that problem. - -Signed-off-by: José Bollo -Acked-by: Casey Schaufler ---- - security/smack/smack_lsm.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index b20ef06..b2bcb14 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -1444,9 +1444,13 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) - * Don't do anything special for these. - * XATTR_NAME_SMACKIPIN - * XATTR_NAME_SMACKIPOUT -- * XATTR_NAME_SMACKEXEC - */ -- if (strcmp(name, XATTR_NAME_SMACK) == 0) -+ if (strcmp(name, XATTR_NAME_SMACK) == 0) { -+ struct super_block *sbp = d_backing_inode(dentry)->i_sb; -+ struct superblock_smack *sbsp = sbp->s_security; -+ -+ isp->smk_inode = sbsp->smk_default; -+ } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) - isp->smk_task = NULL; - else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) - isp->smk_mmap = NULL; --- -2.7.4 - diff --git a/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0003-Smack-ignore-null-signal-in-smack_task_kill.patch b/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0003-Smack-ignore-null-signal-in-smack_task_kill.patch deleted file mode 100644 index c9180bb9f..000000000 --- a/meta-agl-bsp/meta-raspberrypi/recipes-kernel/linux/linux-raspberrypi/0003-Smack-ignore-null-signal-in-smack_task_kill.patch +++ /dev/null @@ -1,39 +0,0 @@ -From ec4eb03af07b0fbc330aecca6ac4ebd6accd8825 Mon Sep 17 00:00:00 2001 -From: Rafal Krypa -Date: Mon, 4 Apr 2016 11:14:53 +0200 -Subject: [PATCH 3/4] Smack: ignore null signal in smack_task_kill - -Kill with signal number 0 is commonly used for checking PID existence. -Smack treated such cases like any other kills, although no signal is -actually delivered when sig == 0. - -Checking permissions when sig == 0 didn't prevent an unprivileged caller -from learning whether PID exists or not. When it existed, kernel returned -EPERM, when it didn't - ESRCH. The only effect of policy check in such -case is noise in audit logs. - -This change lets Smack silently ignore kill() invocations with sig == 0. - -Signed-off-by: Rafal Krypa -Acked-by: Casey Schaufler ---- - security/smack/smack_lsm.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index b2bcb14..cf8a93f 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -2239,6 +2239,9 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info, - struct smack_known *tkp = smk_of_task_struct(p); - int rc; - -+ if (!sig) -+ return 0; /* null signal; existence test */ -+ - smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); - smk_ad_setfield_u_tsk(&ad, p); - /* --- -2.7.4 - -- cgit 1.2.3-korg