basesystem-jjsandbox/ToshikazuOhiwa/master-jj

recipes

4 files changed, 27 insertions, 286 deletions

diff --git a/external/poky/meta/recipes-extended/sudo/sudo.inc b/external/poky/meta/recipes-extended/sudo/sudo.inc
index 69dccde5..5d27d469 100644
--- a/external/poky/meta/recipes-extended/sudo/sudo.inc
+++ b/external/poky/meta/recipes-extended/sudo/sudo.inc
@@ -4,15 +4,18 @@ HOMEPAGE = "http://www.sudo.ws"
 BUGTRACKER = "http://www.sudo.ws/bugs/"
 SECTION = "admin"
 LICENSE = "ISC & BSD & Zlib"
-LIC_FILES_CHKSUM = "file://doc/LICENSE;md5=cc4bf2366b059c9598e3947f885931ec \
-                    file://plugins/sudoers/redblack.c;beginline=1;endline=41;md5=805782a8466975716f8376b2be9aedde \
-                    file://lib/util/reallocarray.c;beginline=3;endline=16;md5=85b0905b795d4d58bf2e00635649eec6 \
-                    file://lib/util/fnmatch.c;beginline=3;endline=27;md5=67f83ee9bd456557397082f8f1be0efd \
-                    file://lib/util/getcwd.c;beginline=5;endline=27;md5=449af4cc57fc7d46f42090608ba3e681 \
-                    file://lib/util/glob.c;beginline=6;endline=31;md5=5872733146b9eb0deb79e1f664815b85 \
-                    file://lib/util/snprintf.c;beginline=6;endline=34;md5=c82c1b3a5c32e08545c9ec5d71e41e50 \
-                    file://include/sudo_queue.h;beginline=5;endline=27;md5=449af4cc57fc7d46f42090608ba3e681 \
-                    file://lib/util/inet_pton.c;beginline=3;endline=17;md5=3970ab0518ab79cbd0bafb697f10b33a \
+LIC_FILES_CHKSUM = "file://doc/LICENSE;md5=4d1b44b1576eea036d78b8cc961aa93d \
+                    file://plugins/sudoers/redblack.c;beginline=1;endline=46;md5=03e35317699ba00b496251e0dfe9f109 \
+                    file://lib/util/reallocarray.c;beginline=3;endline=15;md5=397dd45c7683e90b9f8bf24638cf03bf \
+                    file://lib/util/fnmatch.c;beginline=3;endline=27;md5=004d7d2866ba1f5b41174906849d2e0f \
+                    file://lib/util/getcwd.c;beginline=2;endline=27;md5=50f8d9667750e18dea4e84a935c12009 \
+                    file://lib/util/glob.c;beginline=2;endline=31;md5=2852f68687544e3eb8a0a61665506f0e \
+                    file://lib/util/snprintf.c;beginline=3;endline=33;md5=b70df6179969e38fcf68da91b53b8029 \
+                    file://include/sudo_queue.h;beginline=2;endline=27;md5=ad578e9664d17a010b63e4bc0576ee8d \
+                    file://lib/util/inet_pton.c;beginline=3;endline=17;md5=27785c9f5835093eda42aa0816a2d0b4 \
+                    file://lib/util/arc4random.c;beginline=3;endline=20;md5=ced8636ecefa2ba907cfe390bc3bd964 \
+                    file://lib/util/arc4random_uniform.c;beginline=3;endline=17;md5=e30c2b777cdc00cfcaf7c445a10b262f \
+                    file://lib/util/getentropy.c;beginline=1;endline=19;md5=a0f58be3d60b6dcd898ec5fe0866d36f \
                     "
 
 inherit autotools
@@ -23,7 +26,7 @@ PACKAGECONFIG[pam-wheel] = ",,,pam-plugin-wheel"
 
 CONFFILES_${PN} = "${sysconfdir}/sudoers"
 
-EXTRA_OECONF = "--with-editor=/bin/vi --with-env-editor"
+EXTRA_OECONF = "--with-editor=${base_bindir}/vi --with-env-editor"
 
 EXTRA_OECONF_append_libc-musl = " --disable-hardening "
 
diff --git a/external/poky/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch b/external/poky/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch
deleted file mode 100644
index f954fac8..00000000
--- a/external/poky/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p1.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-Treat an ID of -1 as invalid since that means "no change".
-Fixes CVE-2019-14287.
-Found by Joe Vennix from Apple Information Security.
-
-CVE: CVE-2019-14287
-Upstream-Status: Backport
-[https://www.sudo.ws/repos/sudo/rev/83db8dba09e7]
-
-Signed-off-by: Dan Tran <dantran@microsoft.com>
-
-Index: sudo-1.8.21p2/lib/util/strtoid.c
-===================================================================
---- sudo-1.8.21p2.orig/lib/util/strtoid.c	2019-10-10 14:31:08.338476078 -0400
-+++ sudo-1.8.21p2/lib/util/strtoid.c	2019-10-10 14:31:08.338476078 -0400
-@@ -42,6 +42,27 @@
- #include "sudo_util.h"
- 
- /*
-+ * Make sure that the ID ends with a valid separator char.
-+ */
-+static bool
-+valid_separator(const char *p, const char *ep, const char *sep)
-+{
-+    bool valid = false;
-+    debug_decl(valid_separator, SUDO_DEBUG_UTIL)
-+
-+    if (ep != p) {
-+	/* check for valid separator (including '\0') */
-+	if (sep == NULL)
-+	    sep = "";
-+	do {
-+	    if (*ep == *sep)
-+		valid = true;
-+	} while (*sep++ != '\0');
-+    }
-+    debug_return_bool(valid);
-+}
-+
-+/*
-  * Parse a uid/gid in string form.
-  * If sep is non-NULL, it contains valid separator characters (e.g. comma, space)
-  * If endp is non-NULL it is set to the next char after the ID.
-@@ -55,36 +76,33 @@ sudo_strtoid_v1(const char *p, const cha
-     char *ep;
-     id_t ret = 0;
-     long long llval;
--    bool valid = false;
-     debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL)
- 
-     /* skip leading space so we can pick up the sign, if any */
-     while (isspace((unsigned char)*p))
- 	p++;
--    if (sep == NULL)
--	sep = "";
-+
-+    /* While id_t may be 64-bit signed, uid_t and gid_t are 32-bit unsigned. */
-     errno = 0;
-     llval = strtoll(p, &ep, 10);
--    if (ep != p) {
--	/* check for valid separator (including '\0') */
--	do {
--	    if (*ep == *sep)
--		valid = true;
--	} while (*sep++ != '\0');
-+    if ((errno == ERANGE && llval == LLONG_MAX) || llval > (id_t)UINT_MAX) {
-+	errno = ERANGE;
-+	if (errstr != NULL)
-+	    *errstr = N_("value too large");
-+	goto done;
-     }
--    if (!valid) {
-+    if ((errno == ERANGE && llval == LLONG_MIN) || llval < INT_MIN) {
-+	errno = ERANGE;
- 	if (errstr != NULL)
--	    *errstr = N_("invalid value");
--	errno = EINVAL;
-+	    *errstr = N_("value too small");
- 	goto done;
-     }
--    if (errno == ERANGE) {
--	if (errstr != NULL) {
--	    if (llval == LLONG_MAX)
--		*errstr = N_("value too large");
--	    else
--		*errstr = N_("value too small");
--	}
-+
-+    /* Disallow id -1, which means "no change". */
-+    if (!valid_separator(p, ep, sep) || llval == -1 || llval == (id_t)UINT_MAX) {
-+	if (errstr != NULL)
-+	    *errstr = N_("invalid value");
-+	errno = EINVAL;
- 	goto done;
-     }
-     ret = (id_t)llval;
-@@ -101,30 +119,15 @@ sudo_strtoid_v1(const char *p, const cha
- {
-     char *ep;
-     id_t ret = 0;
--    bool valid = false;
-     debug_decl(sudo_strtoid, SUDO_DEBUG_UTIL)
- 
-     /* skip leading space so we can pick up the sign, if any */
-     while (isspace((unsigned char)*p))
- 	p++;
--    if (sep == NULL)
--	sep = "";
-+
-     errno = 0;
-     if (*p == '-') {
- 	long lval = strtol(p, &ep, 10);
--	if (ep != p) {
--	    /* check for valid separator (including '\0') */
--	    do {
--		if (*ep == *sep)
--		    valid = true;
--	    } while (*sep++ != '\0');
--	}
--	if (!valid) {
--	    if (errstr != NULL)
--		*errstr = N_("invalid value");
--	    errno = EINVAL;
--	    goto done;
--	}
- 	if ((errno == ERANGE && lval == LONG_MAX) || lval > INT_MAX) {
- 	    errno = ERANGE;
- 	    if (errstr != NULL)
-@@ -137,28 +140,31 @@ sudo_strtoid_v1(const char *p, const cha
- 		*errstr = N_("value too small");
- 	    goto done;
- 	}
--	ret = (id_t)lval;
--    } else {
--	unsigned long ulval = strtoul(p, &ep, 10);
--	if (ep != p) {
--	    /* check for valid separator (including '\0') */
--	    do {
--		if (*ep == *sep)
--		    valid = true;
--	    } while (*sep++ != '\0');
--	}
--	if (!valid) {
-+
-+	/* Disallow id -1, which means "no change". */
-+	if (!valid_separator(p, ep, sep) || lval == -1) {
- 	    if (errstr != NULL)
- 		*errstr = N_("invalid value");
- 	    errno = EINVAL;
- 	    goto done;
- 	}
-+	ret = (id_t)lval;
-+    } else {
-+	unsigned long ulval = strtoul(p, &ep, 10);
- 	if ((errno == ERANGE && ulval == ULONG_MAX) || ulval > UINT_MAX) {
- 	    errno = ERANGE;
- 	    if (errstr != NULL)
- 		*errstr = N_("value too large");
- 	    goto done;
- 	}
-+
-+	/* Disallow id -1, which means "no change". */
-+	if (!valid_separator(p, ep, sep) || ulval == UINT_MAX) {
-+	    if (errstr != NULL)
-+		*errstr = N_("invalid value");
-+	    errno = EINVAL;
-+	    goto done;
-+	}
- 	ret = (id_t)ulval;
-     }
-     if (errstr != NULL)
diff --git a/external/poky/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch b/external/poky/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch
deleted file mode 100644
index dcb2703d..00000000
--- a/external/poky/meta/recipes-extended/sudo/sudo/CVE-2019-14287_p2.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-CVE: CVE-2019-14287
-Upstream-Status: Backport
-[https://www.sudo.ws/repos/sudo/rev/db06a8336c09]
-
-Signed-off-by: Dan Tran <dantran@microsoft.com>
-
-Index: sudo-1.8.21p2/lib/util/regress/atofoo/atofoo_test.c
-===================================================================
---- sudo-1.8.21p2.orig/lib/util/regress/atofoo/atofoo_test.c	2019-10-11 07:11:49.874655384 -0400
-+++ sudo-1.8.21p2/lib/util/regress/atofoo/atofoo_test.c	2019-10-11 07:13:07.471005893 -0400
-@@ -24,6 +24,7 @@
- #else
- # include "compat/stdbool.h"
- #endif
-+#include <errno.h>
- 
- #include "sudo_compat.h"
- #include "sudo_util.h"
-@@ -78,15 +79,20 @@ static struct strtoid_data {
-     id_t id;
-     const char *sep;
-     const char *ep;
-+    int errnum;
- } strtoid_data[] = {
--    { "0,1", 0, ",", "," },
--    { "10", 10, NULL, NULL },
--    { "-2", -2, NULL, NULL },
-+    { "0,1", 0, ",", ",", 0 },
-+    { "10", 10, NULL, NULL, 0 },
-+    { "-1", 0, NULL, NULL, EINVAL },
-+    { "4294967295", 0, NULL, NULL, EINVAL },
-+    { "4294967296", 0, NULL, NULL, ERANGE },
-+    { "-2147483649", 0, NULL, NULL, ERANGE },
-+    { "-2", -2, NULL, NULL, 0 },
- #if SIZEOF_ID_T != SIZEOF_LONG_LONG
--    { "-2", 4294967294U, NULL, NULL },
-+    { "-2", (id_t)4294967294U, NULL, NULL, 0 },
- #endif
--    { "4294967294", 4294967294U, NULL, NULL },
--    { NULL, 0, NULL, NULL }
-+    { "4294967294", (id_t)4294967294U, NULL, NULL, 0 },
-+    { NULL, 0, NULL, NULL, 0 }
- };
- 
- static int
-@@ -102,11 +108,23 @@ test_strtoid(int *ntests)
- 	(*ntests)++;
- 	errstr = "some error";
- 	value = sudo_strtoid(d->idstr, d->sep, &ep, &errstr);
--	if (errstr != NULL) {
--	    if (d->id != (id_t)-1) {
--		sudo_warnx_nodebug("FAIL: %s: %s", d->idstr, errstr);
-+	if (d->errnum != 0) {
-+	    if (errstr == NULL) {
-+		sudo_warnx_nodebug("FAIL: %s: missing errstr for errno %d",
-+		    d->idstr, d->errnum);
-+		errors++;
-+	    } else if (value != 0) {
-+		sudo_warnx_nodebug("FAIL: %s should return 0 on error",
-+		    d->idstr);
-+		errors++;
-+	    } else if (errno != d->errnum) {
-+		sudo_warnx_nodebug("FAIL: %s: errno mismatch, %d != %d",
-+		    d->idstr, errno, d->errnum);
- 		errors++;
- 	    }
-+	} else if (errstr != NULL) {
-+	    sudo_warnx_nodebug("FAIL: %s: %s", d->idstr, errstr);
-+	    errors++;
- 	} else if (value != d->id) {
- 	    sudo_warnx_nodebug("FAIL: %s != %u", d->idstr, (unsigned int)d->id);
- 	    errors++;
-Index: sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.out.ok
-===================================================================
---- sudo-1.8.21p2.orig/plugins/sudoers/regress/testsudoers/test5.out.ok	2019-10-11 07:11:49.874655384 -0400
-+++ sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.out.ok	2019-10-11 07:11:49.870655365 -0400
-@@ -4,7 +4,7 @@ Parse error in sudoers near line 1.
- Entries for user root:
- 
- Command unmatched
--testsudoers: test5.inc should be owned by gid 4294967295
-+testsudoers: test5.inc should be owned by gid 4294967294
- Parse error in sudoers near line 1.
- 
- Entries for user root:
-Index: sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.sh
-===================================================================
---- sudo-1.8.21p2.orig/plugins/sudoers/regress/testsudoers/test5.sh	2019-10-11 07:11:49.874655384 -0400
-+++ sudo-1.8.21p2/plugins/sudoers/regress/testsudoers/test5.sh	2019-10-11 07:11:49.870655365 -0400
-@@ -24,7 +24,7 @@ EOF
- 
- # Test group writable
- chmod 664 $TESTFILE
--./testsudoers -U $MYUID -G -1 root id <<EOF
-+./testsudoers -U $MYUID -G -2 root id <<EOF
- #include $TESTFILE
- EOF
- 
diff --git a/external/poky/meta/recipes-extended/sudo/sudo_1.8.23.bb b/external/poky/meta/recipes-extended/sudo/sudo_1.8.31.bb
index d12cf2d5..39d8817c 100644
--- a/external/poky/meta/recipes-extended/sudo/sudo_1.8.23.bb
+++ b/external/poky/meta/recipes-extended/sudo/sudo_1.8.31.bb
@@ -1,24 +1,30 @@
 require sudo.inc
 
-SRC_URI = "http://ftp.sudo.ws/sudo/dist/sudo-${PV}.tar.gz \
+SRC_URI = "https://www.sudo.ws/dist/sudo-${PV}.tar.gz \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
            file://0001-Include-sys-types.h-for-id_t-definition.patch \
-           file://CVE-2019-14287_p1.patch \
-           file://CVE-2019-14287_p2.patch \
            "
 
 PAM_SRC_URI = "file://sudo.pam"
 
-SRC_URI[md5sum] = "ea444d747feb1decfebdffd0b38b0739"
-SRC_URI[sha256sum] = "d863d29b6fc87bc784a3223350e2b28a2ff2c4738f0fb8f1c92bb38c3017e679"
+SRC_URI[md5sum] = "ce17ff6e72a70f8d5dabba8abf3cd2de"
+SRC_URI[sha256sum] = "7ea8d97a3cee4c844e0887ea7a1bd80eb54cc98fd77966776cb1a80653ad454f"
 
 DEPENDS += " virtual/crypt ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
 RDEPENDS_${PN} += " ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-limits pam-plugin-keyinit', '', d)}"
 
+CACHED_CONFIGUREVARS = " \
+        ac_cv_type_rsize_t=no \
+        ac_cv_path_MVPROG=${base_bindir}/mv \
+        ac_cv_path_BSHELLPROG=${base_bindir}/sh \
+        ac_cv_path_SENDMAILPROG=${sbindir}/sendmail \
+        ac_cv_path_VIPROG=${base_bindir}/vi \
+        "
+
 EXTRA_OECONF += " \
-             ac_cv_type_rsize_t=no \
              ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--with-pam', '--without-pam', d)} \
-             ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '--enable-tmpfiles.d=${libdir}/tmpfiles.d', '--disable-tmpfiles.d', d)} \
+             ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '--enable-tmpfiles.d=${nonarch_libdir}/tmpfiles.d', '--disable-tmpfiles.d', d)} \
+             --with-vardir=/var/lib/sudo \
              "
 
 do_install_append () {
@@ -37,6 +43,6 @@ do_install_append () {
 	rmdir -p --ignore-fail-on-non-empty ${D}/run/sudo
 }
 
-FILES_${PN} += "${libdir}/tmpfiles.d"
+FILES_${PN} += "${nonarch_libdir}/tmpfiles.d"
 FILES_${PN}-dev += "${libexecdir}/${BPN}/lib*${SOLIBSDEV} ${libexecdir}/${BPN}/*.la \
                     ${libexecdir}/lib*${SOLIBSDEV} ${libexecdir}/*.la"