Today CVE-2020-7221 was publicly discussed on oss-sec [1]. MariaDB
upstream had not mentioned this CVE in their last release notes. The CVE
is related to auth-pam and the possibility of a local mariadb to root
user exploit in the mysql_install_db script.
Upstream has made amendments to the script, but according to the oss-sec
posts the folder permissions were not updated as they should have been.
In OpenWrt the script mysql_install_db is actually patched to never run
the commands in question. This has been this way since MariaDB 10.4 was
made available.
Still, the directory permissions set by the postinstall script are too
lax. To quote the discoverer of the issue, Matthias Gerstner from Suse,
they exhibit "the dangerous situation of a setuid-root binary residing
in a directory owned by an unprivileged user".
This commit fixes this by changing the permissions to the following:
root:mariadb 0750 /usr/lib/mariadb/plugin/auth_pam_tool_dir
This way the setuid-root binary is only available to root and the
mariadb user, while at the same time the mariadb user has no ownership
of the directory.
[1] https://seclists.org/oss-sec/2020/q1/55
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Added missing limits header. This is normally included in fortify-headers,
which I have disabled locally.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
With mpd's build system, it requires either an iconv built into the libc
or icu. Since uClibc-ng as configured by OpenWrt currently has no iconv,
use icu for it to work around the problem. This is the simplest solution.
Added a patch to use boost's rounding functions. They are more appropriate
and work with uClibc-ng.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
* Set GOENV=off when building Go compiler and packages, to ignore user's
environment configuration file
* Set GOCACHE when building host Go
* Unset GOTMPDIR, to use the buildroot temp directory instead of temp
directories in build_dir
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This exporter exposes information of the connected stations acquired
from hostapd. These contain additional information compared to the
existing station exporter, however they require a full build of hostapd
/ wpad.
Signed-off-by: David Bauer <mail@david-bauer.net>
- Major version jump from v2.0 to v2.1
- Update haproxy download URL and hash
- Add new patches (see https://www.haproxy.org/bugs/bugs-2.1.2.html)
- Stop building LUA 5.3 in the haproxy build-process and use liblua5.3 as a dependency instead
Signed-off-by: Christian Lachner <gladiac@gmail.com>
- Migrate libusb dependency back to libsane
(virtually all useful backends for OpenWrt would need it anyway)
- Disabled new usb-record-replay feature (avoid libxml2 dep)
- Disabled new escl backend (network-only backend are not too useful
for OpenWrt and it requires libcurl, libnetsnmp, libavahi and libxml2)
- Workaround sane-daemon/postinst installation on Imagebuild
- Enabled backends kvs40xx and mustek_usb2 (fixed upstream)
- Fix bigendian compilation
(https://gitlab.com/sane-project/backends/-/merge_requests/329)
- Fix missing std::round() for uclibc
(https://gitlab.com/sane-project/backends/issues/237)
- Fixes FS#2685: coldplug was running before usblp was loaded. Now
it grants access do usblp when a device using it is plugged.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Fixed license information.
Removed patch requiring autoreconf and replaced with a configure variable.
Removed faulty patch that broke systems without a disabled crypt size hack.
Replaced with using a SED command as well as bcrypt, which works in musl.
Removed su patch and converted it to a SED command in the Makefile.
Added new shadow utilities.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
