- In 2018 parted was moved from being an addon to being a core program
- The rootfile was moved from rootfiles/packages/ to rootfiles/common/
- The LFS was not updated to remove the PAK_VER etc elements.
- This patch adjusts the LFS file to be in line with being a core program
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-16-2
"Features
Merge #718: Introduce infra-cache-max-rtt option to config max retransmit timeout.
Bug Fixes
Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699.
Fix bug introduced in 'improve val_sigcrypt.c::algo_needs_missing
for one loop pass'.
Merge PR #668 from Cristian Rodríguez: Set IP_BIND_ADDRESS_NO_PORT
on outbound tcp sockets.
Fix verbose EDE error printout.
Fix dname count in sldns parse type descriptor for SVCB and HTTPS.
For windows crosscompile, fix setting the IPV6_MTU socket option
equivalent (IPV6_USER_MTU); allows cross compiling with latest cross-compiler versions.
Merge PR 714: Avoid treat normal hosts as unresponsive servers. And fixup the lock code.
iana portlist update.
Update documentation for 'outbound-msg-retry:'.
Tests for ghost domain fixes."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Quoted from https://capsule8.com/blog/kernel-configuration-glossary/:
> Significance: Critical
>
> In support of Kernel Address Space Layout Randomization (KASLR) this randomizes
> the physical address at which the kernel image is decompressed and the virtual
> address where the kernel image is mapped as a security feature that deters
> exploit attempts relying on knowledge of the location of kernel code internals.
We tried to enable this back in 2020, and failed. Since then, things
may have been improved, so let's give this low-hanging fruit another
try.
Fixes: #12363
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Studies reveal intelligent life before the first cup of coffee is
possibly in theory, but does not exist in practice.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
- Use getmetadata function in services.cgi to determine installed
addon services to display. Removing code duplication and intel that
should only be known by pakfire itself.
- Removed hardcoded exclusions:
- squid should show up correctly using the new metadata info
- mdadm is part of core and will never show up here
- alsa, unknown if this problem still exists, but if it is, this
should be handled somewhere else.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
- Added new getmetadata function for easy access to all available
metadata of a pak without knowledge about or need to parse
pakfire internal db files.
- Added new 'pakfire info' functionality for displaying all available
metadata of (a) pak(s) to the user, using the new getmetadata.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
- Removed UI code from status function now returning hash with status
properties.
- Removed function coreupdate_available as it is now not used anymore
- Added UI code to pakfire status routine
- Added meaningfull exitcode to status:
- 2: Core update available
- 3: Pak update available
- 4: Reboot required
- Error codes can be added together: 2+3 = 5 means both core update
and pak update is available
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
- Added possibility to list available upgrades from commandline
using 'pakfire list upgrade'.
- Added exitcode to 'pakfire list'
- Moved 'Pakfire has finished' log message inside END block to
always log when pakfire exited.
- Fix: allow [options] between 'list' and [installed/notinstalled/
upgrade] parameters (Partly fixes Bug #12868)
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
upgradecore function should just upgrade the core:
Moved check if upgrade is necessary to pakfire upgrade code, removing
code from upgradecore function duplicating codedbinfo workings.
Also adding more vebosity to pakfire upgrade.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Replace dbgetlist code duplicating dblist and getmetafile
workings with call to actual dblist and getmetafile functions.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
- Removed UI code from dblist function and refactor it making it return
a hash representing the pak db for easier handling of this data.
- Moved core update check in dblist to new seperate dbcoreinfo function
making it return a hash with current and possibly available core
version info.
- Update existing calls to dblist
- Bring UI parts previously in dblist to pakfire program itself,
pakfire.cgi and index.cgi with a few small enhancements:
- Translations for 'Core-Update', 'Release', 'Update' and 'Version'
- Add currently installed version numbers to installed paks list in
pakfire.cgi
- Add 'Installed: yes/no' to pakfire list output so people not using
colors have this information too. (Partly fixes Bug #12868)
- Add update available details to pakfire list output if package has
updates available.
Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Stopping services before potentially tampering with files they use is a
more sane approach than doing the latter and hope the running service
can cope with it. Suricata, at least, reportedly doesn't.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
If available, the kernel will enable IOMMU (a/k/a DMA remapping) by
default on boot. To tools making use of that, particularly hypervisors,
this provides better security without any downsides.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Please refer to https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.57
for the changelog of this version. Since it introduces
architecture-dependent rootfile changes due to CPU side-channel
mitigations, changes to ARM rootfiles have been omitted due to the lack
of hardware.
Supposed hardening changes will be submitted separately.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
The second version of this patch uses @ instead of / for sed delimiters,
which makes the command less hard to read. Since Core Update 170 already
requires a reboot at this point, the respective directive is omitted.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
For details see:
https://blog.clamav.net/2022/07/clamav-01037-01041-and-01051-patch.html
"ClamAV 0.105.1 is a critical patch release with the following fixes:
Upgrade the vendored UnRAR library to version 6.1.7.
Fix issue building macOS universal binaries in some configurations.
Silence error message when the logical signature maximum functionality
level is lower than the current functionality level.
Fix scan error when scanning files containing malformed images that
cannot be loaded to calculate an image fuzzy hash.
Fix logical signature "Intermediates" feature.
Relax constraints on slightly malformed ZIP archives that contain
overlapping file entries."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This just came to my view...
I know its not *actually* a link to a "DNS-Proxyserver", but I find it
nice that I can change to the page containing some of the main DNS settings
in just one click. I thought it could be useful.
JM2C
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
For details see:
https://downloads.isc.org/isc/bind9/9.16.31/doc/arm/html/notes.html#notes-for-bind-9-16-31
Excerpt from changelog:
" --- 9.16.31 released ---
5917. [bug] Update ifconfig.sh script as is miscomputed interface
identifiers when destroying interfaces. [GL #3061]
5915. [bug] Detect missing closing brace (}) and computational
overflows in $GENERATE directives. [GL #3429]
5913. [bug] Fix a race between resolver query timeout and
validation in resolver.c:validated(). Remove
resolver.c:maybe_destroy() as it is no loger needed.
[GL #3398]
5909. [bug] The server-side destination port was missing from dnstap
captures of client traffic. [GL #3309]
5905. [bug] When the TCP connection would be closed/reset between
the connect/accept and the read, the uv_read_start()
return value would be unexpected and cause an assertion
failure. [GL #3400]
5903. [bug] When named checks that the OPCODE in a response matches
that of the request, if there is a mismatch named logs
an error. Some of those error messages incorrectly
used RCODE instead of OPCODE to lookup the nemonic.
This has been corrected. [GL !6420]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- 29 strings have been added (otp qrcode, ipblocklist, cve mmio stale
data)
- 8 strings have been improved
- 3 strings have been removed (rdrand and hwrng system, hardware
support)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
