From a08774c5259e9b802427190a1a762e1642f7e7aa Mon Sep 17 00:00:00 2001 From: likanchen <31509805+likanchen@users.noreply.github.com> Date: Sat, 18 Jan 2020 01:35:21 +0800 Subject: [PATCH 1/8] Solve a problem during compiling for mt76x8 (#2780) change default package from wpad-basic to wpad-openssl for mt76x8 to solve some problems during compiling. --- target/linux/ramips/mt76x8/target.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/linux/ramips/mt76x8/target.mk b/target/linux/ramips/mt76x8/target.mk index f8b21eac02..f3a060466c 100644 --- a/target/linux/ramips/mt76x8/target.mk +++ b/target/linux/ramips/mt76x8/target.mk @@ -7,7 +7,7 @@ BOARDNAME:=MT76x8 based boards FEATURES+=usb ramdisk CPU_TYPE:=24kc -DEFAULT_PACKAGES += kmod-mt7603 wpad-basic +DEFAULT_PACKAGES += kmod-mt7603 wpad-openssl define Target/Description Build firmware images for Ralink MT76x8 based boards. From 5537db1a88f601b6c0b021c2a4dbba33884599ae Mon Sep 17 00:00:00 2001 From: QING LIU <9l@users.noreply.github.com> Date: Sat, 18 Jan 2020 01:36:05 +0800 Subject: [PATCH 2/8] x86 EFI image: fix EFI image file size (#2783) Fix EFI image file size is not a multiple of 8k block size. It cause a problem when import image disk in pve with zfs file system. --- target/linux/x86/image/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/target/linux/x86/image/Makefile b/target/linux/x86/image/Makefile index 44013ccd4e..86bb8cf1e9 100644 --- a/target/linux/x86/image/Makefile +++ b/target/linux/x86/image/Makefile @@ -140,7 +140,7 @@ ifneq ($(CONFIG_GRUB_IMAGES)$(CONFIG_EFI_IMAGES),) "$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img" # Convert the MBR partition to GPT and set EFI ROOTFS signature - dd if=/dev/zero of="$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img" bs=512 count=33 conv=notrunc oflag=append + dd if=/dev/zero of="$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img" bs=512 count=34 conv=notrunc oflag=append sgdisk -g "$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img" sgdisk -t 2:EF00 "$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img" sgdisk -t 3:EF02 "$(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img" @@ -276,13 +276,13 @@ endif ifneq ($(CONFIG_QCOW2_IMAGES),) define Image/Build/qcow2 rm $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).qcow2 || true - /usr/bin/qemu-img convert -O qcow2 \ + /usr/bin/qemu-img convert -f raw -O qcow2 \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-combined-$(1).qcow2 endef define Image/Build/qcow2_efi rm $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).qcow2 || true - /usr/bin/qemu-img convert -O qcow2 \ + /usr/bin/qemu-img convert -f raw -O qcow2 \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).img \ $(BIN_DIR)/$(IMG_PREFIX)-uefi-gpt-$(1).qcow2 endef From a6fb452315059292d8b9ead02fd445da869df65d Mon Sep 17 00:00:00 2001 From: shizhe Date: Sat, 18 Jan 2020 01:37:06 +0800 Subject: [PATCH 3/8] fix segfault in debug mode (#2794) --- .../pdnsd-alt/patches/01-musl-compat.patch | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 package/lean/pdnsd-alt/patches/01-musl-compat.patch diff --git a/package/lean/pdnsd-alt/patches/01-musl-compat.patch b/package/lean/pdnsd-alt/patches/01-musl-compat.patch new file mode 100644 index 0000000000..c83332bc1a --- /dev/null +++ b/package/lean/pdnsd-alt/patches/01-musl-compat.patch @@ -0,0 +1,37 @@ +--- a/src/main.c ++++ b/src/main.c +@@ -219,6 +219,16 @@ static int check_ipv6() + */ + int main(int argc,char *argv[]) + { ++#if DEBUG>0 ++ { ++ int err; ++ /* Generate a key for storing our thread id's */ ++ if ((err=pthread_key_create(&thrid_key, NULL)) != 0) { ++ log_error("pthread_key_create failed: %s",strerror(err)); ++ _exit(1); ++ } ++ } ++#endif + int i,sig,pfd=-1; /* Initialized to inhibit compiler warning */ + + main_thrid=pthread_self(); +@@ -626,17 +636,6 @@ int main(int argc,char *argv[]) + pthread_sigmask(SIG_BLOCK,&sigs_msk,NULL); + #endif + +-#if DEBUG>0 +- { +- int err; +- /* Generate a key for storing our thread id's */ +- if ((err=pthread_key_create(&thrid_key, NULL)) != 0) { +- log_error("pthread_key_create failed: %s",strerror(err)); +- _exit(1); +- } +- } +-#endif +- + { + #if DEBUG>0 + int thrdsucc=1; From 580a72e141266fc00b66986343a2e763d1a27224 Mon Sep 17 00:00:00 2001 From: VictoriousRaptor <10308169+VictoriousRaptor@users.noreply.github.com> Date: Sat, 18 Jan 2020 02:26:12 +0800 Subject: [PATCH 4/8] Update lua-app-filetransfer (#2688) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Fix #350 既然你都解决了干嘛不PR…… * Convert size in bytes to readable string * Fix kB --- .../luasrc/model/cbi/updownload.lua | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua b/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua index 7b487cb215..af56b44b7c 100644 --- a/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua +++ b/package/lean/luci-app-filetransfer/luasrc/model/cbi/updownload.lua @@ -86,6 +86,16 @@ elseif luci.http.formvalue("download") then Download() end +local function getSizeStr(size) + local i = 0 + local byteUnits = {' kB', ' MB', ' GB', ' TB'} + repeat + size = size / 1024 + i = i + 1 + until(size <= 1024) + return string.format("%.1f", size) .. byteUnits[i] +end + local inits, attr = {} for i, f in ipairs(fs.glob("/tmp/upload/*")) do attr = fs.stat(f) @@ -94,7 +104,7 @@ for i, f in ipairs(fs.glob("/tmp/upload/*")) do inits[i].name = fs.basename(f) inits[i].mtime = os.date("%Y-%m-%d %H:%M:%S", attr.mtime) inits[i].modestr = attr.modestr - inits[i].size = tostring(attr.size) + inits[i].size = getSizeStr(attr.size) inits[i].remove = 0 inits[i].install = false end From 77ab08c20c046d766fdd3f27bc4a96c0fa151ee5 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Fri, 17 Jan 2020 10:38:17 -0800 Subject: [PATCH 5/8] ar71xx: switch kernel to 4.14 --- target/linux/ar71xx/Makefile | 2 +- .../linux/ar71xx/files/arch/mips/ath79/mach-sgr-w500-n85b-v2.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/target/linux/ar71xx/Makefile b/target/linux/ar71xx/Makefile index e7ca46c7ac..93832b560e 100644 --- a/target/linux/ar71xx/Makefile +++ b/target/linux/ar71xx/Makefile @@ -13,7 +13,7 @@ FEATURES:=usbgadget CPU_TYPE:=24kc SUBTARGETS:=generic tiny nand mikrotik -KERNEL_PATCHVER:=4.9 +KERNEL_PATCHVER:=4.14 include $(INCLUDE_DIR)/target.mk diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-sgr-w500-n85b-v2.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-sgr-w500-n85b-v2.c index d2749e483a..d35821388e 100644 --- a/target/linux/ar71xx/files/arch/mips/ath79/mach-sgr-w500-n85b-v2.c +++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-sgr-w500-n85b-v2.c @@ -79,7 +79,7 @@ static struct gpio_keys_button grentech_gpio_keys[] __initdata = { static struct mdio_board_info grentech_mdio0_info[] = { { .bus_id = "ag71xx-mdio.0", - .phy_addr = 1, + .mdio_addr = 1, }, }; From 81ed73d4d61ff23bf9a7c3ea6436c50d3d8fc572 Mon Sep 17 00:00:00 2001 From: dunkeng Date: Sat, 18 Jan 2020 02:41:10 +0800 Subject: [PATCH 6/8] mvebu:switch to kernel 4.19 (#2790) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 我已经本地更新编译测试过没问题，WRT1200AC --- target/linux/mvebu/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/linux/mvebu/Makefile b/target/linux/mvebu/Makefile index a920f6db7d..1688065a5c 100644 --- a/target/linux/mvebu/Makefile +++ b/target/linux/mvebu/Makefile @@ -12,7 +12,7 @@ FEATURES:=fpu usb pci pcie gpio nand squashfs ramdisk boot-part rootfs-part SUBTARGETS:=cortexa9 cortexa53 cortexa72 MAINTAINER:=Imre Kaloz -KERNEL_PATCHVER:=4.14 +KERNEL_PATCHVER:=4.19 include $(INCLUDE_DIR)/target.mk From 6c5dcf4fb8ab5f945537397b271ecf241e3a4934 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Fri, 17 Jan 2020 10:55:30 -0800 Subject: [PATCH 7/8] buildsystem: Make PIE ASLR option tristate --- config/Config-build.in | 22 ++++++++++++++++++---- include/hardening.mk | 9 ++++++++- 2 files changed, 26 insertions(+), 5 deletions(-) diff --git a/config/Config-build.in b/config/Config-build.in index 21c23de3cb..90d5f86b9a 100644 --- a/config/Config-build.in +++ b/config/Config-build.in @@ -191,11 +191,10 @@ menu "Global build settings" this per package by adding PKG_CHECK_FORMAT_SECURITY:=0 in the package Makefile. - config PKG_ASLR_PIE - bool + choice prompt "User space ASLR PIE compilation" - select BUSYBOX_DEFAULT_PIE - default n + default PKG_ASLR_PIE_NONE if ((SMALL_FLASH || LOW_MEMORY_FOOTPRINT) && !SDK) + default PKG_ASLR_PIE_REGULAR help Add -fPIC to CFLAGS and -specs=hardened-build-ld to LDFLAGS. This enables package build as Position Independent Executables (PIE) @@ -206,6 +205,21 @@ menu "Global build settings" to predict when an attacker is attempting a memory-corruption exploit. You can disable this per package by adding PKG_ASLR_PIE:=0 in the package Makefile. + Be ware that ASLR increases the binary size. + config PKG_ASLR_PIE_NONE + bool "None" + help + PIE is deactivated for all applications + config PKG_ASLR_PIE_REGULAR + bool "Regular" + help + PIE is activated for some binaries, mostly network exposed applications + config PKG_ASLR_PIE_ALL + bool "All" + select BUSYBOX_DEFAULT_PIE + help + PIE is activated for all applications + endchoice choice prompt "User space Stack-Smashing Protection" diff --git a/include/hardening.mk b/include/hardening.mk index 60f39428e8..4e49e6b1b9 100644 --- a/include/hardening.mk +++ b/include/hardening.mk @@ -7,6 +7,7 @@ PKG_CHECK_FORMAT_SECURITY ?= 1 PKG_ASLR_PIE ?= 1 +PKG_ASLR_PIE_REGULAR ?= 0 PKG_SSP ?= 1 PKG_FORTIFY_SOURCE ?= 1 PKG_RELRO ?= 1 @@ -16,12 +17,18 @@ ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY TARGET_CFLAGS += -Wformat -Werror=format-security endif endif -ifdef CONFIG_PKG_ASLR_PIE +ifdef CONFIG_PKG_ASLR_PIE_ALL ifeq ($(strip $(PKG_ASLR_PIE)),1) TARGET_CFLAGS += $(FPIC) TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs endif endif +ifdef CONFIG_PKG_ASLR_PIE_REGULAR + ifeq ($(strip $(PKG_ASLR_PIE_REGULAR)),1) + TARGET_CFLAGS += $(FPIC) + TARGET_LDFLAGS += $(FPIC) -specs=$(INCLUDE_DIR)/hardened-ld-pie.specs + endif +endif ifdef CONFIG_PKG_CC_STACKPROTECTOR_REGULAR ifeq ($(strip $(PKG_SSP)),1) TARGET_CFLAGS += -fstack-protector From 5cf20fb286b1d4a6182162810b4a204aa959d916 Mon Sep 17 00:00:00 2001 From: LEAN-ESX Date: Fri, 17 Jan 2020 11:00:51 -0800 Subject: [PATCH 8/8] dnsmasq: Activate PIE by default --- package/network/services/dnsmasq/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index 6c718b2cde..8652343c57 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -23,6 +23,7 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSI PKG_INSTALL:=1 PKG_BUILD_PARALLEL:=1 +PKG_ASLR_PIE_REGULAR:=1 PKG_CONFIG_DEPENDS:= CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcp \ CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dhcpv6 \ CONFIG_PACKAGE_dnsmasq_$(BUILD_VARIANT)_dnssec \