From 76c888cb940f7817b8c6c570a760fdf5f0c176cc Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Thu, 16 Aug 2018 21:31:59 +0200 Subject: gnu: e2fsprogs: Update to 1.44.3. * gnu/packages/linux.scm (e2fsprogs): Update to 1.44.3. [source]: Remove glibc-2.27 patch. (extundelete)[source]: Apply e2fsprogs-1.44 patch. * gnu/packages/patches/e2fsprogs-glibc-2.27.patch: Delete file... * gnu/local.mk (dist_patch_DATA): ...remove it, and add... * gnu/packages/patches/extundelete-e2fsprogs-1.44.patch: ...this new file. --- gnu/local.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index 606b3ace3..dbdb22d09 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -650,7 +650,6 @@ dist_patch_DATA = \ %D%/packages/patches/doxygen-gcc-ice.patch \ %D%/packages/patches/doxygen-test.patch \ %D%/packages/patches/dvd+rw-tools-add-include.patch \ - %D%/packages/patches/e2fsprogs-glibc-2.27.patch \ %D%/packages/patches/eigen-arm-neon-fixes.patch \ %D%/packages/patches/elfutils-tests-ptrace.patch \ %D%/packages/patches/elogind-glibc-2.27.patch \ @@ -668,6 +667,7 @@ dist_patch_DATA = \ %D%/packages/patches/evilwm-lost-focus-bug.patch \ %D%/packages/patches/exiv2-CVE-2017-14860.patch \ %D%/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch \ + %D%/packages/patches/extundelete-e2fsprogs-1.44.patch \ %D%/packages/patches/fastcap-mulGlobal.patch \ %D%/packages/patches/fastcap-mulSetup.patch \ %D%/packages/patches/fasthenry-spAllocate.patch \ -- cgit v1.3 From 1dfb14d2f7734e14f1644c609a35d3dc88830501 Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Thu, 16 Aug 2018 21:35:29 +0200 Subject: gnu: btrfs-progs: Update to 4.17.1. * gnu/packages/linux.scm (btrfs-progs): Update to 4.17.1. [source]: Remove patch. [native-inputs]: Add python. * gnu/packages/patches/btrfs-progs-e-value-block.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. --- gnu/local.mk | 1 - gnu/packages/linux.scm | 6 ++-- .../patches/btrfs-progs-e-value-block.patch | 37 ---------------------- 3 files changed, 3 insertions(+), 41 deletions(-) delete mode 100644 gnu/packages/patches/btrfs-progs-e-value-block.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index dbdb22d09..c3d9d1ae4 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -594,7 +594,6 @@ dist_patch_DATA = \ %D%/packages/patches/binutils-loongson-workaround.patch \ %D%/packages/patches/blast+-fix-makefile.patch \ %D%/packages/patches/boost-fix-icu-build.patch \ - %D%/packages/patches/btrfs-progs-e-value-block.patch \ %D%/packages/patches/byobu-writable-status.patch \ %D%/packages/patches/cairo-CVE-2016-9082.patch \ %D%/packages/patches/calibre-no-updates-dialog.patch \ diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm index 02fdd816a..d952c3461 100644 --- a/gnu/packages/linux.scm +++ b/gnu/packages/linux.scm @@ -3240,7 +3240,7 @@ and copy/paste text in the console and in xterm.") (define-public btrfs-progs (package (name "btrfs-progs") - (version "4.15.1") + (version "4.17.1") (source (origin (method url-fetch) (uri (string-append "mirror://kernel.org/linux/kernel/" @@ -3248,8 +3248,7 @@ and copy/paste text in the console and in xterm.") "btrfs-progs-v" version ".tar.xz")) (sha256 (base32 - "15izak6jg6pqr6ha9447cdrdj9k6kfiarvwlrj53cpvrsv02l437")) - (patches (search-patches "btrfs-progs-e-value-block.patch")))) + "0x6d53fbrcmzvhv461575fzsv3373427p4srz646w2wcagqk82xz")))) (build-system gnu-build-system) (outputs '("out" "static")) ; static versions of the binaries in "out" @@ -3285,6 +3284,7 @@ and copy/paste text in the console and in xterm.") ("zstd" ,zstd))) (native-inputs `(("pkg-config" ,pkg-config) ("asciidoc" ,asciidoc) + ("python" ,python) ("xmlto" ,xmlto) ;; For building documentation. ("libxml2" ,libxml2) diff --git a/gnu/packages/patches/btrfs-progs-e-value-block.patch b/gnu/packages/patches/btrfs-progs-e-value-block.patch deleted file mode 100644 index 636514643..000000000 --- a/gnu/packages/patches/btrfs-progs-e-value-block.patch +++ /dev/null @@ -1,37 +0,0 @@ -From c78f59a971ce4b543f3177e383b677862b2d9fb5 Mon Sep 17 00:00:00 2001 -From: Qu Wenruo -Date: Wed, 14 Mar 2018 08:56:57 +0800 -Subject: [PATCH] btrfs-progs: convert/ext2: Remove check for - ext2_ext_attr_entry->e_value_block - -In latest e2fsprogs (1.44.0) definition of ext2_ext_attr_entry has -removed member e_value_block, as currently ext* doesn't support it set -anyway. - -So remove such check so that we can pass compile. - -Issue: #110 -Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199071 -Signed-off-by: Qu Wenruo -Signed-off-by: David Sterba ---- - convert/source-ext2.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/convert/source-ext2.c b/convert/source-ext2.c -index b1492c78..070126ec 100644 ---- a/convert/source-ext2.c -+++ b/convert/source-ext2.c -@@ -422,8 +422,7 @@ static int ext2_xattr_check_entry(struct ext2_ext_attr_entry *entry, - { - size_t value_size = entry->e_value_size; - -- if (entry->e_value_block != 0 || value_size > size || -- entry->e_value_offs + value_size > size) -+ if (value_size > size || entry->e_value_offs + value_size > size) - return -EIO; - return 0; - } --- -2.16.3 - -- cgit v1.3 From e0b49c785b6fe577fbf07e5d74b8544e9d336209 Mon Sep 17 00:00:00 2001 From: Konrad Hinsen Date: Thu, 2 Aug 2018 16:23:11 +0200 Subject: gnu: racket: Update to 7.0. * gnu/packages/scheme.scm (racket): Update to 7.0. [inputs]: Add libedit. [arguments]: Update the list of FFI library references to patch. [source]: Remove 'racket-fix-xform-issue.patch'. * gnu/packages/patches/racket-store-checksum-override.patch: Adjust. * gnu/packages/patches/racket-fix-xform-issue.patch: Delete file. * gnu/local.mk: Adjust accordingly. Signed-off-by: Leo Famulari --- gnu/local.mk | 2 +- gnu/packages/patches/racket-fix-xform-issue.patch | 63 ---------------------- .../patches/racket-store-checksum-override.patch | 19 ++++--- gnu/packages/scheme.scm | 39 +++++++------- 4 files changed, 34 insertions(+), 89 deletions(-) delete mode 100644 gnu/packages/patches/racket-fix-xform-issue.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index c3d9d1ae4..1e64015fa 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1117,7 +1117,7 @@ dist_patch_DATA = \ %D%/packages/patches/rpcbind-CVE-2017-8779.patch \ %D%/packages/patches/rsem-makefile.patch \ %D%/packages/patches/rtags-separate-rct.patch \ - %D%/packages/patches/racket-fix-xform-issue.patch \ + %D%/packages/patches/racket-store-checksum-override.patch \ %D%/packages/patches/ruby-rubygems-276-for-ruby24.patch \ %D%/packages/patches/ruby-concurrent-ignore-broken-test.patch \ %D%/packages/patches/ruby-concurrent-test-arm.patch \ diff --git a/gnu/packages/patches/racket-fix-xform-issue.patch b/gnu/packages/patches/racket-fix-xform-issue.patch deleted file mode 100644 index 0a1640ee5..000000000 --- a/gnu/packages/patches/racket-fix-xform-issue.patch +++ /dev/null @@ -1,63 +0,0 @@ -050cdb59839896b41431791f8ee0ef2564231b8f -Author: Matthew Flatt -AuthorDate: Tue Mar 6 09:05:08 2018 -0700 -Commit: Matthew Flatt -CommitDate: Tue Mar 6 09:05:08 2018 -0700 - -Parent: efb9a919fc ffi docs: clarification on `unsafe-socket->port` -Containing: master -Follows: v5.0.1 (21612) - -xform: avoid problems with `__signbitf128` - -Closes #1962 and uses the suggested patch there, among other changes. - -2 files changed, 6 insertions(+), 3 deletions(-) -racket/collects/compiler/private/xform.rkt | 2 +- -racket/src/racket/src/number.c | 7 +++++-- - -diff --git a/racket/collects/compiler/private/xform.rkt b/racket/collects/compiler/private/xform.rkt -index 28a425c057..89ae848f9c 100644 ---- a/collects/compiler/private/xform.rkt -+++ b/collects/compiler/private/xform.rkt -@@ -904,7 +904,7 @@ - - strlen cos cosl sin sinl exp expl pow powl log logl sqrt sqrtl atan2 atan2l frexp - isnan isinf fpclass signbit _signbit _fpclass __fpclassify __fpclassifyf __fpclassifyl -- _isnan __isfinited __isnanl __isnan __signbit __signbitf __signbitd __signbitl -+ _isnan __isfinited __isnanl __isnan __signbit __signbitf __signbitd __signbitl __signbitf128 - __isinff __isinfl isnanf isinff __isinfd __isnanf __isnand __isinf __isinff128 - __inline_isnanl __inline_isnan __inline_signbit __inline_signbitf __inline_signbitd __inline_signbitl - __builtin_popcount __builtin_clz __builtin_isnan __builtin_isinf __builtin_signbit -diff --git a/racket/src/racket/src/number.c b/racket/src/racket/src/number.c -index 71f42aaf3c..3bbad3ba83 100644 ---- a/src/racket/src/number.c -+++ b/src/racket/src/number.c -@@ -1796,6 +1796,7 @@ double scheme_real_to_double(Scheme_Object *r) - } - - XFORM_NONGCING static MZ_INLINE int minus_zero_p(double d) -+ XFORM_SKIP_PROC - { - #ifdef MZ_IS_NEG_ZERO - return MZ_IS_NEG_ZERO(d); -@@ -1809,7 +1810,9 @@ int scheme_minus_zero_p(double d) - return minus_zero_p(d); - } - --static int rational_dbl_p(double f) { -+XFORM_NONGCING static int rational_dbl_p(double f) -+ XFORM_SKIP_PROC -+{ - return !(MZ_IS_NAN(f) - || MZ_IS_INFINITY(f)); - } -@@ -1955,7 +1958,7 @@ real_p(int argc, Scheme_Object *argv[]) - return (SCHEME_REALP(o) ? scheme_true : scheme_false); - } - --static int is_rational(const Scheme_Object *o) -+XFORM_NONGCING static int is_rational(const Scheme_Object *o) - { - if (SCHEME_FLOATP(o)) - return rational_dbl_p(SCHEME_FLOAT_VAL(o)); \ No newline at end of file diff --git a/gnu/packages/patches/racket-store-checksum-override.patch b/gnu/packages/patches/racket-store-checksum-override.patch index b22facca0..6c9cd5198 100644 --- a/gnu/packages/patches/racket-store-checksum-override.patch +++ b/gnu/packages/patches/racket-store-checksum-override.patch @@ -7,19 +7,23 @@ because the store is immutable. This patch makes Racket ignore checksums for files in the store. See for details. +--- + collects/compiler/private/cm-minimal.rkt | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) -diff -ruN racket-6.12/collects/compiler/cm.rkt racket-6.12-patched/collects/compiler/cm.rkt ---- racket-6.12/collects/compiler/cm.rkt 1969-12-31 19:00:00.000000000 -0500 -+++ racket-6.12-patched/collects/compiler/cm.rkt 2018-08-12 06:36:46.061142149 -0400 +diff --git a/collects/compiler/private/cm-minimal.rkt b/collects/compiler/private/cm-minimal.rkt +index a5a5407..15af6b8 100644 +--- a/collects/compiler/private/cm-minimal.rkt ++++ b/collects/compiler/private/cm-minimal.rkt @@ -7,6 +7,7 @@ racket/list racket/path racket/promise + racket/string openssl/sha1 - racket/place setup/collects -@@ -627,6 +628,10 @@ + compiler/compilation-path +@@ -543,6 +544,10 @@ #f (list src-hash recorded-hash))) @@ -30,7 +34,7 @@ diff -ruN racket-6.12/collects/compiler/cm.rkt racket-6.12-patched/collects/comp (define (rkt->ss p) (if (path-has-extension? p #".rkt") (path-replace-extension p #".ss") -@@ -679,7 +684,8 @@ +@@ -595,7 +600,8 @@ (trace-printf "newer src... ~a > ~a" path-time path-zo-time) ;; If `sha1-only?', then `maybe-compile-zo' returns a #f or thunk: (maybe-compile-zo sha1-only? deps path->mode roots path orig-path read-src-syntax up-to-date collection-cache new-seen)] @@ -40,3 +44,6 @@ diff -ruN racket-6.12/collects/compiler/cm.rkt racket-6.12-patched/collects/comp => (lambda (difference) (trace-printf "different src hash... ~a" difference) ;; If `sha1-only?', then `maybe-compile-zo' returns a #f or thunk: +-- +2.18.0 + diff --git a/gnu/packages/scheme.scm b/gnu/packages/scheme.scm index b30245cce..1e045a27f 100644 --- a/gnu/packages/scheme.scm +++ b/gnu/packages/scheme.scm @@ -65,6 +65,7 @@ #:use-module (gnu packages xorg) #:use-module (gnu packages tls) #:use-module (gnu packages gl) + #:use-module (gnu packages libedit) #:use-module (ice-9 match)) (define (mit-scheme-source-directory system version) @@ -407,22 +408,19 @@ implementation techniques and as an expository tool.") (define-public racket (package (name "racket") - (version "6.12") + (version "7.0") (source (origin - (method url-fetch) - (uri (list (string-append "http://mirror.racket-lang.org/installers/" - version "/racket-" version "-src.tgz") - (string-append - "http://mirror.informatik.uni-tuebingen.de/mirror/racket/" - version "/racket-" version "-src.tgz"))) - (sha256 - (base32 - "0cwcypzjfl9py1s695mhqkiapff7c1w29llsmdj7qgn58wl0apk5")) - (patches (search-patches - ;; See: https://github.com/racket/racket/issues/1962 - ;; This can be removed in whatever Racket release comes after 6.12 - "racket-fix-xform-issue.patch" - "racket-store-checksum-override.patch")))) + (method url-fetch) + (uri (list (string-append "http://mirror.racket-lang.org/installers/" + version "/racket-" version "-src.tgz") + (string-append + "http://mirror.informatik.uni-tuebingen.de/mirror/racket/" + version "/racket-" version "-src.tgz"))) + (sha256 + (base32 + "1glv5amsp9xp480d4yr63hhm9kkyav06yl3a6p489nkr4cln0j9a")) + (patches (search-patches + "racket-store-checksum-override.patch")))) (build-system gnu-build-system) (arguments '(#:phases @@ -485,7 +483,9 @@ implementation techniques and as an expository tool.") ("share/pkgs/gui-lib/mred/private/wx/gtk/gl-context.rkt" ("libGL")) ("share/pkgs/sgl/gl.rkt" - ("libGL" "libGLU"))))) + ("libGL" "libGLU")) + ("share/pkgs/readline-lib/readline/rktrl.rkt" + ("libedit"))))) (chdir "src") #t)) (add-after 'unpack 'patch-/bin/sh @@ -493,7 +493,7 @@ implementation techniques and as an expository tool.") (substitute* "collects/racket/system.rkt" (("/bin/sh") (which "sh"))) #t))) - #:tests? #f ; XXX: how to run them? + #:tests? #f ; XXX: how to run them? )) (inputs `(("libffi" ,libffi) @@ -504,7 +504,7 @@ implementation techniques and as an expository tool.") ("glib" ,glib) ("glu" ,glu) ("gmp" ,gmp) - ("gtk+" ,gtk+) ; propagates gdk-pixbuf+svg + ("gtk+" ,gtk+) ; propagates gdk-pixbuf+svg ("libjpeg" ,libjpeg) ("libpng" ,libpng) ("libx11" ,libx11) @@ -513,7 +513,8 @@ implementation techniques and as an expository tool.") ("openssl" ,openssl) ("pango" ,pango) ("sqlite" ,sqlite) - ("unixodbc" ,unixodbc))) + ("unixodbc" ,unixodbc) + ("libedit" ,libedit))) (home-page "http://racket-lang.org") (synopsis "Implementation of Scheme and related languages") (description -- cgit v1.3 From c4f8953a12b8831bcbbea6a217190ac8ca70ae73 Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Fri, 17 Aug 2018 05:16:23 +0200 Subject: gnu: lxc: Update to 3.0.2. * gnu/packages/virtualization.scm (lxc): Update to 3.0.2. [source]: Remove patch. * gnu/packages/patches/lxc-CVE-2018-6556.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. --- gnu/local.mk | 1 - gnu/packages/patches/lxc-CVE-2018-6556.patch | 116 --------------------------- gnu/packages/virtualization.scm | 5 +- 3 files changed, 2 insertions(+), 120 deletions(-) delete mode 100644 gnu/packages/patches/lxc-CVE-2018-6556.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index 1e64015fa..fc674ffff 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -929,7 +929,6 @@ dist_patch_DATA = \ %D%/packages/patches/luit-posix.patch \ %D%/packages/patches/luminance-hdr-qt-printer.patch \ %D%/packages/patches/lvm2-static-link.patch \ - %D%/packages/patches/lxc-CVE-2018-6556.patch \ %D%/packages/patches/lxsession-use-gapplication.patch \ %D%/packages/patches/lyx-2.2.3-fix-test.patch \ %D%/packages/patches/mailutils-uninitialized-memory.patch \ diff --git a/gnu/packages/patches/lxc-CVE-2018-6556.patch b/gnu/packages/patches/lxc-CVE-2018-6556.patch deleted file mode 100644 index 7eab7101f..000000000 --- a/gnu/packages/patches/lxc-CVE-2018-6556.patch +++ /dev/null @@ -1,116 +0,0 @@ -Fix CVE-2018-6556: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6556 -https://bugzilla.suse.com/show_bug.cgi?id=988348#c8 - -Patch copied from upstream source repository: - -https://github.com/lxc/lxc/commit/c1cf54ebf251fdbad1e971679614e81649f1c032 - -From c1cf54ebf251fdbad1e971679614e81649f1c032 Mon Sep 17 00:00:00 2001 -From: Christian Brauner -Date: Wed, 25 Jul 2018 19:56:54 +0200 -Subject: [PATCH] CVE 2018-6556: verify netns fd in lxc-user-nic - -Signed-off-by: Christian Brauner ---- - src/lxc/cmd/lxc_user_nic.c | 35 ++++++++++++++++++++++++++++++++--- - src/lxc/utils.c | 12 ++++++++++++ - src/lxc/utils.h | 5 +++++ - 3 files changed, 49 insertions(+), 3 deletions(-) - -diff --git a/src/lxc/cmd/lxc_user_nic.c b/src/lxc/cmd/lxc_user_nic.c -index ec9cd97e0..c5beb6c8d 100644 ---- a/src/lxc/cmd/lxc_user_nic.c -+++ b/src/lxc/cmd/lxc_user_nic.c -@@ -1179,12 +1179,41 @@ int main(int argc, char *argv[]) - exit(EXIT_FAILURE); - } - } else if (request == LXC_USERNIC_DELETE) { -- netns_fd = open(args.pid, O_RDONLY); -+ char opath[LXC_PROC_PID_FD_LEN]; -+ -+ /* Open the path with O_PATH which will not trigger an actual -+ * open(). Don't report an errno to the caller to not leak -+ * information whether the path exists or not. -+ * When stracing setuid is stripped so this is not a concern -+ * either. -+ */ -+ netns_fd = open(args.pid, O_PATH | O_CLOEXEC); - if (netns_fd < 0) { -- usernic_error("Could not open \"%s\": %s\n", args.pid, -- strerror(errno)); -+ usernic_error("Failed to open \"%s\"\n", args.pid); -+ exit(EXIT_FAILURE); -+ } -+ -+ if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) { -+ usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid); -+ close(netns_fd); -+ exit(EXIT_FAILURE); -+ } -+ -+ ret = snprintf(opath, sizeof(opath), "/proc/self/fd/%d", netns_fd); -+ if (ret < 0 || (size_t)ret >= sizeof(opath)) { -+ close(netns_fd); -+ exit(EXIT_FAILURE); -+ } -+ -+ /* Now get an fd that we can use in setns() calls. */ -+ ret = open(opath, O_RDONLY | O_CLOEXEC); -+ if (ret < 0) { -+ usernic_error("Failed to open \"%s\": %s\n", args.pid, strerror(errno)); -+ close(netns_fd); - exit(EXIT_FAILURE); - } -+ close(netns_fd); -+ netns_fd = ret; - } - - if (!create_db_dir(LXC_USERNIC_DB)) { -diff --git a/src/lxc/utils.c b/src/lxc/utils.c -index 530b1f81a..3b854e35b 100644 ---- a/src/lxc/utils.c -+++ b/src/lxc/utils.c -@@ -2544,6 +2544,18 @@ bool has_fs_type(const char *path, fs_type_magic magic_val) - return has_type; - } - -+bool fhas_fs_type(int fd, fs_type_magic magic_val) -+{ -+ int ret; -+ struct statfs sb; -+ -+ ret = fstatfs(fd, &sb); -+ if (ret < 0) -+ return false; -+ -+ return is_fs_type(&sb, magic_val); -+} -+ - bool lxc_nic_exists(char *nic) - { - #define __LXC_SYS_CLASS_NET_LEN 15 + IFNAMSIZ + 1 -diff --git a/src/lxc/utils.h b/src/lxc/utils.h -index 6a0bebded..0805f5d0d 100644 ---- a/src/lxc/utils.h -+++ b/src/lxc/utils.h -@@ -95,6 +95,10 @@ - #define CGROUP2_SUPER_MAGIC 0x63677270 - #endif - -+#ifndef NSFS_MAGIC -+#define NSFS_MAGIC 0x6e736673 -+#endif -+ - /* Useful macros */ - /* Maximum number for 64 bit integer is a string with 21 digits: 2^64 - 1 = 21 */ - #define LXC_NUMSTRLEN64 21 -@@ -580,6 +584,7 @@ extern void *must_realloc(void *orig, size_t sz); - /* __typeof__ should be safe to use with all compilers. */ - typedef __typeof__(((struct statfs *)NULL)->f_type) fs_type_magic; - extern bool has_fs_type(const char *path, fs_type_magic magic_val); -+extern bool fhas_fs_type(int fd, fs_type_magic magic_val); - extern bool is_fs_type(const struct statfs *fs, fs_type_magic magic_val); - extern bool lxc_nic_exists(char *nic); - extern int lxc_make_tmpfile(char *template, bool rm); diff --git a/gnu/packages/virtualization.scm b/gnu/packages/virtualization.scm index a39f2fa58..7427465f5 100644 --- a/gnu/packages/virtualization.scm +++ b/gnu/packages/virtualization.scm @@ -340,16 +340,15 @@ all common programming languages. Vala bindings are also provided.") (define-public lxc (package (name "lxc") - (version "3.0.1") + (version "3.0.2") (source (origin (method url-fetch) (uri (string-append "https://linuxcontainers.org/downloads/lxc/lxc-" version ".tar.gz")) - (patches (search-patches "lxc-CVE-2018-6556.patch")) (sha256 (base32 - "1nyml98k28sc5sda0260cmby4irkpnhpwgmx4yhqy10wpr4nr625")))) + "0p1gy553cm4mhwxi85fl6qiwz61rjmvysm8c8pd20qh62xxi3dva")))) (build-system gnu-build-system) (native-inputs `(("pkg-config" ,pkg-config))) -- cgit v1.3 From b66741edc954f0a17f1ef567e8d612cac87c7b6a Mon Sep 17 00:00:00 2001 From: Kei Kebreau Date: Wed, 15 Aug 2018 22:56:59 -0400 Subject: gnu: octave: Update to 4.4.1. * gnu/packages/maths.scm (octave): Update to 4.4.1. (qtoctave)[source]: Remove obsolete patch. * gnu/packages/patches/qtoctave-qt-5.11-fix.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. --- gnu/local.mk | 1 - gnu/packages/maths.scm | 11 ++++------- gnu/packages/patches/qtoctave-qt-5.11-fix.patch | 26 ------------------------- 3 files changed, 4 insertions(+), 34 deletions(-) delete mode 100644 gnu/packages/patches/qtoctave-qt-5.11-fix.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index fc674ffff..aa5188fab 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1097,7 +1097,6 @@ dist_patch_DATA = \ %D%/packages/patches/qemu-glibc-2.27.patch \ %D%/packages/patches/qt4-ldflags.patch \ %D%/packages/patches/qtbase-use-TZDIR.patch \ - %D%/packages/patches/qtoctave-qt-5.11-fix.patch \ %D%/packages/patches/qtscript-disable-tests.patch \ %D%/packages/patches/quagga-reproducible-build.patch \ %D%/packages/patches/quickswitch-fix-dmenu-check.patch \ diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm index 39668c7db..d4529e45b 100644 --- a/gnu/packages/maths.scm +++ b/gnu/packages/maths.scm @@ -1350,12 +1350,12 @@ can solve two kinds of problems: @end enumerate\n") (license license:bsd-3))) -;; For a fully featured Octave, users are strongly recommended also to install +;; For a fully featured Octave, users are strongly recommended also to install ;; the following packages: less, ghostscript, gnuplot. (define-public octave (package (name "octave") - (version "4.4.0") + (version "4.4.1") (source (origin (method url-fetch) @@ -1363,7 +1363,7 @@ can solve two kinds of problems: version ".tar.lz")) (sha256 (base32 - "0nm766737gbkq9wqry54a026k3dg7rb1065kngfpwgjz8b544xbp")))) + "0jsdgizlv02an2ppfjwk5qf209zpwi3317yb7jvlsjzxnir3lvhy")))) (build-system gnu-build-system) (inputs `(("lapack" ,lapack) @@ -1433,10 +1433,7 @@ script files.") (package (inherit octave) (name "qtoctave") (source (origin - (inherit (package-source octave)) - (patches (append (origin-patches (package-source octave)) - (search-patches - "qtoctave-qt-5.11-fix.patch"))))) + (inherit (package-source octave)))) (inputs `(("qscintilla" ,qscintilla) ("qt" ,qtbase) diff --git a/gnu/packages/patches/qtoctave-qt-5.11-fix.patch b/gnu/packages/patches/qtoctave-qt-5.11-fix.patch deleted file mode 100644 index 67317d1b3..000000000 --- a/gnu/packages/patches/qtoctave-qt-5.11-fix.patch +++ /dev/null @@ -1,26 +0,0 @@ -This patch comes from upstream: -https://hg.savannah.gnu.org/hgweb/octave/rev/cdaa884568b1. - -# HG changeset patch -# User Mike Miller -# Date 1527214835 25200 -# Node ID cdaa884568b159549bd373f04386ff62417f6df9 -# Parent 9e39a53b4e007d3f79f88b711ab9fa5f2f24fbc9 -add Qt include needed to build against Qt 5.11 (bug #53978) - -* settings-dialog.cc: Add missing include for to fix build -failure with Qt 5.11. - -diff --git a/libgui/src/settings-dialog.cc b/libgui/src/settings-dialog.cc ---- a/libgui/src/settings-dialog.cc -+++ b/libgui/src/settings-dialog.cc -@@ -34,6 +34,8 @@ - #include "workspace-model.h" - #include "settings-dialog.h" - #include "ui-settings-dialog.h" -+ -+#include - #include - #include - #include - -- cgit v1.3 From 8cd80a4b61962c001bcaf7f3deb10bca88bf22f3 Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Sat, 18 Aug 2018 16:21:22 +0200 Subject: gnu: eigen: Update to 3.3.5. * gnu/packages/algebra.scm (eigen): Update to 3.3.5. [source]: Remove upstreamed ARM patch and obsolete substitutions. * gnu/packages/patches/eigen-arm-neon-fixes.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it. --- gnu/local.mk | 1 - gnu/packages/algebra.scm | 15 +- gnu/packages/patches/eigen-arm-neon-fixes.patch | 245 ------------------------ 3 files changed, 2 insertions(+), 259 deletions(-) delete mode 100644 gnu/packages/patches/eigen-arm-neon-fixes.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index aa5188fab..727056057 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -649,7 +649,6 @@ dist_patch_DATA = \ %D%/packages/patches/doxygen-gcc-ice.patch \ %D%/packages/patches/doxygen-test.patch \ %D%/packages/patches/dvd+rw-tools-add-include.patch \ - %D%/packages/patches/eigen-arm-neon-fixes.patch \ %D%/packages/patches/elfutils-tests-ptrace.patch \ %D%/packages/patches/elogind-glibc-2.27.patch \ %D%/packages/patches/einstein-build.patch \ diff --git a/gnu/packages/algebra.scm b/gnu/packages/algebra.scm index a58ad8448..bb5c80b31 100644 --- a/gnu/packages/algebra.scm +++ b/gnu/packages/algebra.scm @@ -697,16 +697,15 @@ Sine Transform} (DST) and @dfn{Discrete Hartley Transform} (DHT).") (define-public eigen (package (name "eigen") - (version "3.3.4") + (version "3.3.5") (source (origin (method url-fetch) (uri (string-append "https://bitbucket.org/eigen/eigen/get/" version ".tar.bz2")) (sha256 (base32 - "19m4406jvqnwh7kpcvx1lfx2vdc5zwia5q9ayv89bimg1gmln9fx")) + "1qh3yrwn78ms5yhwbpl5wvblk4gbz02cacdygxylr7i9xbrvylkk")) (file-name (string-append name "-" version ".tar.bz2")) - (patches (search-patches "eigen-arm-neon-fixes.patch")) (modules '((guix build utils))) (snippet ;; There are 3 test failures in the "unsupported" directory, @@ -716,16 +715,6 @@ Sine Transform} (DST) and @dfn{Discrete Hartley Transform} (DHT).") (substitute* "unsupported/CMakeLists.txt" (("add_subdirectory\\(test.*") "# Do not build the tests for unsupported features.\n")) - (substitute* "CMakeLists.txt" - ;; Work around - ;; . - (("\"include/eigen3\"") - "\"${CMAKE_INSTALL_PREFIX}/include/eigen3\"")) - (substitute* "test/bdcsvd.cpp" - ;; See - ;; https://bitbucket.org/eigen/eigen/commits/ea8c22ce6920e982d15245ee41d0531a46a28e5d - ((".*svd_preallocate[^\n]*" &) - (string-append "//" & " // Not supported by BDCSVD"))) #t)))) (build-system cmake-build-system) (arguments diff --git a/gnu/packages/patches/eigen-arm-neon-fixes.patch b/gnu/packages/patches/eigen-arm-neon-fixes.patch deleted file mode 100644 index 0838f3046..000000000 --- a/gnu/packages/patches/eigen-arm-neon-fixes.patch +++ /dev/null @@ -1,245 +0,0 @@ -# HG changeset patch -# User Gael Guennebaud -# Date 1497514590 -7200 -# Node ID d781c1de98342c5ca29c2fe719d8d3c96a35dcd4 -# Parent 48cd83b2b459aa9f3f5dca135d38760fe0b02a2f -Bug 1436: fix compilation of Jacobi rotations with ARM NEON, some specializations of internal::conj_helper were missing. - -diff --git a/Eigen/Core b/Eigen/Core ---- a/Eigen/Core -+++ b/Eigen/Core -@@ -371,6 +371,7 @@ - #include "src/Core/MathFunctions.h" - #include "src/Core/GenericPacketMath.h" - #include "src/Core/MathFunctionsImpl.h" -+#include "src/Core/arch/Default/ConjHelper.h" - - #if defined EIGEN_VECTORIZE_AVX512 - #include "src/Core/arch/SSE/PacketMath.h" -diff --git a/Eigen/src/Core/arch/AVX/Complex.h b/Eigen/src/Core/arch/AVX/Complex.h ---- a/Eigen/src/Core/arch/AVX/Complex.h -+++ b/Eigen/src/Core/arch/AVX/Complex.h -@@ -204,23 +204,7 @@ - } - }; - --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet4cf pmadd(const Packet8f& x, const Packet4cf& y, const Packet4cf& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet4cf pmul(const Packet8f& x, const Packet4cf& y) const -- { return Packet4cf(Eigen::internal::pmul(x, y.v)); } --}; -- --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet4cf pmadd(const Packet4cf& x, const Packet8f& y, const Packet4cf& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet4cf pmul(const Packet4cf& x, const Packet8f& y) const -- { return Packet4cf(Eigen::internal::pmul(x.v, y)); } --}; -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet4cf,Packet8f) - - template<> EIGEN_STRONG_INLINE Packet4cf pdiv(const Packet4cf& a, const Packet4cf& b) - { -@@ -400,23 +384,7 @@ - } - }; - --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet2cd pmadd(const Packet4d& x, const Packet2cd& y, const Packet2cd& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet2cd pmul(const Packet4d& x, const Packet2cd& y) const -- { return Packet2cd(Eigen::internal::pmul(x, y.v)); } --}; -- --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet2cd pmadd(const Packet2cd& x, const Packet4d& y, const Packet2cd& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet2cd pmul(const Packet2cd& x, const Packet4d& y) const -- { return Packet2cd(Eigen::internal::pmul(x.v, y)); } --}; -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet2cd,Packet4d) - - template<> EIGEN_STRONG_INLINE Packet2cd pdiv(const Packet2cd& a, const Packet2cd& b) - { -diff --git a/Eigen/src/Core/arch/AltiVec/Complex.h b/Eigen/src/Core/arch/AltiVec/Complex.h ---- a/Eigen/src/Core/arch/AltiVec/Complex.h -+++ b/Eigen/src/Core/arch/AltiVec/Complex.h -@@ -224,23 +224,7 @@ - } - }; - --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet2cf pmadd(const Packet4f& x, const Packet2cf& y, const Packet2cf& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet2cf pmul(const Packet4f& x, const Packet2cf& y) const -- { return Packet2cf(internal::pmul(x, y.v)); } --}; -- --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet2cf pmadd(const Packet2cf& x, const Packet4f& y, const Packet2cf& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet2cf pmul(const Packet2cf& x, const Packet4f& y) const -- { return Packet2cf(internal::pmul(x.v, y)); } --}; -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet2cf,Packet4f) - - template<> EIGEN_STRONG_INLINE Packet2cf pdiv(const Packet2cf& a, const Packet2cf& b) - { -@@ -416,23 +400,8 @@ - return pconj(internal::pmul(a, b)); - } - }; --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet1cd pmadd(const Packet2d& x, const Packet1cd& y, const Packet1cd& c) const -- { return padd(c, pmul(x,y)); } - -- EIGEN_STRONG_INLINE Packet1cd pmul(const Packet2d& x, const Packet1cd& y) const -- { return Packet1cd(internal::pmul(x, y.v)); } --}; -- --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet1cd pmadd(const Packet1cd& x, const Packet2d& y, const Packet1cd& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet1cd pmul(const Packet1cd& x, const Packet2d& y) const -- { return Packet1cd(internal::pmul(x.v, y)); } --}; -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet1cd,Packet2d) - - template<> EIGEN_STRONG_INLINE Packet1cd pdiv(const Packet1cd& a, const Packet1cd& b) - { -diff --git a/Eigen/src/Core/arch/Default/ConjHelper.h b/Eigen/src/Core/arch/Default/ConjHelper.h -new file mode 100644 ---- /dev/null -+++ b/Eigen/src/Core/arch/Default/ConjHelper.h -@@ -0,0 +1,29 @@ -+ -+// This file is part of Eigen, a lightweight C++ template library -+// for linear algebra. -+// -+// Copyright (C) 2017 Gael Guennebaud -+// -+// This Source Code Form is subject to the terms of the Mozilla -+// Public License v. 2.0. If a copy of the MPL was not distributed -+// with this file, You can obtain one at http://mozilla.org/MPL/2.0/. -+ -+#ifndef EIGEN_ARCH_CONJ_HELPER_H -+#define EIGEN_ARCH_CONJ_HELPER_H -+ -+#define EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(PACKET_CPLX, PACKET_REAL) \ -+ template<> struct conj_helper { \ -+ EIGEN_STRONG_INLINE PACKET_CPLX pmadd(const PACKET_REAL& x, const PACKET_CPLX& y, const PACKET_CPLX& c) const \ -+ { return padd(c, pmul(x,y)); } \ -+ EIGEN_STRONG_INLINE PACKET_CPLX pmul(const PACKET_REAL& x, const PACKET_CPLX& y) const \ -+ { return PACKET_CPLX(Eigen::internal::pmul(x, y.v)); } \ -+ }; \ -+ \ -+ template<> struct conj_helper { \ -+ EIGEN_STRONG_INLINE PACKET_CPLX pmadd(const PACKET_CPLX& x, const PACKET_REAL& y, const PACKET_CPLX& c) const \ -+ { return padd(c, pmul(x,y)); } \ -+ EIGEN_STRONG_INLINE PACKET_CPLX pmul(const PACKET_CPLX& x, const PACKET_REAL& y) const \ -+ { return PACKET_CPLX(Eigen::internal::pmul(x.v, y)); } \ -+ }; -+ -+#endif // EIGEN_ARCH_CONJ_HELPER_H -diff --git a/Eigen/src/Core/arch/NEON/Complex.h b/Eigen/src/Core/arch/NEON/Complex.h ---- a/Eigen/src/Core/arch/NEON/Complex.h -+++ b/Eigen/src/Core/arch/NEON/Complex.h -@@ -265,6 +265,8 @@ - } - }; - -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet2cf,Packet4f) -+ - template<> EIGEN_STRONG_INLINE Packet2cf pdiv(const Packet2cf& a, const Packet2cf& b) - { - // TODO optimize it for NEON -@@ -456,6 +458,8 @@ - } - }; - -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet1cd,Packet2d) -+ - template<> EIGEN_STRONG_INLINE Packet1cd pdiv(const Packet1cd& a, const Packet1cd& b) - { - // TODO optimize it for NEON -diff --git a/Eigen/src/Core/arch/SSE/Complex.h b/Eigen/src/Core/arch/SSE/Complex.h ---- a/Eigen/src/Core/arch/SSE/Complex.h -+++ b/Eigen/src/Core/arch/SSE/Complex.h -@@ -229,23 +229,7 @@ - } - }; - --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet2cf pmadd(const Packet4f& x, const Packet2cf& y, const Packet2cf& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet2cf pmul(const Packet4f& x, const Packet2cf& y) const -- { return Packet2cf(Eigen::internal::pmul(x, y.v)); } --}; -- --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet2cf pmadd(const Packet2cf& x, const Packet4f& y, const Packet2cf& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet2cf pmul(const Packet2cf& x, const Packet4f& y) const -- { return Packet2cf(Eigen::internal::pmul(x.v, y)); } --}; -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet2cf,Packet4f) - - template<> EIGEN_STRONG_INLINE Packet2cf pdiv(const Packet2cf& a, const Packet2cf& b) - { -@@ -430,23 +414,7 @@ - } - }; - --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet1cd pmadd(const Packet2d& x, const Packet1cd& y, const Packet1cd& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet1cd pmul(const Packet2d& x, const Packet1cd& y) const -- { return Packet1cd(Eigen::internal::pmul(x, y.v)); } --}; -- --template<> struct conj_helper --{ -- EIGEN_STRONG_INLINE Packet1cd pmadd(const Packet1cd& x, const Packet2d& y, const Packet1cd& c) const -- { return padd(c, pmul(x,y)); } -- -- EIGEN_STRONG_INLINE Packet1cd pmul(const Packet1cd& x, const Packet2d& y) const -- { return Packet1cd(Eigen::internal::pmul(x.v, y)); } --}; -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet1cd,Packet2d) - - template<> EIGEN_STRONG_INLINE Packet1cd pdiv(const Packet1cd& a, const Packet1cd& b) - { -diff --git a/Eigen/src/Core/arch/ZVector/Complex.h b/Eigen/src/Core/arch/ZVector/Complex.h ---- a/Eigen/src/Core/arch/ZVector/Complex.h -+++ b/Eigen/src/Core/arch/ZVector/Complex.h -@@ -336,6 +336,9 @@ - } - }; - -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet2cf,Packet4f) -+EIGEN_MAKE_CONJ_HELPER_CPLX_REAL(Packet1cd,Packet2d) -+ - template<> EIGEN_STRONG_INLINE Packet1cd pdiv(const Packet1cd& a, const Packet1cd& b) - { - // TODO optimize it for AltiVec -- cgit v1.3 From 0b93d04ac537d6413999349ebe7cdcb1e961700e Mon Sep 17 00:00:00 2001 From: Ludovic Courtès Date: Sun, 19 Aug 2018 18:20:05 +0200 Subject: gnu: gcc@4.8: Fix libsanitizer build issue. Fixes . Reported by fis trivial . * gnu/packages/patches/gcc-4.8-libsanitizer-fix.patch: New file. * gnu/packages/gcc.scm (gcc-4.8)[source]: Use it. * gnu/local.mk (dist_patch_DATA): Add it. --- gnu/local.mk | 1 + gnu/packages/gcc.scm | 1 + gnu/packages/patches/gcc-4.8-libsanitizer-fix.patch | 15 +++++++++++++++ 3 files changed, 17 insertions(+) create mode 100644 gnu/packages/patches/gcc-4.8-libsanitizer-fix.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index 5789a872d..4013803b0 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -695,6 +695,7 @@ dist_patch_DATA = \ %D%/packages/patches/gcc-asan-missing-include.patch \ %D%/packages/patches/gcc-cross-environment-variables.patch \ %D%/packages/patches/gcc-fix-texi2pod.patch \ + %D%/packages/patches/gcc-4.8-libsanitizer-fix.patch \ %D%/packages/patches/gcc-4.9-libsanitizer-fix.patch \ %D%/packages/patches/gcc-libsanitizer-fix.patch \ %D%/packages/patches/gcc-libvtv-runpath.patch \ diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm index 04d0a8527..bdff2ddad 100644 --- a/gnu/packages/gcc.scm +++ b/gnu/packages/gcc.scm @@ -365,6 +365,7 @@ Go. It also includes runtime support libraries for these languages.") (base32 "08yggr18v373a1ihj0rg2vd6psnic42b518xcgp3r9k81xz1xyr2")) (patches (search-patches "gcc-arm-link-spec-fix.patch" + "gcc-4.8-libsanitizer-fix.patch" "gcc-asan-missing-include.patch" "gcc-fix-texi2pod.patch")) (modules '((guix build utils))) diff --git a/gnu/packages/patches/gcc-4.8-libsanitizer-fix.patch b/gnu/packages/patches/gcc-4.8-libsanitizer-fix.patch new file mode 100644 index 000000000..86a3ee912 --- /dev/null +++ b/gnu/packages/patches/gcc-4.8-libsanitizer-fix.patch @@ -0,0 +1,15 @@ +This is a backport of part of this patch from 6.5 to 4.8: + + https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=8937b94d1a643fd9760714642296d034a45254a8 + +--- a/libsanitizer/tsan/tsan_platform_linux.cc ++++ b/libsanitizer/tsan/tsan_platform_linux.cc +@@ -351,7 +351,7 @@ bool IsGlobalVar(uptr addr) { + // closes within glibc. The code is a pure hack. + int ExtractResolvFDs(void *state, int *fds, int nfd) { + int cnt = 0; +- __res_state *statp = (__res_state*)state; ++ struct __res_state *statp = (struct __res_state*)state; + for (int i = 0; i < MAXNS && cnt < nfd; i++) { + if (statp->_u._ext.nsaddrs[i] && statp->_u._ext.nssocks[i] != -1) + fds[cnt++] = statp->_u._ext.nssocks[i]; -- cgit v1.3 From 6cd2c4a83cc2baa387d04979b489bee2429cc39d Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Wed, 15 Aug 2018 16:28:25 -0400 Subject: gnu: openssh: Don't allow remote username enumeration [fixes CVE-2018-15473]. * gnu/packages/patches/openssh-CVE-2018-15473.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/ssh.scm (openssh)[source]: Use it. --- gnu/local.mk | 1 + gnu/packages/patches/openssh-CVE-2018-15473.patch | 165 ++++++++++++++++++++++ gnu/packages/ssh.scm | 1 + 3 files changed, 167 insertions(+) create mode 100644 gnu/packages/patches/openssh-CVE-2018-15473.patch (limited to 'gnu/local.mk') diff --git a/gnu/local.mk b/gnu/local.mk index 4013803b0..eb0862448 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -997,6 +997,7 @@ dist_patch_DATA = \ %D%/packages/patches/openldap-CVE-2017-9287.patch \ %D%/packages/patches/openocd-nrf52.patch \ %D%/packages/patches/opensmtpd-fix-crash.patch \ + %D%/packages/patches/openssh-CVE-2018-15473.patch \ %D%/packages/patches/openssl-runpath.patch \ %D%/packages/patches/openssl-1.0.2-CVE-2018-0495.patch \ %D%/packages/patches/openssl-1.0.2-CVE-2018-0732.patch \ diff --git a/gnu/packages/patches/openssh-CVE-2018-15473.patch b/gnu/packages/patches/openssh-CVE-2018-15473.patch new file mode 100644 index 000000000..26b2dc59c --- /dev/null +++ b/gnu/packages/patches/openssh-CVE-2018-15473.patch @@ -0,0 +1,165 @@ +Fix CVE-2018-15473, a method by which remote clients can enumerate +usernames on the server: + +http://seclists.org/oss-sec/2018/q3/124 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15473 + +Patch adapted from upstream source repository: + +https://anongit.mindrot.org/openssh.git/commit/?id=74287f5df9966a0648b4a68417451dd18f079ab8 + +From 74287f5df9966a0648b4a68417451dd18f079ab8 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Tue, 31 Jul 2018 03:10:27 +0000 +Subject: [PATCH] upstream: delay bailout for invalid authentic + +=?UTF-8?q?ating=20user=20until=20after=20the=20packet=20containing=20the?= +=?UTF-8?q?=20request=20has=20been=20fully=20parsed.=20Reported=20by=20Dar?= +=?UTF-8?q?iusz=20Tytko=20and=20Micha=C5=82=20Sajdak;=20ok=20deraadt?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +OpenBSD-Commit-ID: b4891882fbe413f230fe8ac8a37349b03bd0b70d +--- + auth2-gss.c | 11 +++++++---- + auth2-hostbased.c | 11 ++++++----- + auth2-pubkey.c | 25 +++++++++++++++---------- + 3 files changed, 28 insertions(+), 19 deletions(-) + +# Adapted from upstream to apply to OpenSSH 7.7p1. +diff --git a/auth2-gss.c b/auth2-gss.c +index 589283b7..1d7cfb39 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -69,9 +69,6 @@ userauth_gssapi(struct ssh *ssh) + u_int len; + u_char *doid = NULL; + +- if (!authctxt->valid || authctxt->user == NULL) +- return (0); +- + mechs = packet_get_int(); + if (mechs == 0) { + debug("Mechanism negotiation is not supported"); +diff --git a/auth2-gss.c b/auth2-gss.c +index 47308c5c..9351e042 100644 +--- a/auth2-gss.c ++++ b/auth2-gss.c +@@ -106,6 +103,12 @@ userauth_gssapi(struct ssh *ssh) + return (0); + } + ++ if (!authctxt->valid || authctxt->user == NULL) { ++ debug2("%s: disabled because of invalid user", __func__); ++ free(doid); ++ return (0); ++ } ++ + if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) { + if (ctxt != NULL) + ssh_gssapi_delete_ctx(&ctxt); +diff --git a/auth2-hostbased.c b/auth2-hostbased.c +index 60159a56..35939329 100644 +--- a/auth2-hostbased.c ++++ b/auth2-hostbased.c +@@ -67,10 +67,6 @@ userauth_hostbased(struct ssh *ssh) + size_t alen, blen, slen; + int r, pktype, authenticated = 0; + +- if (!authctxt->valid) { +- debug2("%s: disabled because of invalid user", __func__); +- return 0; +- } + /* XXX use sshkey_froms() */ + if ((r = sshpkt_get_cstring(ssh, &pkalg, &alen)) != 0 || + (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0 || +@@ -117,6 +113,11 @@ userauth_hostbased(struct ssh *ssh) + goto done; + } + ++ if (!authctxt->valid || authctxt->user == NULL) { ++ debug2("%s: disabled because of invalid user", __func__); ++ goto done; ++ } ++ + if ((b = sshbuf_new()) == NULL) + fatal("%s: sshbuf_new failed", __func__); + /* reconstruct packet */ +diff --git a/auth2-pubkey.c b/auth2-pubkey.c +index c4d0f790..e1c15040 100644 +--- a/auth2-pubkey.c ++++ b/auth2-pubkey.c +@@ -89,19 +89,15 @@ userauth_pubkey(struct ssh *ssh) + { + Authctxt *authctxt = ssh->authctxt; + struct passwd *pw = authctxt->pw; +- struct sshbuf *b; ++ struct sshbuf *b = NULL; + struct sshkey *key = NULL; +- char *pkalg, *userstyle = NULL, *key_s = NULL, *ca_s = NULL; +- u_char *pkblob, *sig, have_sig; ++ char *pkalg = NULL, *userstyle = NULL, *key_s = NULL, *ca_s = NULL; ++ u_char *pkblob = NULL, *sig = NULL, have_sig; + size_t blen, slen; + int r, pktype; + int authenticated = 0; + struct sshauthopt *authopts = NULL; + +- if (!authctxt->valid) { +- debug2("%s: disabled because of invalid user", __func__); +- return 0; +- } + if ((r = sshpkt_get_u8(ssh, &have_sig)) != 0 || + (r = sshpkt_get_cstring(ssh, &pkalg, NULL)) != 0 || + (r = sshpkt_get_string(ssh, &pkblob, &blen)) != 0) +@@ -167,6 +163,11 @@ userauth_pubkey(struct ssh *ssh) + fatal("%s: sshbuf_put_string session id: %s", + __func__, ssh_err(r)); + } ++ if (!authctxt->valid || authctxt->user == NULL) { ++ debug2("%s: disabled because of invalid user", ++ __func__); ++ goto done; ++ } + /* reconstruct packet */ + xasprintf(&userstyle, "%s%s%s", authctxt->user, + authctxt->style ? ":" : "", +@@ -183,7 +184,6 @@ userauth_pubkey(struct ssh *ssh) + #ifdef DEBUG_PK + sshbuf_dump(b, stderr); + #endif +- + /* test for correct signature */ + authenticated = 0; + if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) && +@@ -194,7 +194,6 @@ userauth_pubkey(struct ssh *ssh) + authenticated = 1; + } + sshbuf_free(b); +- free(sig); + auth2_record_key(authctxt, authenticated, key); + } else { + debug("%s: test pkalg %s pkblob %s%s%s", +@@ -205,6 +204,11 @@ userauth_pubkey(struct ssh *ssh) + if ((r = sshpkt_get_end(ssh)) != 0) + fatal("%s: %s", __func__, ssh_err(r)); + ++ if (!authctxt->valid || authctxt->user == NULL) { ++ debug2("%s: disabled because of invalid user", ++ __func__); ++ goto done; ++ } + /* XXX fake reply and always send PK_OK ? */ + /* + * XXX this allows testing whether a user is allowed +@@ -238,6 +242,7 @@ done: + free(pkblob); + free(key_s); + free(ca_s); ++ free(sig); + return authenticated; + } + +-- +2.18.0 diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm index 90205fa93..876993e16 100644 --- a/gnu/packages/ssh.scm +++ b/gnu/packages/ssh.scm @@ -153,6 +153,7 @@ a server that supports the SSH-2 protocol.") (method url-fetch) (uri (string-append "mirror://openbsd/OpenSSH/portable/" name "-" version ".tar.gz")) + (patches (search-patches "openssh-CVE-2018-15473.patch")) (sha256 (base32 "13vbbrvj3mmfhj83qyrg5c0ipr6bzw5s65dy4k8gr7p9hkkfffyp")))) -- cgit v1.3