aboutsummaryrefslogtreecommitdiffstats
path: root/package/system
Commit message (Collapse)AuthorAgeFilesLines
* selinux-policy: update to 1.2.5Linhui Liu2023-05-311-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | 30d503a uci jsonfilter: pipe and leak e13cb64 rpcd leds 144781f jsonfilter, luci, ubus 1210762 rpcd and all agents get fd's leaked ab9227c rpcd 2f99e0e luci rpcd b43aaf3 rpcd (enable/disable services) luci peeraddr f20f03e rpcd 7bc74f6 rpcd reads all subj state and luci-bwc leaks 9634b17 adds inotify perms to anon_inode 3d3c17c adds bare anon_inode (linux 5.15) 7104b20 dnsmasq and luci 0de2c66 luci,rpcd, ucode, wpad 14f5cf9 luci and ucode e3ce84c rpcd, ucode and cgiio loose ends 96a2401 misc updates 9fe0490 initscript: remove redundant rules 71bd77e allow all init scripts to log to logd f697331 sandbox: make ttydev handling more robust a471877 simplify pty tty console access f738984 sandbox: also remove TIOSCTI from all ttydevs Signed-off-by: Linhui Liu <liulinhui36@gmail.com> (cherry picked from commit 4c5a9da8699a7982b8f03b28561f955d9d1313f1)
* ca-certificates: Update to version 20230311Tianling Shen2023-05-312-13/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the ca-certificates and ca-bundle package from version 20211016 to version 20230311. Use TAR_OPTIONS instead of hacking Build/Prepare, refresh patches. Debian change-log entry [1]: |[...] |[ Đoàn Trần Công Danh ] |* ca-certificates: compat with non-GNU mktemp (closes: #1000847) | |[ Ilya Lipnitskiy ] |* certdata2pem.py: use UTC time when checking cert validity | |[ Julien Cristau ] |* Update Mozilla certificate authority bundle to version 2.60 | The following certificate authorities were added (+): | + "Autoridad de Certificacion Firmaprofesional CIF A62634068" | + "Certainly Root E1" | + "Certainly Root R1" | + "D-TRUST BR Root CA 1 2020" | + "D-TRUST EV Root CA 1 2020" | + "DigiCert TLS ECC P384 Root G5" | + "DigiCert TLS RSA4096 Root G5" | + "E-Tugra Global Root CA ECC v3" | + "E-Tugra Global Root CA RSA v3" | + "HARICA TLS ECC Root CA 2021" | + "HARICA TLS RSA Root CA 2021" | + "HiPKI Root CA - G1" | + "ISRG Root X2" | + "Security Communication ECC RootCA1" | + "Security Communication RootCA3" | + "Telia Root CA v2" | + "TunTrust Root CA" | + "vTrus ECC Root CA" | + "vTrus Root CA" | The following certificate authorities were removed (-): | - "Cybertrust Global Root" (expired) | - "EC-ACC" | - "GlobalSign Root CA - R2" (expired) | - "Hellenic Academic and Research Institutions RootCA 2011" | - "Network Solutions Certificate Authority" | - "Staat der Nederlanden EV Root CA" (expired) |* Drop trailing space from debconf template causing misformatting | (closes: #980821) | |[ Wataru Ashihara ] |* Make certdata2pem.py compatible with cryptography >= 35 (closes: #1008244) |[...] [1]: https://metadata.ftp-master.debian.org/changelogs/main/c/ca-certificates/ca-certificates_20230311_changelog Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org> (cherry picked from commit 7c83b6ac8656f9a3b005554d25857e8ed5faf3f6)
* treewide: replace AUTORELEASE with real PKG_RELEASETianling Shen2023-05-183-3/+3
| | | | | | | | | | | | | | | | | | Based on Paul Fertser <fercerpav@gmail.com>'s guidance: Change AUTORELEASE in rules.mk to: ``` AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) ``` then update all affected packages by: ``` for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/clean done ``` Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* ath79: add Cisco Meraki MR18Christian Lamparter2023-05-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: SOC: Atheros/Qualcomm QCA9557-AT4A @ 720MHz RAM: 2x Winbond W9751G6KB-25 (128 MiB) FLASH: Hynix H27U1G8F2BTR-BC TSOP48 ONFI NAND (128 MiB) WIFI1: Atheros AR9550 5.0GHz (SoC) WIFI2: Atheros AR9582-AR1A 2.4GHz WIFI2: Atheros AR9582-AR1A 2.4GHz + 5GHz PHYETH: Atheros AR8035-A, 802.3af PoE capable Atheros (1x Gigabit LAN) LED: 1x Power-LED, 1 x RGB Tricolor-LED INPUT: One Reset Button UART: JP1 on PCB (Labeled UART), 3.3v-Level, 115200n8 (VCC, RX, TX, GND - VCC is closest to the boot set jumper under the console pins.) Flashing instructions: Depending on the installed firmware, there are vastly different methods to flash a MR18. These have been documented on: <https://openwrt.org/toh/meraki/mr18> Tip: Use an initramfs from a previous release and then use sysupgrade to get to the later releases. This is because the initramfs can no longer be built by the build-bots due to its size (>8 MiB). Note on that: Upgrades from AR71XX releases are possible, but they will require the force sysupgrade option ( -F ). Please backup your MR18's configuration before starting the update. The reason here is that a lot of development happend since AR71XX got removed, so I do advise to use the ( -n ) option for sysupgrade as well. This will cause the device to drop the old AR71xx configuration and make a new configurations from scratch. Note on LEDs: The LEDs has changed since AR71XX. The white LED is now used during the boot and when upgrading instead of the green tricolor LED. The technical reason is that currently the RGB-LED is brought up later by a userspace daemon. (added warning note about odm-caldata partition. remove initramfs - it's too big to be built by the bots. MerakiNAND -> meraki-header. sort nu801's targets) Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-214-11/+6
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "gc-sections" in PKG_BUILD_FLAGSAndre Heider2023-03-211-1/+2
| | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-03-212-2/+2
| | | | | | | Keep backwards compatibility via PKG_USE_MIPS16 for now, as this is used in all package feeds. Signed-off-by: Andre Heider <a.heider@gmail.com>
* rpcd: bump to latest git HEADChristian Marangi2023-03-171-4/+4
| | | | | | | | | d978830 rc: add option to get info for a single script in list method 632b4fc rc: add option to skip running check for list method 5577db9 rc: add support for scanning USE_PROCD and skip running if not supported 4de3f02 rc: fix and improve script scanning START and STOP Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* uci: update to git HEADHauke Mehrtens2023-03-051-4/+4
| | | | | | | | | | | | | | | | 5de3871 cli: drop redundant uci_add_delta_path() call for -P f49a2fd delta: simplify uci_load_delta() by using a helper 9b6605e uci: fix use-after-free uci_set on update option b7ceda9 uci: maintain option position in uci_set 7e01d66 uci: optimize update option in uci_set 47697e6 uci: fix use-after-free uci_add_list 74f2797 uci: fix atomicity of uci_add_list b2f3417 uci: maintain option position in uci_add_list 16e8a3b uci: fix memory leak uci_set on update section ae61e1c uci: optimize update section in uci_set 04d0c46 uci: macro uci_alloc_element not in uci.h Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* fstools: update to the latest masterRafał Miłecki2023-02-281-3/+3
| | | | | | bfe882d libblkid-tiny: add exfat superblock support Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* fstools: update to git HEADDaniel Golle2023-02-151-3/+3
| | | | | | 12155d3 libfstools: use class interface to iterate over ubi devices Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* fstools: bump to latest Git HEADChristian Marangi2023-02-041-3/+3
| | | | | | 14d535e partname: Correct fstools_partname_fallback_scan comparison Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ubus: fix wrong package mirror hashPetr Štetiar2023-01-301-1/+1
| | | | | | | | | | I've somehow managed to commit wrong package mirror hash in commit 36076b5a4092 ("ubus: update to version 2022-06-15"), so lets fix it by using a proper one. Fixes: 36076b5a4092 ("ubus: update to version 2022-06-15") Reported-by: Andre Heider <a.heider@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ubus: update to version 2022-06-15Petr Štetiar2023-01-271-3/+3
| | | | | | | | | | | Update which contains just a following fix: * ubusd: add lookup command queuing support Defers and continues a client's lookup command to avoid unnecessary buffering under load. Signed-off-by: Petr Štetiar <ynezz@true.cz>
* rpcd: bump libiwinfo abi requirement to >= 2023-01-21Christian Marangi2023-01-231-2/+2
| | | | | | Bump libiwinfo abi requirement to >= 2023-01-21 for rpcd. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* fstool: bump to latest Git HEADChristian Marangi2023-01-221-4/+4
| | | | | | | | 1ea5855 partname: Introduce fstools_partname_fallback_scan option While at it also drop AUTORELEASE from PKG_RELEASE. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* rpcd: update to latest Git HEADChristian Marangi2023-01-211-3/+3
| | | | | | | | c0df2a7 iwinfo: add "band" and "mhz" to the scan output 06ad60f iwinfo: add "band" to the freqlist output b32fd32 iwinfo: add flags to freqlist output Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* fstools: bump to latest Git HEADChristian Marangi2023-01-211-3/+3
| | | | | | e9b59f0 partname: Ignore root=PARTUUID... Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* procd: update to git HEADDaniel Golle2023-01-161-4/+4
| | | | | | | | 04d7570 jail: fs: don't overwrite existing mount target 6b9629b jail: don't assume positive return value of creat 190f13a init: attempt to mount efivarfs Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* tree-wide: Do not use package librt and libpthreadHauke Mehrtens2022-12-293-8/+4
| | | | | | | | | | | The libraries libpthread, libdl, libutil, libanl have been integrated into the libc library in version 2.34. it is not needed to explicitly link them any more. Most of the functions have been moved from the librt.so into libc.so some time ago already. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* rpcd: update to latest Git HEADJo-Philipp Wich2022-12-161-5/+7
| | | | | | | | | 7de4820 iwinfo: add "hwmodes_text" to the info output b3f530b iwinfo: clean up rpc_iwinfo_call_hw_ht_mode() c46ad61 iwinfo: reuse infos provided by libiwinfo 6c5e900 iwinfo: constify string map arg for rpc_iwinfo_call_int() Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* iucode-tool: fix compile error with musl libc and USE_CPUID_DEVICEChristian Marangi2022-12-041-0/+29
| | | | | | | | | | | Add patch to fix compilation error with USE_CPUID_DEVICE enabled and musl used as libc. Musl doesn't add limits.h header by default and this is required if USE_CPUID_DEVICE is used. The package currently compile because fortify headers include limits.h by default. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* procd: service: pass all arguments to serviceAndrew Ammerlaan2022-11-131-3/+3
| | | | | | | | | Passing all arguments to /etc/init.d/$service restores the behaviour of openwrt 21.02. This is relevant for services such as etherwake which take more then one argument, e.g.: "service etherwake start <list of devices to wake>" Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
* procd: update to git HEADDaniel Golle2022-11-101-3/+3
| | | | | | | | 24f6bc4 jail: correctly check for null pointer 93b2c2d jail: ignore missing .dynamic sect 039b88f sysupgrade: print errno on failure Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* fstools: update to git HEADRafał Miłecki2022-11-101-3/+3
| | | | | | 3affe9e block: try multiple NTFS filesystem implementations Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* fstools: update to git HEADDaniel Golle2022-10-181-3/+3
| | | | | | | | ee54c6b libfstools: skip JFFS2 padding on block devices Fixes config restore on the BPi R3 when using MMC storage. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* rpcd: update to latest Git HEADJo-Philipp Wich2022-10-151-3/+3
| | | | | | 8c852b6 ucode: write ucode runtime exceptions to stderr Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* rpcd: update to latest Git HEADJo-Philipp Wich2022-09-161-3/+3
| | | | | | | e80d0b2 ucode: pass-through `ubus_rpc_session` argument 0d02243 ucode: initialize module search path early Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* rpcd: bump version to 2022-08-24Petr Štetiar2022-08-251-3/+3
| | | | | | | | | | | | | | | | | | | | | | | gcc 10 with -O2 reports following: In function ‘strncpy’, inlined from ‘rpc_sys_packagelist’ at /opt/devel/openwrt/c-projects/rpcd/sys.c:244:4: /usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 128 equals destination size [-Werror=stringop-truncation] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function ‘strncpy’, inlined from ‘rpc_sys_packagelist’ at /opt/devel/openwrt/c-projects/rpcd/sys.c:227:4: /usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 128 equals destination size [-Werror=stringop-truncation] 106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Since it is not possible to avoid truncation by strncpy, it is necessary to make sure the result of strncpy is properly NUL-terminated and the NUL must be inserted explicitly, after strncpy has returned. References: #10442 Reported-by: Alexey Smirnov <s.alexey@gmail.com> Signed-off-by: Petr Štetiar <ynezz@true.cz>
* rpcd: update to latest Git HEADJo-Philipp Wich2022-08-241-3/+3
| | | | | | ae5afea ucode: parse ucode plugin scripts in raw mode, init search path Signed-off-by: Jo-Philipp Wich <jo@mein.io>
* fstools: update to git HEADHauke Mehrtens2022-08-131-3/+3
| | | | | | | 8c213b0 libfstools: Rename move_mount() function to ovl_move_mount() for glibc 2.36 81785c1 block: Do not include linux/fs.h any more Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* ubox: update to latest git HEADHauke Mehrtens2022-08-131-3/+3
| | | | | | | fa6cb9a kmodloader: fix bad realloc usage 4c7b720 kmodloader: fix GCC fanalyzer warnings Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* fstools: add uci fstab section to conffiles for package block-mountFlorian Eckert2022-08-121-0/+4
| | | | | | | | | The command 'opkg search /etc/config/fstab' does not return a package name for this config file. In order to know to which package this config file belongs to, a 'conffiles' entry was made for this file to package 'block-mount'. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* nu801: fix DEPENDS on bcm53xxChristian Lamparter2022-07-171-1/+1
| | | | | | | | | | | the tacked on @TARGET_bcm53xx causes warnings: tmp/.config-package.in:14027:warning: ignoring unsupported character '@' tmp/.config-package.in:26028:warning: ignoring unsupported character '@' this was wrong. Fixes: be1761fa1488 ("nu801: add MR26 to the table") Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* procd: update to git HEADChristian Marangi2022-07-171-3/+3
| | | | | | | ef5d3e3 jail: fix various ignoring return value compilation warning 8e4a956 jail: add WARNING macro to log non critical warning message Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* fstools: update to git HEADChristian Marangi2022-07-171-3/+3
| | | | | | ebf7e90 libfstools: handle gzip return value in block_volume_format Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* ubox: update to latest git HEADChristian Marangi2022-07-171-4/+4
| | | | | | | | 46a33b8 kmodloader: fix compilation warning with not checking return of asprintf Also switch PKG_RELEASE to AUTORELEASE. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
* nu801: add MR26 to the tableChristian Lamparter2022-07-151-3/+3
| | | | | | | The MR26 uses a NU801 for the RGB-Leds. Make the LEDs available. Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
* opkg: update to 2022-02-24Josef Schlehofer2022-06-271-3/+3
| | | | | | | | | | Changes: 9c44557 opkg_remove: avoid remove pkg repeatly with option --force-removal-of-dependent-packages 2edcfad libopkg: set 'const' attribute for argv This should fix the CI error in the packages repository, which happens with perl. Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* fstools: update to git HEADDaniel Golle2022-06-021-3/+3
| | | | | | 93369be Revert "fstools: remove SELinux restorecon hack" Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ubus: update to git HEADDaniel Golle2022-06-011-4/+4
| | | | | | | 2f793a4 lua: add optional path filter to objects() method 2bebf93 ubusd: handle invoke on event object without data Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2022-06-011-3/+3
| | | | | | | 557c98e init: selinux: don't relabel virtual filesystems 7a00968 init: only relabel rootfs if started from initramfs Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* rpcd: update to latest Git HEADChristian 'Ansuel' Marangi2022-06-011-3/+3
| | | | | | | 1c48257 iwinfo: fix compilation error with GCC 12 [remove extra change in Makefile] Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
* Revert "rpcd: update to latest Git HEAD"Christian 'Ansuel' Marangi2022-06-011-8/+3
| | | | This reverts commit 8885cf88279fd131c163d0ac34aeeef0bbff0ceb.
* rpcd: update to latest Git HEADChristian 'Ansuel' Marangi2022-06-011-3/+8
| | | | | | 1c48257 iwinfo: fix compilation error with GCC 12 Signed-off-by: Christian 'Ansuel' Marangi <ansuelsmth@gmail.com>
* selinux-policy: update to version 1.2.3Dominick Grift2022-05-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 86ca9c6 devstatus: prints to terminal 95de949 deal with /rom/dev/console label inconsistencies ab6b6ee uci: hack to deal with potentially mislabeled char files acf9172 dnsmasq this can't be right 021db5b luci-app-tinyproxy cf3a9c4 support/secmark: removes duplicate loopback rules eeb2610 dhcp servers: recv dhcp client packets d5a5fc3 more support/secmark "fixes" 35d8604 update support secmark 4c155c0 packets these were caused by labeling issues with loopback fad35a5 nftables reads routing table f9c5a04 umurmur: kill an mumur instance that does not run as root 10a10c6 mmc stordev make this consistent ab3ec5b Makefile: sort with LC_ALL=C b34eaa5 fwenv rules 8c2960f adds rfkill nodedev and some mmc partitions to stordev 5a9ffe9 rcboot runs fwenv with a transition 9954bf6 dnsmasq in case of tcp ab66468 dnsmasq try this 5bfcb88 dnsmasq stubby not sure why this is happening 863f549 luci not sure why it recv and send server packets d5cddb0 uhttpd sends sigkill luci cgi 44cc04d stubby: it does not maintain anything in there db730b4 Adds stubby ccbcf0e tor simplify network access a308065 tor basic a9c0163 znc loose ends 327a9af acme: allow acme_cleanup.sh to restart znc 4015614 basic znc 7ef14a2 support/secmark: clarify some things 3107afe README: todo qrencode 943035a README and secmark doc 4c90937 ttyd: fix that socket leak again 3239adf dnsmasq icmp packets and fix a tty leak issue b41d38f Makefile: optimize 95d05b1 sandbox dontaudit ttyd leak 0b7d670 rpcd: reads mtu e754bf1 opkg-lists try this 35fb530 opkg-lists: custom 4328754 opkg try to address mislabeled /tmp/opkg-lists 3e2385c rcnftqos 95eae2d ucode c86d366 luci diagnostics e10b443 rpcd packets and wireguard/luci a25e020 igmpproxt packets 0106f00 luci dcef79c nftqos related 3c9bc90 related to nft-qos and luci f8502d4 dnsmasq more related to /usr/lib/dnsmasq/dhcp-script.sh 29a4271 dnsmasq: related to /usr/lib/dnsmasq/dhcp-script.sh 0c5805a some nft-qos 1100b41 adds a label for /tmp/.ujailnoafile e141a83 initscript: i labeled ujail procd.execfile a3b0302 Makefile: adds a default target + packets target 6a3f8ef label usign as opkg and label fwtool and sysupgrade 04d1cc7 sysupgrade: i meant don't do the fc spec 763bec0 sysupgrade: dont do /tmp/sysupgrade.img af2306f adds a failsafe.tmpfile and labels validate_firmware_image 5b15760 fwenv: comment doesnt make sense 370ac3b fwenv: executes shell 67e3fcb fwenv: adds fw_setsys 544d211 adds procd execfile module to label procd related exec files 99d5f13 rclocalconffile: treat /etc/rc.button like /etc/rc.local 4dfd662 label uclient-fetch the same as wget 75d8212 osreleasemiscfile: adds /etc/device_info 0c1f116 adds a rcbuttonconffile for /etc/rc.button (base-files) ccd23f8 adds a syslog.conffile for /etc/syslog.conf (busybox) f790600 adds a libattr.conffile for /etc/xattr.conf fcc028e fwenv: adds fwsys 1255470 xtables: various iptables alternatives a7c4035 Revert "sqm: runs xtables, so also allow nftables" 0d331c3 sqm: runs xtables, so also allow nftables f34076b acme: will run nftables in the near future 6217046 allow ssl.read types to read /tmp/etc/ssl/engines.cnf d0deea3 fixes dns packets 8399efc Revert "sandbox: see if dontauditing this affects things" 73d716a sandbox: see if dontauditing this affects things b5ee097 sandbox: also allow readinherited dropbear pipes 12ee46b iwinfo traverses /tmp/run/wpa_supplicant 4a4d724 agent.cil: also reads inherited dropbear pipes d48013f support/secmark: i tightened my dns packet policy 645ad9e dns packets redone 4790b25 dnsnetpacket: fix obj macro template d9fafff redo dns packets 0a68498 ttyd: leaks a netlink route socket 1d2e6be .gitattributes: remove todo e1bb954 usbutil: reads bus sysfile symlinks d275a32 support/secmark: clean it up a little af5ce12 Makefile: exclude packet types in default make target 3caacdf support/secmark: document tunable/boolean e3dd3e6 invalidpacketselinuxbool: make it build-time again 54f0ccf odhcpd packet fix 4a864ba contrib/secmark: add a big FAT warning bead937 contrib/secmark: adds note about secmark support 146ae16 netpacket remove test 2ce9899 dns packets, odhcp6c raw packet, 4123 ntpnts for netnod 070a45f chrony and unbound packets eba894f rawip socket packets cannot be labeled 656ae0b adds isakmp (500), ipsec-nat-t (4500) and rawip packet types 35325db adds igmp packet type 5cf444c adds icmp packet type 2e41304 sandbox some more packet access for sandbox net 12caad6 packet accesses b8eb9a8 adds a trunkload of packet types a42a336 move rules related to invalid netpeers and ipsec associations a9e40e0 xtables/nftables allow relabelto all packet types aa5a52c README: adds item to wish list 3a96eec experiment: simple label based packet filtering 26d6f95 nftables reads/writes fw pipes Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
* fstools: update to git HEADDaniel Golle2022-05-031-3/+3
| | | | | | 9e11b37 fstools: remove SELinux restorecon hack Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2022-05-031-3/+3
| | | | | | 652e6df init: restore SELinux labels after policy is loaded Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* selinux-policy: update to version 1.1Dominick Grift2022-05-021-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | try to clean up some labeling inconsistencies iwinfo loose ends ucode loose ends Makefile: adjust mintesttgt (adds blockmount/blockd) nftables: reads inherited netifd pipe ucode: reads inherited netifd pipes mountroot: fowner sandbox: writes inherited dropbear pipes unbound related to /tmp/etc/ssl unbound loose ends adds a sslconftmpfile for /tmp/etc/ssl README: maintain a wish list in the README iwinfo: netifd forgot write gptfdisk loose ends iwinfo: netifd wpad reads/writes inherited netifd fifo files netifd (mac80211.sh) executes iwinfo luci: executes wireguard luci-cgi: audits xtables execute access rcuhttpd: lists ssl certfile dirs iwinfo, wifi,nftables usage of ttyd pty if available urandomseed: seedrng needs cap_sys_admin iwinfo iwinfo, nftables and some chronyd rules related to ntp nts server nftables, wifi and adds iwinfo skel nftables, rpcd, ucode nftables, ucode and seedrng ucode, fw3/nftables, luci adds ucode skel and some fw3/nftables related urandomseed: some seedrng rules fw3 adds some support for fw4 urandomseed: /etc/seedrng is for seed.credit hotplugcal: runs ucode which is interpreter like adds a nftables skeleton and makes xtables optional agent: allow all agents to write inherited dropbear pipes urandomseed: this seems to be replaced by seedrng kmodloader: label /etc/modules.conf kmodloader.conffile Revert "shelexecfile: remove auditallow rule" Makefile: sort the modules to process by secilc Moves back to git.defensec.nl unbound odhcpd (ip) reads net proc tcp dump shelexecfile: remove auditallow rule rrd.cil: fixes indent Target rddtool from cgi-io instead of runnit it without transition rrd.cil related rrd, rpcd, cgiio clean ups related to luci-app-statistics Rules for rrd files and luci-statistics unboundcontrol ordering Several missing permissions blockmount, dnsmasq, hotplugcall, rpcd, unbound adds mctp_socket (linux 5.15) ip: forgot tc-tiny type transition to go along with the fc spec ip: adds a fc spec for tc-tiny (called by sqm) adds ttyACM fc spec and various assorted loose ends .gitattributes: do not export the github workflows workflow use selinux 3.3 project moved back to https://git.defensec.nl/selinux-policy.git Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
* fstools: update to git HEADDaniel Golle2022-05-011-3/+3
| | | | | | | | | | | | | f0fc66a libfstools: check for overlay mounting errors 128ecaf Update / fix extroot comments 8a0ba3b libfstools: get rid of "extroot_prefix" global variable 649cd3f libfstools: use variable for overlay mount-point 922f1b3 libfstools: avoid segfault in find_mount_point ce5eacb libfstools: mtd: improve error handling 898b328 blockd: restore device_move semantics 0917d22 block: don't probe mtdblock on NAND (with legacy exceptions) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-11 02:33:20 +0000