aboutsummaryrefslogtreecommitdiffstats
path: root/package/system
Commit message (Collapse)AuthorAgeFilesLines
...
* Revert "refpolicy: add variant that builds modular policy"Daniel Golle2020-11-221-33/+2
| | | | | | | | | | This reverts commit 9eb9943f82e0b2d5e32ffe1c63f5a82caca5094d. Building the 'modular' variant requires 'semodule_package' from 'selinux-python' to be installed on the buildhost. Apart from that, this change also broke the monolithic refpolicy 'targeted' build. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-11-221-3/+3
| | | | | | | | | 04a2edd uxc: make force-delete kill container process be6da62 seccomp: silence 'unknown syscall' warnings b22e625 jail: cgroup hack: rewrite cgroup -> cgroup2 df7fa7b uxc: fix incomplete commit Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: drop legacy seccomp support, switch to OCI parsersDaniel Golle2020-11-171-3/+3
| | | | | | | | d8f36f5 seccomp: specifying architectures is optional d352e6e seccomp: switch to new OCI compliant parser c110405 trace: switch to OCI seccomp JSON output Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* rpcd: remove file when appliedHuangbin Zhan2020-11-122-5/+7
| | | | | | Make sure exit value of this script is zero. Or the file won't be deleted. Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
* ca-certificates: canonical the build dirJianhui Zhao2020-11-121-1/+7
| | | | | | | The previous build directory "build_dir/target-xx/work/" contaminated the entire build directory. Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
* refpolicy: add variant that builds modular policyW. Michael Petullo2020-11-091-2/+33
| | | | | | | | | This adds a variant of refpolicy that builds the modular form of the policy. While this requires more memory on the target device, along with some tricks to deal with OpenWrt's volatile /var directory, it is useful for experiementing with SELinux policy. Signed-off-by: W. Michael Petullo <mike@flyn.org>
* procd: bump to git HEADDaniel Golle2020-11-071-3/+3
| | | | | | b0de894 jail: fix capabilities Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: bump to git HEADDaniel Golle2020-11-051-3/+3
| | | | | | | | | | | | 2f381fe jail: guard boolean blobmsg attributes 602b8fa jail: add option for pidfile bba6de7 jail: handle mount propagation flags 6963d50 jail: relax seccomp unknown syscall handling e1fcfdc jail: add support for absolute root path in OCI spec 257f29b jail: don't fail if maskedPath cannot be found 75f2374 uxc: mimic runc cmdline by using getopt_long Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* opkg: clean up and fix performance regressionDaniel Golle2020-11-031-3/+3
| | | | | | | da9746a libopkg: clean up handling of unresolved dependencies Signed-off-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Paul Spooren <mail@aparcar.org>
* opkg: fix yet another dependency resolution bugDaniel Golle2020-11-021-3/+3
| | | | | | | | | | The previous fix of a fix caused yet another problem leading to `opkg show-upgradable` ending up in an infinite loop. Fix that. Fixes: 4a2b1ff7fb ("opkg: fix dependency resolution") Reported-by: Huangbin Zhan <zhanhb88@gmail.com> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* opkg: fix dependency resolutionDaniel Golle2020-11-021-3/+3
| | | | | | | | | | | | The previous commit broke opkg in a way that it would no longer include dependencies when installing a package, effectively leading to broken images and unusable systems. Fix that by making sure dependencies are still going to be checked. Also reduce size of struct abstract_pkg as suggested by @jow- while at it. Fixes: 1445d333aa ("opkg: bump to git HEAD") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* zram-swap: use new extra_command wrapperFlorian Eckert2020-11-022-4/+3
| | | | | | Use new `extra_command` wrapper to fix the alignement. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
* opkg: bump to git HEADDaniel Golle2020-10-301-3/+3
| | | | | | 8769c75 pkg_hash: don't suggest incompatible packages Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* uci: fix package mirror hashPetr Štetiar2020-10-271-1/+1
| | | | | | | | I've forget to update PKG_MIRROR_HASH in my previous package version bump. Fixes: 095cc2b7454a ("uci: update to version 2020-10-06") Signed-off-by: Petr Štetiar <ynezz@true.cz>
* uci: update to version 2020-10-06Petr Štetiar2020-10-271-2/+2
| | | | | | | | | | | | | | | | 52bbc99f69ea Replace malloc() + memset() with calloc() 3fbd6c923434 ucimap: Check return of malloc() eae126f66663 file: Check buffer size after strtok() 7f574273180a file: use size_t for position and pointer 19770b6949b9 file: use dynamic memory allocation for tempfile name aa46546794ac file: uci_file_commit: fix memory leak 671c7554bfde uci: silence UBSAN error by using offsetof macro from compiler ea5bbd57d0e1 tests: cram: add uci import testing on fuzzer corpus 31f78bfbf75f cmake: add uci-san cli built with clang sanitizers a3e650911f5e file: uci_parse_package: fix heap use after free 9bd361ca3236 tests: add libFuzzer based fuzzing Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ubus: bump to git HEADDaniel Golle2020-10-251-3/+3
| | | | | | ad0cd11 ubusd_acl: add support for wildcard in methods Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: ujail fixesDaniel Golle2020-10-251-3/+3
| | | | | | | ec461ff jail: mount more stuff read-only 33b799b ujail: elf: work around GCC bug on MIPS64 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ubox: run logd non-root as user logdDaniel Golle2020-10-251-4/+5
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* rpcd: adapt defaults for changed ubus.sock pathDaniel Golle2020-10-223-2/+10
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: jail: clean up capability handling and non-root ubusdDaniel Golle2020-10-211-3/+3
| | | | | | | | | | | | | | | Unify capability handling to only use OCI spec parsers even for ujail slim containers which previously supposedly used their own format. 80c9516 cgroups: restrict allowed keys in 'unified' section 5ade567 cgroups: memory controller fixes 3121467 early: run ubusd non-root as user ubus, group ubus 12a5b97 jail: adapt to new ubus socket path 788d144 instance: actually wire up capabilities filename ebc5a7f jail: nuke old capabilities code in favour of reusing OCI code 6c5233a jail: capabilities: apply in two phases Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* ubus: prepare to run ubusd as non-root userDaniel Golle2020-10-211-3/+4
| | | | | | | Move /var/run/ubus.sock to /var/run/ubus/ubus.sock in preparation for having ubusd run as non-root user. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* selinux-policy: update to git tag v0.3Daniel Golle2020-10-161-3/+3
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* fstools: update to git HEADDaniel Golle2020-10-161-3/+3
| | | | | | | | | | | 8e0f29a mount: remove support for legacy overlayfs before v2.3 0f8a443 mount: fix log format string and indentation 46a56d3 overlay: use precompiler macros for reoccuring path names f25ab8a mount: apply SELinux labels before overlayfs mount Total ipk size change (ipq40xx): +120b Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* selinux-policy: adds new packageDominick Grift2020-10-092-0/+55
| | | | Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
* refpolicy: fix path to setfiles and checkpolicyPaul Spooren2020-09-301-3/+2
| | | | | | | | Directly set path via MAKE vars instead of defning TESTTOOLS. This way setfiles, which is required by the ImageBuilder, ends up in /host/bin while checkpolicy can stay in hostpkg/bin. Signed-off-by: Paul Spooren <mail@aparcar.org>
* refpolicy: mark as architecture independentDaniel Golle2020-09-291-1/+2
| | | | | | | Use PKGARCH:=all to declare this package to be free of any architecture dependent code. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* zram-swap: explicitly use mkswap/swapon/swapoff from /sbinRui Salvaterra2020-09-202-11/+11
| | | | | | | | | | | | | The required BusyBox applets are enabled by default, so we can rely on them being present in the system. This way, we make sure there are no conflicts with less featured variants of these same applets which might also be present in the system. Fixes: 0bd7dfa3ed60 ("zram-swap: enable swap discard") Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com> [wrap commit description] Signed-off-by: David Bauer <mail@david-bauer.net>
* rpcd: update to the latest masterRafał Miłecki2020-09-181-3/+3
| | | | | | 3fea655 rc: support init.d scripts with START=0 Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* zram-swap: default to lzo instead of lzo-rle compressionRui Salvaterra2020-09-171-2/+3
| | | | | | | | | | | | | | | | | | | On devices with small amounts of RAM, zram-swap fails to initialise due to the default compression algorithm (lzo-rle). Startup example on an AirGrid M2, with 32 MiB of RAM: root@airgrid:/etc/config# /etc/init.d/zram start zram_start: activating '/dev/zram0' for swapping (13 MegaBytes) zram_reset: enforcing defaults via /sys/block/zram0/reset sh: write error: Out of memory mkswap: image is too small swapon: /dev/zram0: Invalid argument root@airgrid:/etc/config# Fix this by defaulting to traditional lzo, which works fine and is always available. Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
* rpcd: update to the latest masterRafał Miłecki2020-09-101-3/+3
| | | | | | rc: new ubus object for handling /etc/init.d/ scripts Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* refpolicy: skip building docsDaniel Golle2020-09-012-1/+13
| | | | | | | Building docs requires xmllint and other bulky things being present on the host. Skip that. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* fstools: update to the latest versionHauke Mehrtens2020-09-011-3/+3
| | | | | | 5345343 fstoools: add define for GLOB_ONLYDIR Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* build: opkg-key variable key folderPaul Spooren2020-08-311-4/+6
| | | | | | | | | | | | | | The key folder is used by `opkg` and `usign` to store and retrieve trusted public keys. Using `opkg-key` outside a running device is unfeasible as the key folder is hard coded to `/etc/opkg/keys`. This commit adds a variable OPKG_KEYS which defaults to `/etc/opkg/keys` if unset, however allows set arbitrary key folder locations. Arbitrary key folder locations are useful to add signature verification to the ImageBuilders. Signed-off-by: Paul Spooren <mail@aparcar.org>
* opkg: update to git HEADDaniel Golle2020-08-311-3/+3
| | | | | | | 4318ab1 opkg: allow to configure the path to the signature verification script cf44c2f libopkg: fix compiler warning Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* refpolicy: new packageThomas Petazzoni2020-08-312-0/+87
| | | | | | Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [update to 2.20200229, adjust Makefile, and move to openwrt.git] Signed-off-by: W. Michael Petullo <mike@flyn.org>
* ar71xx: drop targetAdrian Schmutzler2020-08-303-4/+1
| | | | | | | | | | This target has been mostly replaced by ath79 and won't be included in the upcoming release anymore. Finally put it to rest. This also removes all references in packages, tools, etc. as well as the uboot-ar71xx and vsc73x5-ucode packages. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* procd: remove duplicate confguration menuDaniel Golle2020-08-131-2/+0
| | | | | Fixes: 962e73c1a4 ("procd: add selinux variant") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: add selinux variantPaul Spooren2020-08-131-7/+31
| | | | | | | | This commit adds a `selinux` variant to `procd` allowing to load an SELinux policy at boot. Signed-off-by: Paul Spooren <mail@aparcar.org> Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* treewide: bump PKG_RELEASE after replacing `which`Adrian Schmutzler2020-08-121-1/+1
| | | | | | | | | Bump PKG_RELEASE for the affected packages as replacing "which" by "command -v" represents a content change. Fixes: 1fdf6b745cc3 ("treewide: replace `which` with `command -v`") Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* treewide: replace `which` with `command -v`Paul Spooren2020-08-121-3/+3
| | | | | | | | | | | | | | | | | Fix shellcheck SC2230 > which is non-standard. Use builtin 'command -v' instead. Using `command -v` is POSIX compliant while `which` is not. Also to mention, `command -v` is a shell builtin whereas `which` is a separate busybox applet. Once applied to everything concerning OpenWrt we can disable the busybox feature `which` and save 3.8kB. Acked-by: Stijn Tintel <stijn@linux-ipv6.be> Signed-off-by: Paul Spooren <mail@aparcar.org> [also replace cases in zram-swap] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* procd: add SELinux supportThomas Petazzoni2020-08-101-5/+6
| | | | | | | | | | | | | | | | | | This commit adds a patch to procd to support loading the SELinux policy early at boot time, and adjusts the procd package to use this SELinux support when libselinux is enabled. The procd patch has been submitted separately [1]: obviously the intent is to have it merged in the procd Git repository rather than have it in OpenWrt itself. [1] http://lists.infradead.org/pipermail/openwrt-devel/2019-November/025791.html Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [rebase, add commit message] Signed-off-by: W. Michael Petullo <mike@flyn.org> [split commit into openwrt.git and procd.git] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-08-061-3/+3
| | | | | | | | | | | | | 47a9f0d service: add method to query available container features afbaba9 initd: attempt to mount cgroup2 ead60fe jail: use pidns semantics also for timens 759e9f8 jail: make use of BLOBMSG_CAST_INT64 for OCI rlimits 83053b6 instance: add instances into unified cgroup hierarchy 16159bb jail: parse OCI cgroups resources 282ff0c jail: only free cgroups if they were allocated ab55357 jail: fix freeing cgroups avl Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* Revert "procd: update to git HEAD"Daniel Golle2020-08-061-3/+3
| | | | | | This reverts commit e0e607f0d000e62c6af8d822d7c3f57c2a582136. Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-08-061-3/+3
| | | | | | | | | | | 47a9f0d service: add method to query available container features afbaba9 initd: attempt to mount cgroup2 ead60fe jail: use pidns semantics also for timens 759e9f8 jail: make use of BLOBMSG_CAST_INT64 for OCI rlimits 83053b6 instance: add instances into unified cgroup hierarchy 16159bb jail: parse OCI cgroups resources Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-07-301-3/+3
| | | | | | | 28be011 instance: make sure values are not inherited from previous runs 2ae5cbc uxc: remove debugging left-over Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-07-291-3/+3
| | | | | | | | | | | c3ca99f jail: serialize hook execution 8ff8970 jail: add some remaining OCI features 9d5fa0a uxc: behave more like a compliant OCI run-time 1274033 uxc: fix create operation 2d811a4 jail: add 'kill' method to container.%s object 08133b8 uxc: use new container.%s kill ubus API Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: jail: fix build on glibc and uclibcDaniel Golle2020-07-251-3/+3
| | | | Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-07-251-3/+3
| | | | | | | | 48777de rcS: cast format string to int64_t a4df90f jail: fix wrong format for 32-bit c482c5d jail: add support for referencing existing namespaces Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: bump to git HEAD once againDaniel Golle2020-07-201-3/+3
| | | | | | | | | | | Further complete OCI container support in ujail: f5f305e jail: move /tmp/resolv.conf.d to /dev/resolv.conf.d 6f078ae jail: add support for defining devices 686cf7a jail: actually apply filesystem-specific mount options f91009a jail: refactor default mounts into new structure 66ae2d9 jail: re-implement /proc/sys/net read-write in netns hack Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* procd: update to git HEADDaniel Golle2020-07-191-3/+3
| | | | | | | | | | | 9eddf0f jail: fix hooks 1b1286b jail: parse and apply OCI sysctl values c049047 jail: implement OCI user additionalGIDs 0e1920c jail: read and apply umask from OCI if defined 1c46cc3 jail: parse and apply POSIX rlimits 76adac5 jail: /proc/$pid/oom_score_adj to OCI defined oomScoreAdj Signed-off-by: Daniel Golle <daniel@makrotopia.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 00:38:16 +0000