Skip to contentSkip to conversation

busybox miscellaneous fixes

PATCH In review [email protected] 4 participants 18 messages Jun 17, 2013 – Jun 18, 2013

lore
Share & tools
lore
#0 lore raw

v2 cover busybox miscellaneous fixes

From: Chen Qi <[email protected]>

This patchset mainly serves two purposes.
1) Switch to using busybox as the default login manager.
2) Fix to support FEATURE_INDIVIDUAL in busybox.

I'd really appreciate it if you could review it. And any comment or suggest is really welcome.

In this cover letter, I'll describe why we switch to using busybox instead of tiny login, how we do it and the final result of this change.

The reason is well explaned by Saul's comment in bug#4207.
(https://bugzilla.yoctoproject.org/show_bug.cgi?id=4207)
So I quote it here.
'''
tinylogin has been deprecated and the functionality ported into busybox, the size is smaller than tinybox. The issue to be concerned about is having busybox being setuid, a possibility is to use busybox as a separate binary. '''

That's exactly what this patchset does.
*) switch to using busybox as the default login manager
*) remove tinylogin as it's deprecated
*) add the ability to split the busybox binary into two parts, one with suid and the other not.

Following's a brief design. You could also see it on the bugzilla.
(https://bugzilla.yoctoproject.org/show_bug.cgi?id=4207)
Design:
1) Add a configuration fragment to the SRC_URI. The configuration fragment will be called login-utilities.cfg, as its main purpose is to enable the login utility of busybox.

2) set the default login manager to 'busybox' instead of 'tinylogin'

3) Add a variable, BUSYBOX_SPLIT_SUID, to control whether to split the busybox binary into two parts, one with suid and the other not. We default it to "1" to enable the splitting, but users could still override it to disable the splitting. After all, busybox has no internal support for this suid apps splitting, so there might be users out there who trust busybox and want just one busybox binary.

4) Patch busybox to make it able to list configuration items of suid apps and non-suid apps. These two lists are used to separate the busybox binary.

5) Busybox supports building individual apps, so the change above should still support this feature.

Here's the final result of this change:
1) FEATURE_INDIVIDUAL enabled
We'll have links on target like below.
/bin/ls -> /bin/ls.busybox
/bin/cat -> /bin/cat.busybox
/bin/su -> /bin/su.busybox
2) FEATURE_INDIVIDUAL disabled (this is the default behavior) and BUSYBOX_SPLIT_SUID enabled /bin/ls -> /bin/busybox.nosuid
/bin/cat -> /bin/busybox.nosuid
/bin/su -> /bin/busybox.suid
3) FEATURE_INDIVIDUAL disabled and BUSYBOX_SPLIT_SUID disabled
/bin/ls -> /bin/busybox
/bin/cat -> /bin/busybox
/bin/su -> /bin/busybox

//Chen Qi

The following changes since commit a62aed41f2d8f874f7ae24d0e5be5dbc66ea2199:

lrzsz: check locale.h in configure (2013-06-04 15:55:46 +0100)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib ChenQi/busybox-fixes
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=ChenQi/busybox-fixes

Chen Qi (9):
busybox: remove the postinst part of the recipe
busybox: add support for CONFIG_FEATURE_INDIVIDUAL
busybox: add a config fragment to enable login utilities
busybox: enable to list suid and non-suid app configs
busybox: add the ability to split the busybox binary
packagegroup-core-boot: use busybox as the default login manager
packagegroup-core-basic: set the default login manager
mingetty: lower the ALTERNATIVE_PRIORITY
tinylogin: remove recipe

 ...usybox-list-suid-and-non-suid-app-configs.patch |  179 +++++
 .../busybox/busybox-1.20.2/login-utilities.cfg     |   13 +
 meta/recipes-core/busybox/busybox.inc              |  105 ++-
 meta/recipes-core/busybox/busybox_1.20.2.bb        |    4 +-
 .../packagegroups/packagegroup-core-boot.bb        |    2 +-
 .../tinylogin/tinylogin-1.4/add-system.patch       |  117 ---
 .../tinylogin-1.4/adduser-empty_pwd.patch          |   45 --
 .../tinylogin/tinylogin-1.4/avoid_static.patch     |   33 -
 .../tinylogin/tinylogin-1.4/cvs-20040608.patch     |  823 --------------------
 .../tinylogin/tinylogin-1.4/glibc_crypt_fix.patch  |   23 -
 .../tinylogin-1.4/passwd_rotate_check.patch        |   41 -
 .../tinylogin/tinylogin-1.4/remove-index.patch     |   13 -
 .../tinylogin/tinylogin-1.4/use_O2_option.patch    |   21 -
 meta/recipes-core/tinylogin/tinylogin_1.4.bb       |   45 --
 meta/recipes-extended/mingetty/mingetty_1.08.bb    |    2 +-
 .../packagegroups/packagegroup-core-basic.bb       |    3 +-
 16 files changed, 268 insertions(+), 1201 deletions(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/busybox-list-suid-and-non-suid-app-configs.patch
 create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/login-utilities.cfg
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/add-system.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/adduser-empty_pwd.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/avoid_static.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/cvs-20040608.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/glibc_crypt_fix.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/passwd_rotate_check.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/remove-index.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/use_O2_option.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin_1.4.bb
Signature · 1 line
1.7.9.5
#1 lore raw

PATCH v2 1/9 busybox: remove the postinst part of the recipe

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

---
 meta/recipes-core/busybox/busybox.inc |    8 --------
 1 file changed, 8 deletions(-)
meta/recipes-core/busybox/busybox.inc +0 -8
index c8908b0..f4efeb8 100644
@@ -265,14 +265,6 @@ python do_package_prepend () {
     f.close()
 }
 
-pkg_postinst_${PN} () {
-	# If we are not making an image we create links for the utilities that doesn't exist
-	# so the update-alternatives script will get the utilities it needs
-	# (update-alternatives have no problem replacing links later anyway)
-	test -n 2> /dev/null || alias test='busybox test'
-	if test "x$D" = "x"; then while read link; do if test ! -h "$link"; then case "$link" in /*/*/*) to="../../bin/busybox";; /bin/*) to="busybox";; /*/*) to="../bin/busybox";; esac; busybox ln -s $to $link; fi; done </etc/busybox.links; fi
-}
-
 pkg_prerm_${PN} () {
 	# This is so you can make busybox commit suicide - removing busybox with no other packages
 	# providing its files, this will make update-alternatives work, but the update-rc.d part
Signature · 1 line
1.7.9.5
#2 lore raw

Re: [PATCH V2 1/9] busybox: remove the postinst part of the recipe

Quoted 7 lines · On Mon, Jun 17, 2013 at 2:49 AM, <[email protected]> wrote:

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Most of patch 1 and 2 should be merged; here you should drop the postinst and convert these to the update-alternative way so we don't have the tree broken after this patch and allow for bisect to be used.

--
Otavio Salvador O.S. Systems
http://www.ossystems.com.br http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854 Mobile: +1 (347) 903-9750

author
#3 lore raw

Re: [PATCH V2 1/9] busybox: remove the postinst part of the recipe

Quoted 7 lines · Otavio Salvador
Quoted 6 lines · On Mon, Jun 17, 2013 at 2:49 AM, <[email protected]> wrote:

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Quoted 5 lines
Quoted 1 line

Most of patch 1 and 2 should be merged; here you should drop the postinst and convert these to the update-alternative way so we don't have the tree broken after this patch and allow for bisect to be used.

Hi Otavio,

Maybe there's some misunderstanding here.
To be clear, patch 1 and patch 2 do two different things.
Patch 1 removes postinst, it has nothing to do with patch 2, which fix busybox.inc to support the FEATURE_INDIVIDUAL. And after this patch (patch 1), the tree is not broken. The busybox still works as it has been working so far.

[
And I just did a simple test to confirm this. On the lastest master, I removed the postinst part of busybox.inc, and built a core-image-minimal, it worked out well. Here's some output.

root@qemuarm:~# ls -l /bin/ | grep busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 ash -> /bin/busybox
-rwsr-xr-x    1 root     root        556824 Jun 18 01:27 busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 cat -> /bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chattr -> /bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chgrp -> /bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chmod -> /bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chown -> /bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 cp -> /bin/busybox
....
]

Best Regards,
Chen Qi

Quoted 6 lines

--
Otavio Salvador O.S. Systems
http://www.ossystems.com.br http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854 Mobile: +1 (347) 903-9750

#4 lore raw

Re: [PATCH V2 1/9] busybox: remove the postinst part of the recipe

Quoted 30 lines · ChenQi
Quoted 9 lines · Otavio Salvador
Quoted 7 lines · On Mon, Jun 17, 2013 at 2:49 AM, <[email protected]> wrote:

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Quoted 6 lines
Quoted 1 line

Most of patch 1 and 2 should be merged; here you should drop the postinst and convert these to the update-alternative way so we don't have the tree broken after this patch and allow for bisect to be used.

Hi Otavio,

Maybe there's some misunderstanding here.
To be clear, patch 1 and patch 2 do two different things. Patch 1 removes postinst, it has nothing to do with patch 2, which fix busybox.inc to support the FEATURE_INDIVIDUAL.
And after this patch (patch 1), the tree is not broken. The busybox still works as it has been working so far.

[
And I just did a simple test to confirm this. On the lastest master, I removed the postinst part of busybox.inc, and built a core-image-minimal, it worked out well. Here's some output.

Quoted 15 lines
root@qemuarm:~# ls -l /bin/ | grep busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 ash -> /bin/busybox
-rwsr-xr-x    1 root     root        556824 Jun 18 01:27 busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 cat -> /bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chattr ->
/bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chgrp ->
/bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chmod ->
/bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 chown ->
/bin/busybox
lrwxrwxrwx    1 root     root            12 Jun 18 01:31 cp -> /bin/busybox
....
]

Oh I see.

So I have no objection for the patch :-)

Thanks by letting me know.

--
Otavio Salvador O.S. Systems
http://www.ossystems.com.br http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854 Mobile: +1 (347) 903-9750

#5 lore raw

PATCH v2 2/9 busybox: add support for CONFIG_FEATURE_INDIVIDUAL

In reply to [email protected]

From: Chen Qi <[email protected]>

Previously, if CONFIG_FEATURE_INDIVIDUAL was enabled for busybox, yocto-based systems could start correctly.

This is because if busybox is built as individual apps, '/bin/busybox' may not be present, so setting the default ALTERNATIVE_TARGET to '/bin/busybox' is not appropriate and could lead to errors.

This patch fixes this problem by checking the existence of '/bin/busybox' before setting the ALTERNATIVE_TARGET to '/bin/busybox'.

After this change, if busybox is built as individual apps, we'll have links like '/bin/ls -> /bin/ls.busybox', otherwise, we'll have links like '/bin/ls -> /bin/busybox'.

Note there's a grep expression change in this patch. The old expression doesn't work well, it has an unwanted underscore, so I changed it to make it work.

[YOCTO #4570]

---
 meta/recipes-core/busybox/busybox.inc |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
meta/recipes-core/busybox/busybox.inc +4 -3
index f4efeb8..99d4e99 100644
@@ -171,7 +171,7 @@ do_install () {
 			install -m 0755 "0_lib/$NAME" "${D}$FILE.${BPN}"
 		done
 		# add suid bit where needed
-		for i in `grep -E "APPLET.*_BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP | cut -f 3 -d '(' | cut -f 1 -d ','`; do
+		for i in `grep -E "APPLET.*BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP | cut -f 3 -d '(' | cut -f 1 -d ','`; do
 			find ${D} -name $i.${BPN} -exec chmod a+s {} \;
 		done
 		install -m 0755 0_lib/libbusybox.so.${PV} ${D}${libdir}/libbusybox.so.${PV}
@@ -242,8 +242,6 @@ ALTERNATIVE_TARGET[syslog-init] = "${sysconfdir}/init.d/syslog.${BPN}"
 ALTERNATIVE_LINK_NAME[syslog-startup-conf] = "${sysconfdir}/syslog-startup.conf"
 ALTERNATIVE_TARGET[syslog-startup-conf] = "${sysconfdir}/syslog-startup.conf.${BPN}"
 
-ALTERNATIVE_TARGET = "/bin/busybox"
-
 python do_package_prepend () {
     # We need to load the full set of busybox provides from the /etc/busybox.links
     # Use this to see the update-alternatives with the right information
@@ -252,6 +250,9 @@ python do_package_prepend () {
     pn = d.getVar('PN', True)
     f = open('%s/etc/busybox.links' % (dvar), 'r')
 
+    if os.path.exists('%s/bin/busybox' % (dvar)):
+        d.setVar('ALTERNATIVE_TARGET', "/bin/busybox")
+
     for alt_link_name in f:
         alt_link_name = alt_link_name.strip()
         alt_name = os.path.basename(alt_link_name)
Signature · 1 line
1.7.9.5
#6 lore raw

PATCH v2 3/9 busybox: add a config fragment to enable login utilities

In reply to [email protected]

From: Chen Qi <[email protected]>

Create a config fragment to enable the login/passwd utilities of busybox.

[YOCTO #4207]

---
 .../busybox/busybox-1.20.2/login-utilities.cfg     |   13 +++++++++++++
 meta/recipes-core/busybox/busybox_1.20.2.bb        |    3 ++-
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/login-utilities.cfg
meta/recipes-core/busybox/busybox-1.20.2/login-utilities.cfg new file +13 -0
new file mode 100644
index 0000000..cc9b2db
@@ -0,0 +1,13 @@
+CONFIG_FEATURE_SHADOWPASSWDS=y
+CONFIG_ADDUSER=y
+CONFIG_FEATURE_ADDUSER_LONG_OPTIONS=y
+CONFIG_ADDGROUP=y
+CONFIG_FEATURE_ADDGROUP_LONG_OPTIONS=y
+CONFIG_DELUSER=y
+CONFIG_DELGROUP=y
+CONFIG_GETTY=y
+CONFIG_LOGIN=y
+CONFIG_PASSWD=y
+CONFIG_SU=y
+CONFIG_SULOGIN=y
+CONFIG_VLOCK=y
meta/recipes-core/busybox/busybox_1.20.2.bb +2 -1
index 07d722d..3ff8a88 100644
@@ -35,7 +35,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://fail_on_no_media.patch \
            file://busybox-sulogin-empty-root-password.patch \
            file://inetd.conf \
-           file://inetd"
+           file://inetd \
+           file://login-utilities.cfg"
 
 SRC_URI[tarball.md5sum] = "e025414bc6cd79579cc7a32a45d3ae1c"
 SRC_URI[tarball.sha256sum] = "eb13ff01dae5618ead2ef6f92ba879e9e0390f9583bd545d8789d27cf39b6882"
Signature · 1 line
1.7.9.5
#7 lore raw

PATCH v2 4/9 busybox: enable to list suid and non-suid app configs

In reply to [email protected]

From: Chen Qi <[email protected]>

This patch, written by Bernhard Reutner-Fischer <[email protected]>, adds the ability to busybox to list configuration items of suid apps and non-suid apps separately.

`make busybox.cfg.suid' generates a file containing config items of the suid apps.

'make busybox.cfg.nosuid' generates a file containing config items of the non-suid apps.

This patch helps to separate busybox into two binaries, the suid one and the non-suid one.

[YOCTO #4207]

---
 ...usybox-list-suid-and-non-suid-app-configs.patch |  179 ++++++++++++++++++++
 meta/recipes-core/busybox/busybox_1.20.2.bb        |    3 +-
 2 files changed, 181 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/busybox-list-suid-and-non-suid-app-configs.patch
meta/recipes-core/busybox/busybox-1.20.2/busybox-list-suid-and-non-suid-app-configs.patch new file +179 -0
new file mode 100644
index 0000000..753a044
@@ -0,0 +1,179 @@
+Make busybox have the ability to list configuration items regarding suid
+apps and non-suid apps separately.
+
+From: Bernhard Reutner-Fischer <[email protected]>
+Date: Mon, 17 Jun 2013 11:06:05 +0800
+Subject: [PATCH V2] busybox: list suid and non-suid app configs
+
+Upstream-Status: Pending
+
+Signed-off-by: Chen Qi <[email protected]>
+
+---
+ Makefile.custom            |    4 ++++
+ applets/busybox.mksuid     |   53 ++++++++++++++++++++++++++++++++++++++++++++
+ include/applets.src.h      |    9 +++++++-
+ scripts/kconfig/confdata.c |   24 ++++++++++++++++----
+ 4 files changed, 85 insertions(+), 5 deletions(-)
+ create mode 100644 applets/busybox.mksuid
+
+diff --git a/Makefile.custom b/Makefile.custom
+index 6da79e6..a276d6f 100644
+--- a/Makefile.custom
++++ b/Makefile.custom
+@@ -4,6 +4,10 @@
+ 
+ busybox.links: $(srctree)/applets/busybox.mkll $(objtree)/include/autoconf.h include/applets.h
+ 	$(Q)-$(SHELL) $^ >$@
++busybox.cfg.suid: $(srctree)/applets/busybox.mksuid $(objtree)/include/autoconf.h include/applets.h
++	$(Q)-SUID="yes" $(SHELL) $^ > $@
++busybox.cfg.nosuid: $(srctree)/applets/busybox.mksuid $(objtree)/include/autoconf.h include/applets.h
++	$(Q)-SUID="DROP" $(SHELL) $^ > $@
+ 
+ .PHONY: install
+ ifeq ($(CONFIG_INSTALL_APPLET_SYMLINKS),y)
+diff --git a/applets/busybox.mksuid b/applets/busybox.mksuid
+new file mode 100644
+index 0000000..e11a7a1
+--- /dev/null
++++ b/applets/busybox.mksuid
+@@ -0,0 +1,53 @@
++#!/bin/sh
++# Make list of configuration variables regarding suid handling
++
++# input $1: full path to autoconf.h
++# input $2: full path to applets.h
++# input $3: full path to .config
++# output (stdout): list of CONFIG_ that do or may require suid
++
++# If the environment variable SUID is not set or set to DROP,
++# lists all config options that do not require suid permissions.
++# Otherwise, lists all config options for applets that DO or MAY require
++# suid permissions.
++
++# Maintainer: Bernhard Reutner-Fischer
++
++export LC_ALL=POSIX
++export LC_CTYPE=POSIX
++
++CONFIG_H=${1:-include/autoconf.h}
++APPLETS_H=${2:-include/applets.h}
++DOT_CONFIG=${3:-.config}
++
++case ${SUID:-DROP} in
++    [dD][rR][oO][pP]) USE="DROP" ;;
++    *) USE="suid" ;;
++esac
++
++$HOSTCC -E -DMAKE_SUID -include $CONFIG_H $APPLETS_H |
++  awk -v USE=${USE} '
++    /^SUID[ \t]/{
++      if (USE == "DROP") {
++        if ($2 != "BB_SUID_DROP") next
++      } else {
++        if ($2 == "BB_SUID_DROP") next
++      }
++      cfg = $NF
++      gsub("\"", "", cfg)
++      cfg = substr(cfg, 8)
++      s[i++] = "CONFIG_" cfg
++      s[i++] = "CONFIG_FEATURE_" cfg "_.*"
++    }
++    END{
++      while (getline < ARGV[2]) {
++        for (j in s) {
++          if ($0 ~ "^" s[j] "=y$") {
++            sub(/=.*/, "")
++            print
++            if (s[j] !~ /\*$/) delete s[j] # can drop this applet now
++          }
++        }
++      }
++    }
++' - $DOT_CONFIG
+diff --git a/include/applets.src.h b/include/applets.src.h
+index 02b995b..8386c84 100644
+--- a/include/applets.src.h
++++ b/include/applets.src.h
+@@ -52,6 +52,12 @@ s     - suid type:
+ # define APPLET_NOEXEC(name,main,l,s,name2)  LINK l name
+ # define APPLET_NOFORK(name,main,l,s,name2)  LINK l name
+ 
++#elif defined(MAKE_SUID)
++# define APPLET(name,l,s)                    SUID s l name
++# define APPLET_ODDNAME(name,main,l,s,name2) SUID s l name
++# define APPLET_NOEXEC(name,main,l,s,name2)  SUID s l name
++# define APPLET_NOFORK(name,main,l,s,name2)  SUID s l name
++
+ #else
+   static struct bb_applet applets[] = { /*    name, main, location, need_suid */
+ # define APPLET(name,l,s)                    { #name, #name, l, s },
+@@ -414,7 +420,8 @@ IF_YES(APPLET_NOFORK(yes, yes, BB_DIR_USR_BIN, BB_SUID_DROP, yes))
+ IF_GUNZIP(APPLET_ODDNAME(zcat, gunzip, BB_DIR_BIN, BB_SUID_DROP, zcat))
+ IF_ZCIP(APPLET(zcip, BB_DIR_SBIN, BB_SUID_DROP))
+ 
+-#if !defined(PROTOTYPES) && !defined(NAME_MAIN_CNAME) && !defined(MAKE_USAGE)
++#if !defined(PROTOTYPES) && !defined(NAME_MAIN_CNAME) && !defined(MAKE_USAGE) \
++    && !defined(MAKE_LINKS) && !defined(MAKE_SUID)
+ };
+ #endif
+ 
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index bd2d70e..303df0b 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -474,7 +474,11 @@ int conf_write(const char *name)
+ 						fprintf(out_h, "#define CONFIG_%s 1\n", sym->name);
+ 						/* bbox */
+ 						fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
+-						fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
++						fprintf(out_h, "#ifdef MAKE_SUID\n");
++						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
++						fprintf(out_h, "#else\n");
++						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
++						fprintf(out_h, "#endif\n");
+ 						fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
+ 					}
+ 					break;
+@@ -506,7 +510,11 @@ int conf_write(const char *name)
+ 					fputs("\"\n", out_h);
+ 					/* bbox */
+ 					fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
+-					fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
++					fprintf(out_h, "#ifdef MAKE_SUID\n");
++					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
++					fprintf(out_h, "#else\n");
++					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
++					fprintf(out_h, "#endif\n");
+ 					fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
+ 				}
+ 				break;
+@@ -518,7 +526,11 @@ int conf_write(const char *name)
+ 						fprintf(out_h, "#define CONFIG_%s 0x%s\n", sym->name, str);
+ 						/* bbox */
+ 						fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
+-						fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
++						fprintf(out_h, "#ifdef MAKE_SUID\n");
++						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
++						fprintf(out_h, "#else\n");
++						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
++						fprintf(out_h, "#endif\n");
+ 						fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
+ 					}
+ 					break;
+@@ -532,7 +544,11 @@ int conf_write(const char *name)
+ 					fprintf(out_h, "#define CONFIG_%s %s\n", sym->name, str);
+ 					/* bbox */
+ 					fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
+-					fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
++					fprintf(out_h, "#ifdef MAKE_SUID\n");
++					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
++					fprintf(out_h, "#else\n");
++					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
++					fprintf(out_h, "#endif\n");
+ 					fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
+ 				}
+ 				break;
+-- 
+1.7.9.5
+
meta/recipes-core/busybox/busybox_1.20.2.bb +2 -1
index 3ff8a88..a2e762d 100644
@@ -36,7 +36,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://busybox-sulogin-empty-root-password.patch \
            file://inetd.conf \
            file://inetd \
-           file://login-utilities.cfg"
+           file://login-utilities.cfg \
+           file://busybox-list-suid-and-non-suid-app-configs.patch"
 
 SRC_URI[tarball.md5sum] = "e025414bc6cd79579cc7a32a45d3ae1c"
 SRC_URI[tarball.sha256sum] = "eb13ff01dae5618ead2ef6f92ba879e9e0390f9583bd545d8789d27cf39b6882"
Signature · 1 line
1.7.9.5
#8 lore raw

PATCH v2 5/9 busybox: add the ability to split the busybox binary

In reply to [email protected]

From: Chen Qi <[email protected]>

This patch enables us to split the busybox into two binaries, one containing suid applications, and the other containing nosuid apps.

Add a variable, BUSYBOX_SPLIT_SUID, to control whether to split the busybox binary into two parts. We default it to "1" to enable the splitting, but users could still override it to disable the splitting. After all, busybox has no internal support for this suid apps splitting, so there might be users out there who want just one busybox binary.

The basic idea here is to build the busybox twice, each with the correct configuration items. We extract the non-app part of the original .config file, and merge this part with the suid-app part to form a .config which contains only suid apps. The same strategy applies to the non-suid apps.

[YOCTO #4207]

---
 meta/recipes-core/busybox/busybox.inc |   96 +++++++++++++++++++++++----------
 1 file changed, 68 insertions(+), 28 deletions(-)
meta/recipes-core/busybox/busybox.inc +68 -28
index 99d4e99..65e1642 100644
@@ -12,6 +12,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=de10de48642ab74318e893a61105afbb"
 
 SECTION = "base"
 
+# Whether to split the suid apps into a seperate binary
+BUSYBOX_SPLIT_SUID ?= "1"
+
 export EXTRA_CFLAGS = "${CFLAGS}"
 export EXTRA_LDFLAGS = "${LDFLAGS}"
 
@@ -136,19 +139,43 @@ do_configure () {
 
 do_compile() {
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-	oe_runmake busybox_unstripped
-	cp busybox_unstripped busybox
+	if [ "${BUSYBOX_SPLIT_SUID}" = "1" -a x`grep "CONFIG_FEATURE_INDIVIDUAL=y" .config` = x ]; then
+	# split the .config into two parts, and make two busybox binaries
+		cp .config .config.orig
+		oe_runmake busybox.cfg.suid
+		oe_runmake busybox.cfg.nosuid
+		for i in `cat busybox.cfg.suid busybox.cfg.nosuid`; do
+			echo "# $i is not set" >> .config.disable.apps
+		done
+		merge_config.sh -m .config.orig .config.disable.apps
+		cp .config .config.nonapps
+		for s in suid nosuid; do
+			cat busybox.cfg.$s | while read item; do
+				grep -w "$item" .config.orig
+			done > .config.app.$s
+			merge_config.sh -m .config.nonapps .config.app.$s
+			oe_runmake busybox_unstripped
+			mv busybox_unstripped busybox.$s
+			oe_runmake busybox.links
+			mv busybox.links busybox.links.$s
+		done
+		# copy .config.orig back to .config, because the install process may check this file
+		cp .config.orig .config
+		# cleanup
+		rm .config.orig .config.app.suid .config.app.nosuid .config.disable.apps .config.nonapps
+	else
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox
+		oe_runmake busybox.links
+	fi
 }
 
 do_install () {
-	oe_runmake busybox.links
 	if [ "${prefix}" != "/usr" ]; then
-		sed "s:^/usr/:${prefix}/:" busybox.links > busybox.links.new
-		mv busybox.links.new busybox.links
+		sed -i "s:^/usr/:${prefix}/:" busybox.links*
 	fi
 	if [ "${base_sbindir}" != "/sbin" ]; then
-		sed "s:^/sbin/:${base_sbindir}/:" busybox.links > busybox.links.new
-		mv busybox.links.new busybox.links
+		sed -i "s:^/sbin/:${base_sbindir}/:" busybox.links*
 	fi
 
 	install -d ${D}${sysconfdir}/init.d
@@ -157,12 +184,21 @@ do_install () {
 		# Install /bin/busybox, and the /bin/sh link so the postinst script
 		# can run. Let update-alternatives handle the rest.
 		install -d ${D}${base_bindir}
-		if grep -q "CONFIG_FEATURE_SUID=y" ${B}/.config; then
-			install -m 4755 ${B}/busybox ${D}${base_bindir}
+		if [ "${BUSYBOX_SPLIT_SUID}" = "1" ]; then
+			install -m 4755 ${B}/busybox.suid ${D}${base_bindir}
+			install -m 0755 ${B}/busybox.nosuid ${D}${base_bindir}
+			install -m 0644 ${S}/busybox.links.suid ${D}${sysconfdir}
+			install -m 0644 ${S}/busybox.links.nosuid ${D}${sysconfdir}
+			ln -sf busybox.nosuid ${D}${base_bindir}/sh
 		else
-			install -m 0755 ${B}/busybox ${D}${base_bindir}
+			if grep -q "CONFIG_FEATURE_SUID=y" ${B}/.config; then
+				install -m 4755 ${B}/busybox ${D}${base_bindir}
+			else
+				install -m 0755 ${B}/busybox ${D}${base_bindir}
+			fi
+			install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
+			ln -sf busybox ${D}${base_bindir}/sh
 		fi
-		ln -sf busybox ${D}${base_bindir}/sh
 	else
 		install -d ${D}${base_bindir} ${D}${base_sbindir}
 		install -d ${D}${libdir} ${D}${bindir} ${D}${sbindir}
@@ -181,6 +217,7 @@ do_install () {
 		if [ -f ${D}/linuxrc.${BPN} ]; then
 			mv ${D}/linuxrc.${BPN} ${D}/linuxrc
 		fi
+		install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
 	fi
 
 	if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then
@@ -217,7 +254,6 @@ do_install () {
                        install -m 644 ${WORKDIR}/mdev.conf ${D}${sysconfdir}/mdev.conf
                fi
 	fi
-	install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
 
     if ${@base_contains('DISTRO_FEATURES','systemd','true','false',d)}; then
         install -d ${D}${systemd_unitdir}/system
@@ -248,22 +284,26 @@ python do_package_prepend () {
 
     dvar = d.getVar('D', True)
     pn = d.getVar('PN', True)
-    f = open('%s/etc/busybox.links' % (dvar), 'r')
-
-    if os.path.exists('%s/bin/busybox' % (dvar)):
-        d.setVar('ALTERNATIVE_TARGET', "/bin/busybox")
-
-    for alt_link_name in f:
-        alt_link_name = alt_link_name.strip()
-        alt_name = os.path.basename(alt_link_name)
-
-        # Match coreutils
-        if alt_name == '[':
-            alt_name = 'lbracket'
-
-        d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
-        d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
-    f.close()
+    def set_alternative_vars(links, target):
+        f = open('%s%s' % (dvar, links), 'r')
+        for alt_link_name in f:
+            alt_link_name = alt_link_name.strip()
+            alt_name = os.path.basename(alt_link_name)
+            # Match coreutils
+            if alt_name == '[':
+                alt_name = 'lbracket'
+            d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
+            d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
+            if os.path.exists('%s%s' % (dvar, target)):
+                d.setVarFlag('ALTERNATIVE_TARGET', alt_name, target)
+        f.close()
+        return
+
+    if os.path.exists('%s/etc/busybox.links' % (dvar)):
+        set_alternative_vars("/etc/busybox.links", "/bin/busybox")
+    else:
+        set_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid")
+        set_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid")
 }
 
 pkg_prerm_${PN} () {
Signature · 1 line
1.7.9.5
#9 lore raw

PATCH v2 6/9 packagegroup-core-boot: use busybox as the default login manager

In reply to [email protected]

From: Chen Qi <[email protected]>

tinylogin has been deprecated and the functionality ported into busybox, so we switch to using busybox as the default login manager.

[YOCTO #4207]

---
 .../packagegroups/packagegroup-core-boot.bb        |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-core/packagegroups/packagegroup-core-boot.bb +1 -1
index 9306a34..d69c41d 100644
@@ -25,7 +25,7 @@ RCONFLICTS_${PN} = "task-core-boot"
 
 # Distro can override the following VIRTUAL-RUNTIME providers:
 VIRTUAL-RUNTIME_dev_manager ?= "udev"
-VIRTUAL-RUNTIME_login_manager ?= "tinylogin"
+VIRTUAL-RUNTIME_login_manager ?= "busybox"
 VIRTUAL-RUNTIME_init_manager ?= "sysvinit"
 VIRTUAL-RUNTIME_initscripts ?= "initscripts"
 VIRTUAL-RUNTIME_keymaps ?= "keymaps"
Signature · 1 line
1.7.9.5
#10 lore raw

PATCH v2 7/9 packagegroup-core-basic: set the default login manager

In reply to [email protected]

From: Chen Qi <[email protected]>

Set the default login manager to 'busybox', drop the mingetty in the RDEPENDS, use ${VIRTUAL-RUNTIME_login_manager} instead.

mingetty doesn't work with serial consoles, so if the login console is ttyS0 for example, we get error messages on screen and cannot login on ttyS0.

The login manager, no matter it's tinylogin or busybox, provides getty, so we can just rdepend on it.

[YOCTO #4207]

---
 .../packagegroups/packagegroup-core-basic.bb       |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
meta/recipes-extended/packagegroups/packagegroup-core-basic.bb +2 -1
index 31cac33..00405d6 100644
@@ -92,11 +92,12 @@ RDEPENDS_packagegroup-core-dev-utils = "\
 
 VIRTUAL-RUNTIME_initscripts ?= "initscripts"
 VIRTUAL-RUNTIME_init_manager ?= "sysvinit"
+VIRTUAL-RUNTIME_login_manager ?= "busybox"
 RDEPENDS_packagegroup-core-initscripts = "\
     ${VIRTUAL-RUNTIME_initscripts} \
     ${VIRTUAL-RUNTIME_init_manager} \
     ethtool \
-    mingetty \
+    ${VIRTUAL-RUNTIME_login_manager} \
     sysklogd \
     "
 
Signature · 1 line
1.7.9.5
#11 lore raw

PATCH v2 8/9 mingetty: lower the ALTERNATIVE_PRIORITY

In reply to [email protected]

From: Chen Qi <[email protected]>

mingetty doesn't work with serial consoles. Currently, it has the same ALTERNATIVE_PRIORITY with busybox. So if it is installed with busybox together, it's possible that the getty is linked to the mingetty, causing failures when we login to the serial consoles.

Lower the its ALTERNATIVE_PRIORITY to solve this problem.

[YOCTO #4207]

---
 meta/recipes-extended/mingetty/mingetty_1.08.bb |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-extended/mingetty/mingetty_1.08.bb +1 -1
index 6c53957..fbd9cb4 100644
@@ -25,4 +25,4 @@ inherit update-alternatives
 ALTERNATIVE_${PN} = "getty"
 ALTERNATIVE_LINK_NAME[getty] = "${base_sbindir}/getty"
 ALTERNATIVE_TARGET[getty] = "${base_sbindir}/mingetty"
-ALTERNATIVE_PRIORITY = "50"
+ALTERNATIVE_PRIORITY = "10"
Signature · 1 line
1.7.9.5
#12 lore raw

PATCH v2 9/9 tinylogin: remove recipe

In reply to [email protected]

From: Chen Qi <[email protected]>

tinylogin has been deprecated and the functionality ported into busybox. We now use busybox as the login manager, so the tinylogin recipe could be deleted.

[YOCTO #4207]

---
 .../tinylogin/tinylogin-1.4/add-system.patch       |  117 ---
 .../tinylogin-1.4/adduser-empty_pwd.patch          |   45 --
 .../tinylogin/tinylogin-1.4/avoid_static.patch     |   33 -
 .../tinylogin/tinylogin-1.4/cvs-20040608.patch     |  823 --------------------
 .../tinylogin/tinylogin-1.4/glibc_crypt_fix.patch  |   23 -
 .../tinylogin-1.4/passwd_rotate_check.patch        |   41 -
 .../tinylogin/tinylogin-1.4/remove-index.patch     |   13 -
 .../tinylogin/tinylogin-1.4/use_O2_option.patch    |   21 -
 meta/recipes-core/tinylogin/tinylogin_1.4.bb       |   45 --
 9 files changed, 1161 deletions(-)
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/add-system.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/adduser-empty_pwd.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/avoid_static.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/cvs-20040608.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/glibc_crypt_fix.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/passwd_rotate_check.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/remove-index.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/use_O2_option.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin_1.4.bb
meta/recipes-core/tinylogin/tinylogin-1.4/add-system.patch deleted +0 -117
deleted file mode 100644
index 0a97974..0000000
@@ -1,117 +0,0 @@
-Upstream-Status: Backport
-
-? add-system.patch
-? cvs-20040608.patch
-? familiar
-? pod2htmd.tmp
-? pod2htmi.tmp
-? system.diff
-? tinylogin_1.4-20030620.1_arm.ipk
-? tinylogin_1.4-20030620.1_arm.ipk.asc
-? tinylogin_1.4-20030620.1_arm.ipk.upload.html
-? tinylogin_1.4-20030620.2_arm.ipk
-? tinylogin_1.4-20030620.2_arm.ipk.asc
-? tinylogin_1.4-20030620.2_arm.ipk.upload.html
-? tinylogin_1.4-20030620_arm.ipk
-? tinylogin_1.4-20030620_arm.ipk.asc
-? tinylogin_1.4-20030620_arm.ipk.upload.html
-? tmp
-Index: addgroup.c
-===================================================================
-RCS file: /var/cvs/tinylogin/addgroup.c,v
-retrieving revision 1.23
-diff -u -r1.23 addgroup.c
---- a/addgroup.c	9 Jan 2003 18:43:29 -0000	1.23
-+++ b/addgroup.c	8 Jun 2004 08:56:08 -0000
-@@ -31,6 +31,7 @@
- #include <sys/stat.h>
- #include <sys/types.h>
- #include <unistd.h>
-+#include <getopt.h>
- #include "tinylogin.h"
- 
- #define GROUP_FILE      "/etc/group"
-@@ -124,6 +125,11 @@
- 	return 0;
- }
- 
-+static struct option long_options[] = {
-+  { "system",		0, NULL, 'S' },
-+  { 0,			0, 0, 0 }
-+};
-+
- /*
-  * addgroup will take a login_name as its first parameter.
-  *
-@@ -136,14 +142,19 @@
- 	int opt;
- 	char *group;
- 	char *user;
-+	int option_index = -1;
- 	gid_t gid = 0;
-+	int system = 0;
- 
- 	/* get remaining args */
--	while ((opt = getopt (argc, argv, "g:")) != -1) {
-+	while ((opt = getopt_long (argc, argv, "g:S", long_options, &option_index)) != -1) {
- 		switch (opt) {
- 			case 'g':
- 				gid = strtol(optarg, NULL, 10);
- 				break;
-+			case 'S':
-+				system = 1;
-+				break;
- 			default:
- 				show_usage();
- 				break;
-Index: adduser.c
-===================================================================
-RCS file: /var/cvs/tinylogin/adduser.c,v
-retrieving revision 1.38
-diff -u -r1.38 adduser.c
---- a/adduser.c	21 Jun 2003 19:35:42 -0000	1.38
-+++ b/adduser.c	8 Jun 2004 08:56:09 -0000
-@@ -66,13 +66,13 @@
- 
- /* remix */
- /* EDR recoded such that the uid may be passed in *p */
--static int passwd_study(const char *filename, struct passwd *p)
-+static int passwd_study(const char *filename, struct passwd *p, int system)
- {
- 	struct passwd *pw;
- 	FILE *passwd;
- 
--	const int min = 500;
--	const int max = 65000;
-+	const int min = system ? 10 : 500;
-+	const int max = system ? 99 : 65000;
- 
- 	passwd = wfopen(filename, "r");
- 	if (!passwd)
-@@ -142,7 +142,7 @@
- }
- 
- /* putpwent(3) remix */
--static int adduser(const char *filename, struct passwd *p, int makehome, int setpass)
-+static int adduser(const char *filename, struct passwd *p, int makehome, int setpass, int system)
- {
- 	FILE *passwd;
- 	int r;
-@@ -165,7 +165,7 @@
- 	fseek(passwd, 0, SEEK_END);
- 
- 	/* if (passwd_study(filename, p) == 0) { */
--	r = passwd_study(filename, p);
-+	r = passwd_study(filename, p, system);
- 	if (r) {
- 		if (r == 1)
- 			error_msg("%s: login already in use", p->pw_name);
-@@ -357,7 +357,7 @@
- 	}
- 
- 	/* grand finale */
--	return adduser(PASSWD_FILE, &pw, makehome, setpass);
-+	return adduser(PASSWD_FILE, &pw, makehome, setpass, system);
- }
- 
- /* $Id: adduser.c,v 1.38 2003/06/21 19:35:42 andersen Exp $ */
meta/recipes-core/tinylogin/tinylogin-1.4/adduser-empty_pwd.patch deleted +0 -45

45 lines not on this page · raw message

meta/recipes-core/tinylogin/tinylogin-1.4/avoid_static.patch deleted +0 -33
deleted file mode 100644
index 8a06af0..0000000
@@ -1,33 +0,0 @@
-tinylogin: Do not link statically when building debug
-
-For some reason if DODEBUG was enabled (to prevent stripping) the binary was
-also statically linked.  This patch prevents that behavior.
-
-Upstream-Status: Inappropriate [no upstream]
-
-Signed-off-by: Mark Hatle <[email protected]>
-
-diff -ur tinylogin-1.4.orig/Makefile tinylogin-1.4/Makefile
---- tinylogin-1.4.orig/Makefile	2011-06-18 11:00:23.073927349 -0500
-+++ tinylogin-1.4/Makefile	2011-06-18 11:03:26.394849372 -0500
-@@ -123,20 +123,6 @@
-     LDFLAGS += -s -Wl,-warn-common 
-     STRIP    = $(STRIPTOOL) --remove-section=.note --remove-section=.comment $(PROG)
- endif
--ifeq ($(strip $(DODEBUG)),true)
--    LDFLAGS += --static
--    #
--    #use '-ffunction-sections -fdata-sections' and '--gc-sections' (if they 
--    # work) to try and strip out any unused junk.  Doesn't do much for me, 
--    # but you may want to give it a shot...
--    #
--    #ifeq ($(shell $(CC) -ffunction-sections -fdata-sections -S \
--    #	-o /dev/null -xc /dev/null 2>/dev/null && $(LD) \
--    #			--gc-sections -v >/dev/null && echo 1),1)
--    #	CFLAGS += -ffunction-sections -fdata-sections
--    #	LDFLAGS += --gc-sections
--    #endif
--endif
- ifeq ($(strip $(DOSTATIC)),true)
-     LDFLAGS += --static
-     #
meta/recipes-core/tinylogin/tinylogin-1.4/cvs-20040608.patch deleted +0 -823

823 lines not on this page · raw message

meta/recipes-core/tinylogin/tinylogin-1.4/glibc_crypt_fix.patch deleted +0 -23
deleted file mode 100644
index 0a24656..0000000
@@ -1,23 +0,0 @@
-
-staring from glibc 2.17 the crypt() function will error out and return
-NULL if the seed or "correct" is invalid. The failure case for this is
-an unknown user which tinylogin assigns '!' for the password. crypt() 
-now expects a minimum of 2 valid characters. If we get a NULL return
-value from the crypt, assume we fail and return 0.
-
-Upstream-Status: Inappropriate [tinylogin depercated]
-Signed-off-by: Saul Wold <[email protected]>
-
-Index: tinylogin-1.4/libbb/correct_password.c
-===================================================================
---- tinylogin-1.4.orig/libbb/correct_password.c
-+++ tinylogin-1.4/libbb/correct_password.c
-@@ -74,5 +74,8 @@ int correct_password ( const struct pass
- 	}
- 	encrypted = crypt ( unencrypted, correct );
- 	memset ( unencrypted, 0, xstrlen ( unencrypted ));
-+        if ( !encrypted )
-+		return 0;
-+
- 	return ( strcmp ( encrypted, correct ) == 0 ) ? 1 : 0;
- }
meta/recipes-core/tinylogin/tinylogin-1.4/passwd_rotate_check.patch deleted +0 -41

41 lines not on this page · raw message

meta/recipes-core/tinylogin/tinylogin-1.4/remove-index.patch deleted +0 -13
deleted file mode 100644
index 9d3c324..0000000
@@ -1,13 +0,0 @@
-Upstream-Status: Inappropriate [legacy version]
-
---- /tmp/deluser.c	2007-05-13 10:38:19.000000000 +0200
-+++ tinylogin-1.4/deluser.c	2007-05-13 10:38:50.185251000 +0200
-@@ -60,7 +60,7 @@
- 	}
- 	start++;
- 
--	stop = index(start, '\n');	/* index is a BSD-ism */
-+	stop = strchr(start, '\n');	/* index is a BSD-ism, strchr hopefully isn't */
- 	b.start = start - buffer;
- 	b.stop = stop - buffer;
- 	return b;
meta/recipes-core/tinylogin/tinylogin-1.4/use_O2_option.patch deleted +0 -21
deleted file mode 100644
index 5b88060..0000000
@@ -1,21 +0,0 @@
-Upstream-Status: Inappropriate [configuration]
-
-tinylogin will meet segment fault if compiled by gcc-4.5.0 when enable both
-frename-registers and Os options. Use O2 instead.
-
-Signed-off-by: Dongxiao Xu <[email protected]>
-
-diff -ruN tinylogin-1.4-orig/Makefile tinylogin-1.4/Makefile
---- tinylogin-1.4-orig/Makefile	2010-09-16 13:02:06.302192295 +0800
-+++ tinylogin-1.4/Makefile	2010-09-16 13:02:34.634167846 +0800
-@@ -97,9 +97,7 @@
- #--------------------------------------------------------
- 
- 
--# use '-Os' optimization if available, else use -O2
--OPTIMIZATION = $(shell if $(CC) -Os -S -o /dev/null -xc /dev/null >/dev/null 2>&1; \
--    then echo "-Os"; else echo "-O2" ; fi)
-+OPTIMIZATION = -O2
- 
- WARNINGS = -Wall
- 
meta/recipes-core/tinylogin/tinylogin_1.4.bb deleted +0 -45

45 lines not on this page · raw message

Signature · 1 line
1.7.9.5
#13 lore raw

Re: [PATCH V2 9/9] tinylogin: remove recipe

Quoted 3 lines · On Mon, 2013-06-17 at 13:49 +0800, [email protected] wrote:

tinylogin has been deprecated and the functionality ported into busybox. We now use busybox as the login manager, so the tinylogin recipe could be deleted.

I'm not entirely sure who "we" is in this context, but the choice of login manager has, historically, been a distro decision.

Reading between the lines I assume what you're actually saying here is that Poky has decided to switch from tinylogin to busybox, which obviously is fine. It's not entirely obvious to me that this is a very compelling reason to remove tinylogin from oe-core, though equally I guess there is no reason it couldn't live in some other layer instead.

p.

#14 lore raw

Re: [PATCH V2 9/9] tinylogin: remove recipe

Quoted 5 lines · Phil Blundell
Quoted 3 lines · On Mon, 2013-06-17 at 13:49 +0800, [email protected] wrote:

tinylogin has been deprecated and the functionality ported into busybox. We now use busybox as the login manager, so the tinylogin recipe could be deleted.

Quoted 8 lines

I'm not entirely sure who "we" is in this context, but the choice of login manager has, historically, been a distro decision.

Reading between the lines I assume what you're actually saying here is that Poky has decided to switch from tinylogin to busybox, which obviously is fine. It's not entirely obvious to me that this is a very compelling reason to remove tinylogin from oe-core, though equally I guess there is no reason it couldn't live in some other layer instead.

The trouble is that the tinylogin we're using is obsolete code and unmaintained/deprecated. Its starting to become a maintenance burden and cause some security concerns since nobody else is using it.

The thinking is therefore we should therefore create a replacement for it from busybox. People are nervous about making busybox entirely SUID but having some small subset of it seems like a reasonable compromise.

If someone wants to continue using tinylogin, there are obviously free to do so but it would no longer be part of OE-Core.

Cheers,

Richard

#15 lore raw

Re: [PATCH V2 9/9] tinylogin: remove recipe

Quoted 3 lines · Richard Purdie

The thinking is therefore we should therefore create a replacement for it from busybox. People are nervous about making busybox entirely SUID but having some small subset of it seems like a reasonable compromise.

The difficulty with this in the past has always been that the way busybox is structured makes it quite difficult to tell which parts of the code might actually end up being executed in setuid context. But maybe that situation has improved now, I dunno.

p.

#16 lore raw

Re: [PATCH V2 9/9] tinylogin: remove recipe

Quoted 9 lines · Phil Blundell
Quoted 3 lines · Richard Purdie

The thinking is therefore we should therefore create a replacement for it from busybox. People are nervous about making busybox entirely SUID but having some small subset of it seems like a reasonable compromise.

The difficulty with this in the past has always been that the way busybox is structured makes it quite difficult to tell which parts of the code might actually end up being executed in setuid context. But maybe that situation has improved now, I dunno.

The plan (and I believe what this series does) is to have two busybox binaries, one is suid (as small a subset as we really need) and the other is not and hence this hopefully goes some way to reassuring people about that.

Cheers,

Richard

#17 lore raw

Re: [PATCH V2 9/9] tinylogin: remove recipe

Quoted 4 lines · Richard Purdie

The plan (and I believe what this series does) is to have two busybox binaries, one is suid (as small a subset as we really need) and the other is not and hence this hopefully goes some way to reassuring people about that.

Partly, but that's only half the problem. My recollection from when I last looked at this is that it was actually quite straightforward to convince yourself by inspection of the code that busybox is indeed dropping setuid privs almost immediately for applets that don't need it, so the risk of having things like /bin/cat unexpectedly running as setuid is probably fairly low. (However, there are other minor reasons why having the primary busybox binary as setuid is sometimes inconvenient so I agree that splitting the setuid portions out makes sense.)

What's harder. given the way that the code is structured, is to get a clear view of which lines of source might end up being invoked by one of the setuid applets and to determine whether this has changed from one busybox release to the next.

p.