457721d7544d jail: drop the deferred path's own mount-propagation remount
66a33c82f755 jail: keep locked flags on phase-2 read-only remounts
0925850d765b jail: keep locked flags when remounting a noafile mask
ac855770e3b2 jail: apply root_map_uid to a joined user namespace
7f1b26ce3759 jail: join an external userns after build_jail_fs()
88fe395b2cd5 jail: fail on an unresolvable -j specification
638c2ecfaf8a jail: let a joined namespace replace the created one
56e1a2032e0d jail: factor out the MS_* to MOUNT_ATTR_* translation
8c9df2b8ae32 jail: mount sysfs in the parent when the jail lacks a netns
4021843627a4 jail: log a failing mask mount
fa1f24c84ce7 jail: drop all capabilities for a bundle that names none
5670ff93498d uxc: report every failure with one exit status
6a22d3964822 service: add per-instance 'vrf' option
Allow to set the new 'vrf' instance option with procd_set_param. It
binds all sockets of a service to a VRF device, like 'ip vrf exec':
procd_set_param vrf <dev>
Assisted-by: Claude:claude-opus-5-5
Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
The rule placed every video4linux and media node in video-capture, but
most are not capture devices: on an rk3588 board five of the six V4L2
nodes are the RGA blitter and the Hantro and rkvdec stateless codecs,
and only the HDMI receiver captures anything. A media player then had to
join video-capture to reach a decoder, which also granted it every
camera on the box.
Put the DRM and media nodes in video, and add v4l-id, which runs
VIDIOC_QUERYCAP and prefers device_caps over capabilities so that what
it describes is the node. Given a device alone it prints one boolean per
V4L2_CAP_ flag as JSON. Given a rule string as well, a list of
CAP[,CAP...]:GROUP separated by semicolons in which * matches any node,
it puts the node into the group of the first rule which matches it.
The rule string is parsed in full before the device is opened, so a
capability name the kernel does not define is reported whichever rule it
appears in, and no node is touched. A V4L2 node is created with no group
and v4l-id assigns one, since exec is queued by procd and may not run at
all; holding the node at root until the driver answers keeps a camera
out of video.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
cd51fc0031ff libubus: refuse to send a message the peer must reject
9ba1ab795b2f libubus: drop the connection when a message cannot be read
ce54d7a956a5 ubusd_main: free partially received message on client disconnect
6b5c6f166db4 ubusd_main: free queued lookup commands on client disconnect
b012bc067515 ubusd_acl: use SO_PEERGROUPS instead of parsing /proc for peer gids
955ff3f7030c ubusd: fix use-after-free when resuming a queued object lookup
fb1dd8e0d7c8 ubusd: document the bound on the pending-message body read
3a39a800f162 libubus-req: fix double close of the fd in ubus_complete_deferred_request
4d60031579d2 libubus: fix msgbuf leak on ubus_channel_connect error path
91b0dadfd1ed libubus-req: fix error check on the __ubus_notify_async result
82416940eae8 libubus-io: do not resend the fd on partial writes in writev_retry
618f3cf75ae3 libubus-obj: fix fd leaks on object message error paths
2f52ae367c93 ubusd_main: flush the tx queue after freeing the client's objects
cdb648c3283a ubusd_obj: propagate subscription allocation failure to the client
7c5c06825daf ubusd_proto: fix double close of forwarded invoke fd
d8fec00656a6 ubusd: keep the fd alive while a message waits in the tx queue
bde609c2400e ubusd_acl: copy the filename used as the ACL file vlist key
008655958eb4 ubusd_acl: do not treat unresolvable ACL user/group names as id 0
5331c00f37f7 ubusd_event: document reserved event namespace forgery check
ef37ed207183 ubusd_event: use an unsigned type for the event dedup sequence
e12ad4bd667f ubusd: flag event messages as not expecting a reply
9d709c536cd6 ubusd_event: report allocation failure as out of memory
5170a5818b54 ubusd: use canonical SCM_RIGHTS extraction on the receive path
8dfee69c250c ubusd_main: do not abort startup when the default socket dir fails
17f78610d771 ubusd: disconnect the client when a partially sent message is dropped
f5e5836704c8 cli: parse monitored payloads with the untrusted blob parser
11e411e36f08 libubus: close the passed fd when the request exceeds the size limit
cbc27b66d813 ubusd: stop writing to a client already flagged for disconnect
2ec13d49ba37 libubus: do not restart the ACL query while one is in flight
297baef62eee libubus: free queued pending messages on shutdown
17525550a36b ubus/lua: fix Lua stack imbalance on policy allocation failure
fdd9ff1fe0fc ubus/lua: copy the Lua strings stored in registered objects
eb5a8284d176 ubusd: close the forwarded fd when the invoke reply cannot be built
3930745d8593 tests/fuzz: fix out-of-bounds read in header validation harness
b27014cf7978 tests/fuzz: use size of blob_attr, not of a pointer, in length guard
414c60a2e29e ubus/lua: store event handler ref without polluting the callback table
Signed-off-by: Felix Fietkau <nbd@nbd.name>
4062f666ecd1 file: reply with empty data instead of error for empty files
a6c6b63b47bd ucode: add compatibility to newer ucode version
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A HID device a driver hands to userspace whole, a UPS, a relay board or
a programmable keypad, appears as a hidraw node and is opened directly
by the program driving it. Everything of that kind runs as root today,
because the generic rule leaves the node 0600 root:root and there is no
group for it.
Allocate the hidraw group and install the rule which puts the hidraw
nodes into it. This is a separate class from the evdev nodes that
input-support covers: hidapi and the packages using it open hidraw, and
a keyboard or a mouse is read through evdev.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Scanner access is granted per device: a USB scanner is matched by vendor
and product id against a database of supported devices, which only the
driver package has. There is no device class to write a generic hotplug
rule against, and putting every USB device node into a group would grant
far more than scanner access.
Allocate the scanner group and nothing else, so the id is the same on
every image, one package owns it, and scanner userspace has something to
depend on. The rule granting access to a particular device stays with
the driver package.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The USB and parallel port printer nodes come out 0600 root:root, so a
print spooler runs as root. The lp group is already allocated by p910nd
in the packages feed with gid 7, without anything creating it.
Add a printer-support package which allocates that group and puts the
usblp, lp and ppdev nodes into it, and make kmod-usb-printer and kmod-lp
depend on it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
/dev/kvm comes out 0600 root:root, so a hypervisor runs as root.
Add a kvm-support package which allocates the kvm group and puts the node
into it. KVM is built into the kernel where it exists, so no module
carries a dependency on the package; userspace depends on it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The DVB adapter nodes under /dev/dvb come out 0600 root:root, so a
tuner daemon runs as root.
Add a dvb-support package which allocates the dvb group and puts those
nodes into it, and make kmod-dvb-core depend on it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The evdev character devices come out 0600 root:root, so a display server
or any other process reading keyboards and pointers runs as root.
Add an input-support package which allocates the input group and puts the
input nodes into it, and make the evdev and joydev modules depend on it.
The one device profile that ships evdev lists the package directly.
kmod-input-core stays ungated: it carries no device node of its own, and
most drivers built on it deliver their events to in-kernel consumers such
as the keyboard and button handlers.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The DRM render and compute nodes, /dev/dri/renderD*, /dev/accel/accel*
and /dev/kfd, come out 0600 root:root, so anything using a GPU for
compute or for accelerated rendering runs as root. They also share the
video group with the modesetting nodes wherever a distribution grants it,
which hands scanout control to every process allowed to compute.
Add an accel-support package which allocates the render group and puts
those nodes into it. No kernel module carries a dependency on it: whether
a device offers a render node is a property of the driver, not of the
module, so userspace that wants the group depends on the package.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The display target feature gates every DRM module, but it says nothing
useful: it is set on ten targets, so a mediatek/mt7623 board can have a
display while a filogic board with a MIPI DBI panel cannot, and rockchip
claims it for a NanoPi R2S as much as for a Rock 5B. Whether a board
drives a panel is a per-device choice, not a property of the SoC family.
The DRM and V4L2 nodes also end up 0600 root:root, so a display server
runs as root or not at all.
Add a video-support package which allocates the video and video-capture
groups and installs the hotplug rules for the DRM and V4L2 nodes, and
make the modules depend on it. The dependency is a plain one, not a
select, so the modules are offered once the feature is chosen. Targets
whose display drivers are built into the kernel carry the package in
DEFAULT_PACKAGES, since no module pulls it in for them, and the one
device profile that ships a DRM module on another target lists it
directly. DISPLAY_SUPPORT stays for now, so this changes no existing
selection.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The audio group and the rule that puts the ALSA character devices in it
are part of procd and base-files, so every image carries them whether or
not it has a sound card, and a package wanting the group has nothing to
depend on. Playback, capture and MIDI all land in one group as well, so a
process allowed to play is also allowed to record.
Move the lot into a new audio-support package with three groups, audio,
audio-capture and midi, and a hotplug fragment that sorts the sound nodes
between them. kmod-sound-core depends on the package, and so do the image
profiles that ship a sound driver. The dependency is a plain one, not a
select, so sound support is offered once the feature is chosen; userspace
that needs one of the groups depends on the same package. Images without
it fall back to the generic rule and get /dev/snd/* as 0600 root:root.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The hotplug rules live in a single /etc/hotplug.json, so a package
that needs a device node named, owned or grouped its own way has no
way to contribute one; the alternatives are patching the shared file
or falling back to a shell script under /etc/hotplug.d.
Load /etc/hotplug.json.d/*.json from inside the device node branch,
ahead of the built-in name rules, and /etc/hotplug-preinit.json.d/*
at the end of the preinit script. Fragments are run in sorted order.
A fragment that creates a node keeps it: the generic rule below still
runs, but its mknod() fails with EEXIST and leaves the node alone.
This is done in preparation for deprecating some of the subtarget-wide
FEATURES flags, instead introducing feature-umbrella packages such as
`video-support` and `audio-support` shipping the hotplug rule snippets
and having all providers (ie. kmods) and users depend on them.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
trx_fixup() computed the CRC32 range from the on-flash TRX header
without validating it:
scan = ptr + offsetof(struct trx_header, flag_version);
trx->crc32 = crc32buf(scan, trx->len - (scan - ptr));
trx->len is read from the mmap()ed partition and is only sanity checked
in trx_check(), which is a separate entry point. A trx->len larger than
the partition therefore makes crc32buf() walk that many bytes past the
end of the mapping and crash mtd with SIGSEGV.
The mirror case of a trx->len below the 12 byte offset does not overread
in practice: crc32buf() takes a size_t but passes it to crc32(), which
takes an int len and loops on "while (--len >= 0)". The wrapped value
truncates to a negative int, so the loop body never runs and a zero
length CRC32 is written instead. Values at or above 0x8000000c truncate
the same way. Only the range from sizeof(struct trx_header) to roughly
0x8000000b stays positive through the truncation and reads out of
bounds, which is exactly the range a plausible bad length falls into.
Bound trx->len on both sides before computing the range, using the same
lower limit trx_check() already applies. Both comparisons are unsigned,
so the wrapping cases are rejected as well.
trx_fixup() runs as root on the contents of the flash, so this is a
robustness fix rather than a privilege boundary: it is reachable through
"mtd jffs2write" and the jffs2_replaced path of "mtd write", not through
"mtd fixtrx", which uses mtd_fixtrx() and derives its length from
erasesize instead. The practical benefit is not crashing on a truncated
or corrupted header during sysupgrade.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-wch3-f5gc-mw2h
Reported-by: @tonoyx91
Reported-by: @0xROI
Fixes: bbd9eb4669 ("clean up mtd, fix up trx header when integrating jffs2 data on broadcom devices")
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/25284
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When the TRX magic check fails, trx_fixup() jumps straight to the err
label, which only returns -1. At that point the mtd device has already
been opened and the whole partition has been mmap()ed, so both the file
descriptor and the mapping are leaked.
Add an err2 label that unwinds the mapping before falling through to the
existing close(bfd), so the error path unwinds in reverse order of
acquisition like the success path does.
Fixes: bbd9eb4669 ("clean up mtd, fix up trx header when integrating jffs2 data on broadcom devices")
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/25284
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add missing syscall names needed on 32-bit platforms to the pre-main
pre-main syscall allowlists.
Fixes: #25392
Fixes: ee526dbf01 ("procd: update to git HEAD of 2026-09-13")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The host apk signs with LibreSSL, which uses a random ECDSA nonce. A
package that is signed again has different bytes and often a different
size, even if its content did not change. The rootfs records the
package size in /lib/apk/db/installed, so a rebuild of one package
changes all images.
Add a patch that derives the nonce as specified in RFC 6979. Signed
packages and images are now identical after a rebuild.
Signed-off-by: John Crispin <john@phrozen.org>
The new seccomp rework broke builds on ARMv4 which doesn't have Thumb
support. Fix it.
c230ad87 jail: skip Thumb injection on cores without Thumb state
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
procd-ujail is not selected on targets without the required kernel
namespace support, but its shared architecture package can still be
installed there.
When the package is carried across an upgrade or installed later, jailed
services fail to start because clone() returns EINVAL.
Keep procd-ujail in target-specific package repositories so it is not
offered on incompatible targets.
Fixes: #22428
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
Various fixes and improvements in procd/ujail/uxc to better support
the use of ujail and uxc as container runtime environments, now
compliant with the OCI run-time spec version 1.3.0.
Also brings basic udebug tracing support and replaces the seccomp
preload libraries with a ucode implementation: procd-seccomp ships
trace2seccomp plus its utrace and seccomp-trace aliases and needs only
ucode and its fs module, while the OCI seccomp code now links into
ujail. uxc installs the new uxc-net and uxc-stack helpers and depends
on the ucode modules they use, and on odhcpd, which serves RA, DHCPv6
and DHCPv4 on container networks.
Adjacent changes in firewall4, netifd and odhcpd still have to find
their way into the tree for dynamically addressed native uxc
containers to be fully functional.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2aa1640 block: preen a registered volume before mount on request
d43ffba block: use preen mode for the f2fs filesystem check
a71e97d blockd: do not let a slow startup helper hold back readiness
1c17d24 blockd: expose storage readiness via a queryable status method
f60b3a3 blockd: pass registrant mount options down to block on autofs mount
998f6ab blockd: notify when an idle autofs mount is unmounted
0008996 block: mount ubus-registered devices without an fstab entry
4fd1502 blockd: coldplug block devices
89a6f52 blockd: retry interrupted waitpid() in synchronous block() helper
37cf94d blockd: fix bounds of the ubus event name buffer
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
In fis_remap(), when desc < last, the memset size is computed as
'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is
always less than end, making 'tmp - end' negative. When cast to size_t,
this wraps to a very large value, causing a massive buffer overflow.
Fix by swapping the operands to 'end - tmp' which correctly computes the
number of bytes to clear.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23550
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
9ff6e43bb75f service: notify instance exit details via ubus
4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace
60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace
Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()"
which changed the code but did not increase the release. This causes two
packages with the same version to have different content and thereby hashes.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23827
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
APK compresses it's helptext using LUA and require `zlib`, which isn't
available on the Buildbots. It thens falls back to `gzip`, which embeds the
MTIME, making the binary itself unreproducible.
This commits adds a downstream patch to run `gzip` with `-n`, setting the time
to 0.
Link: https://github.com/openwrt/openwrt/pull/23736
Signed-off-by: Paul Spooren <mail@aparcar.org>
Two leaks in mtd_dump():
- The buffer allocated with malloc(erasesize) is never freed before
returning, leaking erasesize bytes on every call.
- The pre-existing malloc-NULL early return path also leaked the just-
opened fd by returning directly instead of going through cleanup.
Initialize buf to NULL, route the malloc-NULL case through the
existing 'out:' label, and add free(buf) on the cleanup path so both
fd and buf are released consistently on every exit.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23706
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
After malloc(erasesize) in mtd_check(), the result was never checked
for NULL. On allocation failure, the buf pointer remained NULL and
would later be used in image_check() via read(imagefd, buf + buflen,
...), causing a NULL pointer dereference.
Add a NULL check after the allocation and return early. The early
return path also closes the just-opened fd and frees the strdup'd
colon-separated device-list copy to avoid leaks.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23705
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Two ignored return values in mtd_write_buffer() caused silent failures:
- lseek() return value was ignored. A failed seek (e.g. EBADF, ESPIPE)
followed by write() would silently write at the wrong offset.
- write() return value was ignored, silently discarding write errors.
This could lead to data corruption on the MTD device without any
indication.
Check both return values, report errors to stderr and return -1 on
failure.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23552
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
69b62b1990bc rpc-sys: packagelist: increase input buffer size
e655a0d69492 exec: defer async reply teardown to avoid use-after-free
5b078674a592 optimize by reusing timeout member
d005c885dbe4 session: clamp uloop timeout to avoid int overflow
a545f008da91 ucode: add request.defer() for async method handling
ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks
7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument
680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow
fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random()
dc091afa5860 rpc-sys: packagelist: check calloc() result for world array
4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version
46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name
26dba5206e17 exec: prevent double close() of exec pipe descriptors
af5d6f431186 uci: prevent integer overflow of client supplied apply timeout
d06d2a81dc29 rc: fix memory leak of list request context
0de666811559 rc: copy list "name" filter to avoid use-after-free
75470f4b5124 rc: use a per-request blob_buf for the list reply
3037a0e36856 treat exec failures in forked children with _exit() instead of return
f5ffec54d7c7 rc: reap killed child on list "running" check timeout
fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths
e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS
79c8087c8e8e file: avoid zero-length b64_decode() on empty write data
cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values
2decaec3ef1b iwinfo: fix error handling and backend leak in survey
28faf6403792 cast char arguments to unsigned char for ctype.h functions
Link: https://github.com/openwrt/openwrt/pull/23650
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
ac5cc72f6cfa jail: mount ucode related bits into netifd jail
81119d3f249d instance: disable console logging
8013c0cd2755 jail: mount tools used by dhcp.sh in the netifd jail
876981d0516d jail: fix reading the oci device gid value
c92dbcd460d7 jail: make /dev/tty accessible by others
74bfbee8adb8 service: fix calloc_a argument
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The imagestart variable was assigned sizeof(tag) (which incorrectly
computed the pointer size rather than the struct size), but was never
actually read after the assignment in either trx_fixup() or
mtd_fixtrx(). The CRC calculations that follow use
offsetof(struct bcm_tag, header_crc) directly.
Remove the dead variable and its assignments entirely rather than fixing
the sizeof expression. No functional change.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23546
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
In mtd_replace_jffs2(), the return value of malloc(erasesize) is never
checked. If the allocation fails, buf remains NULL and the subsequent
memcpy(buf + ofs, ...) in add_data() will dereference NULL, causing a
segfault.
Add a NULL check and return -1 on allocation failure. Match the
diagnostic message used by the sibling mtd_write_jffs2() so the
out-of-memory cause is visible at the call site.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23553
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
4b274055ede3 libubus: fix NULL dereference on OOM in ubus_queue_msg
8b5be570f13e libubus-acl: fix dangling pointers on blob_memdup failure in acl_recv_cb
9105ea2a349a ubusd_acl: fix NULL dereference on OOM in ubusd_acl_alloc_obj
07d7f34ac278 ubusd_acl: handle allocation failures in ubusd_acl_init_client
497321a5ea90 ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init
f66d52ba983f ubusd_event: fix OOM handling in ubusd_send_event_msg
11ea1b3bdbea ubusd_main: fix async-signal-unsafe SIGHUP handler
0c095592ccb7 ubusd_proto: fix resource leaks and ID tree corruption in ubusd_proto_new_client
f61695e6e12a ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch
7ecacfadd9bc ubusd_proto: fix NULL dereference on OOM in ubusd_proto_init_retmsg
3ab9d7759545 lua: fix inverted argument check in ubus_lua_add
43051ca73aec lua: fix unchecked calloc and memory leak in ubus_lua_load_object
4ca0b141e9a7 ubusd_id: use getrandom(2) unconditionally on Linux
7e4356da8abe ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message
5849870f2251 libubus-req: fix file descriptor leaks in ubus_process_req_msg
f29767f90af1 libubus: fix file descriptor leaks in ubus_process_msg
b099d050b59d libubus: make ubus_shutdown idempotent
a564b8dcb395 ubusd_main: check strdup return value in mkdir_sockdir
239edcbaaac8 ubusd_id: fix continue in do-while skipping random ID retry
09d2df45bf38 ubusd: fix NULL dereference on OOM in ubus_msg_enqueue
bcc45ca981fd libubus: actually set FD_CLOEXEC on the ubus socket
8188f5ce8564 libubus-io: close recv_fd captured before get_next_msg failure
7a068bac5a9b libubus-io: byte-swap peer in HELLO when storing as local_id
747013f6ea05 libubus-io: reset sock.fd to -1 after close on ubus_reconnect error path
020a64b9b169 ubusd_acl: use size_t for strlen result in ubusd_acl_alloc_obj
f92ffd289dcc ubusd: use size_t for string and blob length variables
795b32bb96b6 ubusd: use fixed-width types for sequence counters
Link: https://github.com/openwrt/openwrt/pull/23487
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
7df188543e26 libfstools: enable f2fs overlay compression formatting
16718b6e3c0f libfstools: mount f2fs overlay with zstd compression
Signed-off-by: Robert Marko <robimarko@gmail.com>
1bf2d490484e libfstools: make get_var_from_file() reusable
0b6022439cad mount_root: add kernel parameter to specify the overlay storage name
e600d842ce81 mount_root: add kernel parameter to specify the overlay fileystem type
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Debian changelog:
* Update Mozilla certificate authority bundle to version 2.82
The following certificate authorities were added (+):
+ TrustAsia TLS ECC Root CA
+ TrustAsia TLS RSA Root CA
+ SwissSign RSA TLS Root CA 2022 - 1
+ OISTE Server Root ECC G1
+ OISTE Server Root RSA G1
The following certificate authorities were removed (-):
- GlobalSign Root CA
- Entrust.net Premium 2048 Secure Server CA
- Baltimore CyberTrust Root (closes: #1121936)
- Comodo AAA Services root
- XRamp Global CA Root
- Go Daddy Class 2 CA
- Starfield Class 2 CA
- CommScope Public Trust ECC Root-01
- CommScope Public Trust ECC Root-02
- CommScope Public Trust RSA Root-01
- CommScope Public Trust RSA Root-02
* Use dh_usrlocal to create /usr/local/share/ca-certificates
(closes: #1127100)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23155
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
58eb263 instance: don't print error in case cgroups are disabled
9baf019 instance: use positive error numbers for strerror()
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Gary Dotzler
Nick Hainke
Daniel Golle
Hauke Mehrtens
Felix Fietkau
John Crispin
Dharmik Parmar
Fengyu Wu
Anna Kiri
Paul Spooren
Robert Marko
Robert Marko
Alexandru Ardelean
Mieczyslaw Nalewaj
Hannu Nyman