- Arch-projects - lists.archlinux.org

[arch-projects] [devtools] [GIT] The official devtools repository branch master updated. 20190912-11-g29c6fa8
by Levente Polyak 15 Oct '19

15 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official devtools repository". The branch, master has been updated via 29c6fa85373324c027c4ca3965707422187881d6 (commit) from 74f65db396038caafcba20e4302fba080d8cc100 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 29c6fa85373324c027c4ca3965707422187881d6 Author: jelle van der Waa <jelle(a)archlinux.org> Date: Tue Oct 15 23:17:00 2019 +0200 sogrep: redirect to destination mirror (#25) Some mirrors redirect consumers to a near by mirror which isn't handled by sogrep. ----------------------------------------------------------------------- Summary of changes: sogrep.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The official devtools repository

1 0

[arch-projects] [devtools] [GIT] The official devtools repository branch sogrep_redirect created. 20190912-11-g7f849ea
by Jelle van der Waa 15 Oct '19

15 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official devtools repository". The branch, sogrep_redirect has been created at 7f849ea58d6a46631017b928285ebf3ff4ce6c69 (commit) - Log ----------------------------------------------------------------- commit 7f849ea58d6a46631017b928285ebf3ff4ce6c69 Author: Jelle van der Waa <jelle(a)vdwaa.nl> Date: Tue Oct 15 21:43:20 2019 +0200 sogrep: redirect to destination mirror Some mirrors redirect consumers to a near by mirror which isn't handled by sogrep. ----------------------------------------------------------------------- hooks/post-receive -- The official devtools repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository annotated tag v26 created. v26
by grazzolini＠archlinux.org 07 Oct '19

07 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The annotated tag, v26 has been created at 8843ca83b9e2fa58cd49e11128222052ec8f4a97 (tag) tagging 9ae6b1f928ef11e277437740908871ab535b655d (commit) replaces 25 tagged by Giancarlo Razzolini on Mon Oct 7 00:22:38 2019 -0300 - Log ----------------------------------------------------------------- tag as v26 Daniel Edgecumbe (1): mkinitcpio: Produce reproducible initramfs images Dave Reisner (1): consolidate error reporting within generation pipeline Giancarlo Razzolini (12): Merge pull request #1 from esotericnonsense/esotericnonsense/reproducible Merge branch 'morten/copyright' of https://github.com/Foxboron/mkinitcpio into Foxboron-morten/copyright Merge branch 'Foxboron-morten/copyright' * Fix whitespace Merge branch 'Foxboron-morten/hookdir-flag' Merge branch 'master' of https://github.com/falconindy/mkinitcpio into falconindy-master Merge branch 'falconindy-master' Change the PKGBUILD to use $startdir Add initramfs to provides=() in the PKGBUILD Split the hookdir var creation and also add the hookdir option to the optparser. Add the hookdir option to both bash and zsh completion files Merge branch 'fix-hookdir-flag' Morten Linderud (5): Updated copyright year [README] Add grazzolini to the copyright Add flag to specify where to look for hooks. [mkinitcpio] Support multiple hook paths [mkinitcpio] Fixup declaration and remove trailing : ----------------------------------------------------------------------- hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 25-19-g9ae6b1f
by grazzolini＠archlinux.org 07 Oct '19

07 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via 9ae6b1f928ef11e277437740908871ab535b655d (commit) via 51a8337b6c461ac29710664ed084c99f57c4118a (commit) via f1e756f78d0e87d422abe6b3bcd5bff61442cc2b (commit) from 6b7427861b923560c10184ba92df2e7cc13ac258 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9ae6b1f928ef11e277437740908871ab535b655d Merge: 6b74278 51a8337 Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Mon Oct 7 00:14:43 2019 -0300 Merge branch 'fix-hookdir-flag' Added the hookdir flag to the parser and also added it to the completions. commit 51a8337b6c461ac29710664ed084c99f57c4118a Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Sun Oct 6 23:50:25 2019 -0300 Add the hookdir option to both bash and zsh completion files commit f1e756f78d0e87d422abe6b3bcd5bff61442cc2b Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Sun Oct 6 23:39:04 2019 -0300 Split the hookdir var creation and also add the hookdir option to the optparser. ----------------------------------------------------------------------- Summary of changes: mkinitcpio | 7 ++++--- shell/bash-completion | 4 ++-- shell/zsh-completion | 1 + 3 files changed, 7 insertions(+), 5 deletions(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 25-16-g6b74278
by grazzolini＠archlinux.org 07 Oct '19

07 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via 6b7427861b923560c10184ba92df2e7cc13ac258 (commit) from a6d0e51cee697d311bb57dd2023b9e148a228a4e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6b7427861b923560c10184ba92df2e7cc13ac258 Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Sun Oct 6 23:09:10 2019 -0300 Add initramfs to provides=() in the PKGBUILD ----------------------------------------------------------------------- Summary of changes: PKGBUILD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 25-15-ga6d0e51
by grazzolini＠archlinux.org 07 Oct '19

07 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via a6d0e51cee697d311bb57dd2023b9e148a228a4e (commit) from f61dc88b9bfdc59f9f3720a1f0c938ed4a2f14db (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a6d0e51cee697d311bb57dd2023b9e148a228a4e Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Sun Oct 6 23:01:39 2019 -0300 Change the PKGBUILD to use $startdir ----------------------------------------------------------------------- Summary of changes: PKGBUILD | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 25-14-gf61dc88
by grazzolini＠archlinux.org 04 Oct '19

04 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via f61dc88b9bfdc59f9f3720a1f0c938ed4a2f14db (commit) via 1dde014bf78f075ecea96a880aeaa68ec8f13268 (commit) via 814dd9df251267c2e48d4a30bb3a192329e7f2ab (commit) from b43739e39d9287baaec131f176a350736bffda4d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f61dc88b9bfdc59f9f3720a1f0c938ed4a2f14db Merge: b43739e 1dde014 Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Fri Oct 4 14:44:00 2019 -0300 Merge branch 'falconindy-master' commit 1dde014bf78f075ecea96a880aeaa68ec8f13268 Merge: b43739e 814dd9d Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Fri Oct 4 14:38:41 2019 -0300 Merge branch 'master' of https://github.com/falconindy/mkinitcpio into falconindy-master commit 814dd9df251267c2e48d4a30bb3a192329e7f2ab Author: Dave Reisner <dreisner(a)archlinux.org> Date: Sun Sep 15 08:10:36 2019 -0400 consolidate error reporting within generation pipeline ----------------------------------------------------------------------- Summary of changes: mkinitcpio | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 25-11-gb43739e
by grazzolini＠archlinux.org 04 Oct '19

04 Oct '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated discards bc41c8b3c51263e52ff21f5ff52fce5c778a35d9 (commit) via b43739e39d9287baaec131f176a350736bffda4d (commit) via 60713cf838baeaa59b71788aaa0fb421b0ecbcd5 (commit) via 7984722e127d411d2c978eaa9665709b4a681485 (commit) via 001a0559cd52d2ab600e31d192198062021e8898 (commit) via 66ab66ebccfc66a8d3afd6f331b4548f6cd973a7 (commit) This update added new revisions after undoing existing revisions. That is to say, the old revision is not a strict subset of the new revision. This situation occurs when you --force push a change and generate a repository containing something like this: * -- * -- B -- O -- O -- O (bc41c8b3c51263e52ff21f5ff52fce5c778a35d9) \ N -- N -- N (b43739e39d9287baaec131f176a350736bffda4d) When this happens we assume that you've already had alert emails for all of the O revisions, and so we here report only the revisions in the N branch from the common base, B. Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b43739e39d9287baaec131f176a350736bffda4d Merge: 06bc15f 60713cf Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Fri Oct 4 14:30:03 2019 -0300 Merge branch 'Foxboron-morten/hookdir-flag' commit 60713cf838baeaa59b71788aaa0fb421b0ecbcd5 Author: Giancarlo Razzolini <grazzolini(a)archlinux.org> Date: Fri Oct 4 14:28:08 2019 -0300 * Fix whitespace commit 7984722e127d411d2c978eaa9665709b4a681485 Author: Morten Linderud <morten(a)linderud.pw> Date: Tue Sep 17 21:42:02 2019 +0200 [mkinitcpio] Fixup declaration and remove trailing : commit 001a0559cd52d2ab600e31d192198062021e8898 Author: Morten Linderud <morten(a)linderud.pw> Date: Tue Sep 17 20:01:28 2019 +0200 [mkinitcpio] Support multiple hook paths commit 66ab66ebccfc66a8d3afd6f331b4548f6cd973a7 Author: Morten Linderud <morten(a)linderud.pw> Date: Tue Sep 10 22:54:25 2019 +0200 Add flag to specify where to look for hooks. ----------------------------------------------------------------------- Summary of changes: man/mkinitcpio.8.txt | 5 ++++- mkinitcpio | 12 ++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [namcap] [PATCH] Add RUNPATH rule
by Jelle van der Waa 29 Sep '19

29 Sep '19

From: Jelle van der Waa <jelle(a)vdwaa.nl> Include a rule to check for vulnerable RUNPATH ELF binary entries, which allow arbitrary code execution by loading shared libraries from an attacker controller path. --- Namcap/rules/__init__.py | 1 + Namcap/rules/runpath.py | 71 ++++++++++++++++++++++++++++++++++++++++ namcap-tags | 1 + namcap.1 | 3 ++ 4 files changed, 76 insertions(+) create mode 100644 Namcap/rules/runpath.py diff --git a/Namcap/rules/__init__.py b/Namcap/rules/__init__.py index 525dbc6..ee400e2 100644 --- a/Namcap/rules/__init__.py +++ b/Namcap/rules/__init__.py @@ -44,6 +44,7 @@ from . import ( permissions, py_mtime, rpath, + runpath, scrollkeeper, shebangdepends, sodepends, diff --git a/Namcap/rules/runpath.py b/Namcap/rules/runpath.py new file mode 100644 index 0000000..053923e --- /dev/null +++ b/Namcap/rules/runpath.py @@ -0,0 +1,71 @@ +# namcap rules - runpath +# +# Copyright (C) 2019 Jelle van der Waa <jelle(a)archlinux.org> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + +from Namcap.util import is_elf +from Namcap.ruleclass import TarballRule + +from elftools.elf.elffile import ELFFile +from elftools.elf.dynamic import DynamicSection + +allowed = ('/usr/lib', '/usr/lib32', '/lib', '$ORIGIN', '${ORIGIN}') +allowed_toplevels = (s + '/' for s in allowed) +warn = ['/usr/local/lib'] + + +def get_runpaths(fileobj): + elffile = ELFFile(fileobj) + for section in elffile.iter_sections(): + if not isinstance(section, DynamicSection): + continue + for tag in section.iter_tags(): + if tag.entry.d_tag != 'DT_RUNPATH': + continue + for path in tag.runpath.split(':'): + yield path + + +class package(TarballRule): + name = "runpath" + description = "Verifies if RUNPATH is secure" + + def analyze(self, pkgingo, tar): + for entry in tar: + if not entry.isfile(): + continue + + fileobj = tar.extractfile(entry) + if not is_elf(fileobj): + continue + + for path in get_runpaths(fileobj): + path_ok = path in allowed + for allowed_toplevel in allowed_toplevels: + if path.startswith(allowed_toplevel): + path_ok = True + + if not path_ok: + self.errors.append(("insecure-runpath %s %s", + (path, entry.name))) + break + + if path in warn and entry.name not in insecure_rpaths: + self.warnings.append(("insecure-runpath %s %s", + (path, entry.name))) + + +# vim: set ts=4 sw=4 noet: diff --git a/namcap-tags b/namcap-tags index 84cc3f7..1f7bc69 100644 --- a/namcap-tags +++ b/namcap-tags @@ -44,6 +44,7 @@ incorrect-owner %s (%s:%s) :: File (%s) is owned by %s:%s invalid-filename :: File name %s contains non standard characters info-dir-file-present %s :: Info directory file (%s) should not be present insecure-rpath %s %s :: Insecure RPATH '%s' in file ('%s') +insecure-runpath %s %s :: Insecure RUNPATH '%s' in file ('%s') libtool-file-present %s :: File (%s) is a libtool file library-no-package-associated %s :: Referenced library '%s' is an uninstalled dependency link-level-dependence %s in %s :: Link-level dependence (%s) in file %s diff --git a/namcap.1 b/namcap.1 index fcea8ed..9243087 100644 --- a/namcap.1 +++ b/namcap.1 @@ -108,6 +108,9 @@ Checks basic file and and directory permissions. It returns warnings about worl .B rpath Gives an error if a binary has RPATH set to something other than /usr/lib .TP +.B runpath +Gives an error if a binary has RUNPATH set to something other than /usr/lib, /usr/lib32 +.TP .B scrollkeeper Verifies that there aren't any scrollkeeper directories .TP -- 2.23.0

1 0

[arch-projects] [devtools] [GIT] The official devtools repository branch bpiotrowski/debug deleted. 20171108-13-g73b9f7b
by Levente Polyak 28 Sep '19

28 Sep '19

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official devtools repository". The branch, bpiotrowski/debug has been deleted was 73b9f7bfccf277e45f921920cc53d1cfb1331ca7 - Log ----------------------------------------------------------------- 73b9f7bfccf277e45f921920cc53d1cfb1331ca7 commitpkg: Use printf format strings for messages about debug packages ----------------------------------------------------------------------- hooks/post-receive -- The official devtools repository

1 0