Skip to content

Commit f6aa123

Browse files
jslobodzianjslobodzian
committed
Merge branch '3.0-dev' into 3.0
2 parents 47307a2 + 07c7a6f commit f6aa123

78 files changed

Lines changed: 2001 additions & 5073 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎SPECS-SIGNED/kernel-signed/kernel-signed.spec‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for %{buildarch} systems
1111
Name: kernel-signed-%{buildarch}
12-
Version: 6.6.56.1
13-
Release: 5%{?dist}
12+
Version: 6.6.57.1
13+
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
1616
Distribution: Azure Linux
@@ -145,6 +145,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
145145
%exclude /module_info.ld
146146

147147
%changelog
148+
* Tue Oct 29 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.57.1-1
149+
- Auto-upgrade to 6.6.57.1
150+
148151
* Thu Oct 24 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.56.1-5
149152
- Bump release to match kernel
150153

‎SPECS-SIGNED/kernel-uki-signed/kernel-uki-signed.spec‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
%define kernelver %{version}-%{release}
66
Summary: Signed Unified Kernel Image for %{buildarch} systems
77
Name: kernel-uki-signed-%{buildarch}
8-
Version: 6.6.56.1
9-
Release: 5%{?dist}
8+
Version: 6.6.57.1
9+
Release: 1%{?dist}
1010
License: GPLv2
1111
Vendor: Microsoft Corporation
1212
Distribution: Azure Linux
@@ -68,6 +68,9 @@ popd
6868
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi
6969

7070
%changelog
71+
* Tue Oct 29 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.57.1-1
72+
- Auto-upgrade to 6.6.57.1
73+
7174
* Thu Oct 24 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.56.1-5
7275
- Bump release to match kernel
7376

‎SPECS/avahi/CVE-2023-1981.patch‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
From a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
3+
Date: Thu, 17 Nov 2022 01:51:53 +0100
4+
Subject: [PATCH] Emit error if requested service is not found
5+
6+
It currently just crashes instead of replying with error. Check return
7+
value and emit error instead of passing NULL pointer to reply.
8+
9+
Fixes #375
10+
---
11+
avahi-daemon/dbus-protocol.c | 20 ++++++++++++++------
12+
1 file changed, 14 insertions(+), 6 deletions(-)
13+
14+
diff --git a/avahi-daemon/dbus-protocol.c b/avahi-daemon/dbus-protocol.c
15+
index 70d7687b..406d0b44 100644
16+
--- a/avahi-daemon/dbus-protocol.c
17+
+++ b/avahi-daemon/dbus-protocol.c
18+
@@ -375,10 +375,14 @@ static DBusHandlerResult dbus_get_alternative_host_name(DBusConnection *c, DBusM
19+
}
20+
21+
t = avahi_alternative_host_name(n);
22+
- avahi_dbus_respond_string(c, m, t);
23+
- avahi_free(t);
24+
+ if (t) {
25+
+ avahi_dbus_respond_string(c, m, t);
26+
+ avahi_free(t);
27+
28+
- return DBUS_HANDLER_RESULT_HANDLED;
29+
+ return DBUS_HANDLER_RESULT_HANDLED;
30+
+ } else {
31+
+ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Hostname not found");
32+
+ }
33+
}
34+
35+
static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DBusMessage *m, DBusError *error) {
36+
@@ -389,10 +393,14 @@ static DBusHandlerResult dbus_get_alternative_service_name(DBusConnection *c, DB
37+
}
38+
39+
t = avahi_alternative_service_name(n);
40+
- avahi_dbus_respond_string(c, m, t);
41+
- avahi_free(t);
42+
+ if (t) {
43+
+ avahi_dbus_respond_string(c, m, t);
44+
+ avahi_free(t);
45+
46+
- return DBUS_HANDLER_RESULT_HANDLED;
47+
+ return DBUS_HANDLER_RESULT_HANDLED;
48+
+ } else {
49+
+ return avahi_dbus_respond_error(c, m, AVAHI_ERR_NOT_FOUND, "Service not found");
50+
+ }
51+
}
52+
53+
static DBusHandlerResult dbus_create_new_entry_group(DBusConnection *c, DBusMessage *m, DBusError *error) {

‎SPECS/avahi/avahi.spec‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Local network service discovery
44
Name: avahi
55
Version: 0.8
6-
Release: 2%{?dist}
6+
Release: 3%{?dist}
77
License: LGPLv2+
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -12,6 +12,7 @@ Source0: https://github.com/lathiat/avahi/releases/download/v%{version}/%
1212
Patch0: %{name}-libevent-pc-fix.patch
1313
Patch1: CVE-2021-3468.patch
1414
Patch2: CVE-2021-3502.patch
15+
Patch3: CVE-2023-1981.patch
1516
BuildRequires: automake
1617
BuildRequires: dbus-devel >= 0.90
1718
BuildRequires: dbus-glib-devel >= 0.70
@@ -214,6 +215,9 @@ NOCONFIGURE=1 ./autogen.sh
214215
--disable-gtk \
215216
--disable-gtk3 \
216217
--disable-mono \
218+
%if 0%{?with_check}
219+
--enable-tests \
220+
%endif
217221
;
218222

219223
# workaround parallel build issues (aarch64 only so far, bug #1564553)
@@ -258,6 +262,7 @@ rm -fv %{buildroot}%{_datadir}/avahi/interfaces/avahi-discover.ui
258262

259263

260264
%check
265+
%make_build -k V=1 check || make check V=1
261266

262267
%pre
263268
getent group avahi >/dev/null || groupadd -f -g 70 -r avahi
@@ -415,6 +420,9 @@ exit 0
415420
%endif
416421

417422
%changelog
423+
* Tue Oct 29 2024 Daniel McIlvaney <damcilva@microsoft.com> - 0.8-3
424+
- Fix CVE-2023-1981 with an upstream patch, enable basic check section
425+
418426
* Wed Aug 14 2024 Chris Co <chrco@microsoft.com> - 0.8-2
419427
- Remove libssp from build environment to fix avahi-daemon hang
420428

‎SPECS/dracut/0014-fix-systemd-pcrphase-in-hostonly-mode-do-not-try-to-include-systemd-pcrphase.patch‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
From 96d153fe927987ce31a1f876b7eeea6fe9cee06a Mon Sep 17 00:00:00 2001
2+
From: Laszlo Gombos <laszlo.gombos@gmail.com>
3+
Date: Thu, 30 May 2024 10:06:04 -0400
4+
Subject: [PATCH] fix(systemd-pcrphase): in hostonly mode do not try to include
5+
systemd-pcrphase
6+
7+
---
8+
modules.d/01systemd-pcrphase/module-setup.sh | 11 +++++------
9+
1 file changed, 5 insertions(+), 6 deletions(-)
10+
11+
diff --git a/modules.d/01systemd-pcrphase/module-setup.sh b/modules.d/01systemd-pcrphase/module-setup.sh
12+
index eb8520799..922711709 100755
13+
--- a/modules.d/01systemd-pcrphase/module-setup.sh
14+
+++ b/modules.d/01systemd-pcrphase/module-setup.sh
15+
@@ -4,7 +4,6 @@
16+
17+
# Prerequisite check(s) for module.
18+
check() {
19+
-
20+
# If the binary(s) requirements are not fulfilled the module can't be installed.
21+
# systemd-255 renamed the binary, check for old and new location.
22+
if ! require_binaries "$systemdutildir"/systemd-pcrphase \
23+
@@ -12,23 +11,24 @@ check() {
24+
return 1
25+
fi
26+
27+
- return 0
28+
+ if [[ $hostonly ]]; then
29+
+ return 255
30+
+ fi
31+
32+
+ return 0
33+
}
34+
35+
# Module dependency requirements.
36+
depends() {
37+
-
38+
# This module has external dependency on other module(s).
39+
echo systemd tpm2-tss
40+
+
41+
# Return 0 to include the dependent module(s) in the initramfs.
42+
return 0
43+
-
44+
}
45+
46+
# Install the required file(s) and directories for the module in the initramfs.
47+
install() {
48+
-
49+
inst_multiple -o \
50+
"$systemdutildir"/systemd-pcrphase \
51+
"$systemdutildir"/systemd-pcrextend \
52+
@@ -43,5 +43,4 @@ install() {
53+
"$systemdsystemconfdir/systemd-pcrphase-initrd.service.d/*.conf" \
54+
"$systemdsystemconfdir"/initrd.target.wants/systemd-pcrphase-initrd.service
55+
fi
56+
-
57+
}

‎SPECS/dracut/0015-fix-systemd-pcrphase-make-tpm2-tss-an-optional-dependency.patch‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From a2193b71f7be75f719eec29faacae36ab25e9147 Mon Sep 17 00:00:00 2001
2+
From: Laszlo Gombos <laszlo.gombos@gmail.com>
3+
Date: Fri, 5 Jul 2024 14:17:00 -0400
4+
Subject: [PATCH] fix(systemd-pcrphase): make tpm2-tss an optional dependency
5+
6+
---
7+
modules.d/01systemd-pcrphase/module-setup.sh | 12 +++++++++++-
8+
1 file changed, 11 insertions(+), 1 deletion(-)
9+
10+
diff --git a/modules.d/01systemd-pcrphase/module-setup.sh b/modules.d/01systemd-pcrphase/module-setup.sh
11+
index 922711709..3016d7e44 100755
12+
--- a/modules.d/01systemd-pcrphase/module-setup.sh
13+
+++ b/modules.d/01systemd-pcrphase/module-setup.sh
14+
@@ -21,7 +21,17 @@ check() {
15+
# Module dependency requirements.
16+
depends() {
17+
# This module has external dependency on other module(s).
18+
- echo systemd tpm2-tss
19+
+
20+
+ local deps
21+
+ deps="systemd"
22+
+
23+
+ # optional dependencies
24+
+ module="tpm2-tss"
25+
+ module_check $module > /dev/null 2>&1
26+
+ if [[ $? == 255 ]]; then
27+
+ deps+=" $module"
28+
+ fi
29+
+ echo "$deps"
30+
31+
# Return 0 to include the dependent module(s) in the initramfs.
32+
return 0

‎SPECS/dracut/dracut.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: dracut to create initramfs
55
Name: dracut
66
Version: 102
7-
Release: 5%{?dist}
7+
Release: 6%{?dist}
88
# The entire source code is GPLv2+
99
# except install/* which is LGPLv2+
1010
License: GPLv2+ AND LGPLv2+
@@ -34,6 +34,8 @@ Patch: 0006-dracut.sh-validate-instmods-calls.patch
3434
Patch: 0011-Remove-reference-to-kernel-module-zlib-in-fips-module.patch
3535
Patch: 0012-fix-dracut-functions-avoid-awk-in-get_maj_min.patch
3636
Patch: 0013-revert-fix-crypt-unlock-encrypted-devices-by-default.patch
37+
Patch: 0014-fix-systemd-pcrphase-in-hostonly-mode-do-not-try-to-include-systemd-pcrphase.patch
38+
Patch: 0015-fix-systemd-pcrphase-make-tpm2-tss-an-optional-dependency.patch
3739

3840
BuildRequires: bash
3941
BuildRequires: kmod-devel
@@ -288,6 +290,9 @@ ln -srv %{buildroot}%{_bindir}/%{name} %{buildroot}%{_sbindir}/%{name}
288290
%dir %{_sharedstatedir}/%{name}/overlay
289291

290292
%changelog
293+
* Thu Oct 10 2024 Thien Trung Vuong <tvuong@microsoft.com> - 102-6
294+
- Add patch to make tpm2-tss an optional dependency for systemd-pcrphase
295+
291296
* Sun Oct 06 2024 Jon Slobodzian <joslobo@microsoft.com> - 102-5
292297
- Bump version to build with latest systemd
293298

‎SPECS/ebtables/ebtables.spec‎

Lines changed: 6 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Name: ebtables
44
Version: 2.0.11
5-
Release: 9%{?dist}
5+
Release: 8%{?dist}
66
Summary: Ethernet Bridge frame table administration tool
77
License: GPLv2+
88
URL: http://ebtables.sourceforge.net/
@@ -35,9 +35,6 @@ like iptables. There are no known incompatibility issues.
3535

3636
%package legacy
3737
Summary: Legacy user space tool to configure bridge netfilter rules in kernel
38-
Requires(post): %{_sbindir}/update-alternatives
39-
Requires(post): %{_bindir}/readlink
40-
Requires(postun): %{_sbindir}/update-alternatives
4138
Provides: ebtables
4239

4340
%description legacy
@@ -93,22 +90,10 @@ rm %{buildroot}/%{_libdir}/libebtc.la
9390
# Drop these binaries (for now at least)
9491
rm %{buildroot}/%{_sbindir}/ebtables{d,u}
9592

96-
# Prepare for Alternatives system
97-
touch %{buildroot}%{_sbindir}/ebtables
98-
touch %{buildroot}%{_sbindir}/ebtables-save
99-
touch %{buildroot}%{_sbindir}/ebtables-restore
100-
101-
%post legacy
102-
pfx=%{_sbindir}/ebtables
103-
%{_sbindir}/update-alternatives --install %{_sbindir}/%{name} %{name} %{_sbindir}/%{name}-legacy 10000 \
104-
--slave %{_sbindir}/%{name}-save %{name}-save %{_sbindir}/%{name}-legacy-save \
105-
--slave %{_sbindir}/%{name}-restore %{name}-restore %{_sbindir}/%{name}-legacy-restore
106-
107-
%postun legacy
108-
if [ $1 -eq 0 ]; then
109-
%{_sbindir}/update-alternatives --remove \
110-
%{name} %{_sbindir}/%{name}-legacy
111-
fi
93+
# Symlink ebtables-legacy to ebtables
94+
ln -sf ebtables-legacy %{buildroot}%{_sbindir}/ebtables
95+
ln -sf ebtables-legacy-save %{buildroot}%{_sbindir}/ebtables-save
96+
ln -sf ebtables-legacy-restore %{buildroot}%{_sbindir}/ebtables-restore
11297

11398
%post services
11499
%systemd_post ebtables.service
@@ -123,10 +108,10 @@ fi
123108
%license COPYING
124109
%doc ChangeLog THANKS
125110
%{_sbindir}/ebtables-legacy*
111+
%{_sbindir}/ebtables*
126112
%{_mandir}/*/ebtables-legacy*
127113
%{_libdir}/libebtc.so*
128114
%{_sysconfdir}/ethertypes
129-
%ghost %{_sbindir}/ebtables{,-save,-restore}
130115

131116
%files services
132117
%{_unitdir}/ebtables.service
@@ -135,9 +120,6 @@ fi
135120
%ghost %{_sysconfdir}/sysconfig/ebtables
136121

137122
%changelog
138-
* Mon Oct 21 2024 Sumedh Sharma <sumsharma@microsoft.com> - 2.0.11-9
139-
- introduce alternatives for legacy
140-
141123
* Tue Sep 03 2024 Neha Agarwal <nehaagarwal@microsoft.com> - 2.0.11-8
142124
- Add missing Vendor and Distribution tags.
143125

0 commit comments

Comments
 (0)