* [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2
2020-01-19 17:03 [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Peter Korsgaard
@ 2020-01-19 17:03 ` Peter Korsgaard
2020-01-20 0:26 ` Alistair Francis
` (2 more replies)
2020-01-19 17:03 ` [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312 Peter Korsgaard
` (4 subsequent siblings)
5 siblings, 3 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-01-19 17:03 UTC (permalink / raw)
To: buildroot
The 4.12.2 release brings a large number of fixes:
https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/
Including a number of security fixes:
XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
XSA-298: missing descriptor table limit checking in x86 PV emulation
(CVE-2019-18425)
XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
XSA-302: passed through PCI devices may corrupt host memory after
deassignment (CVE-2019-18424)
XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
(CVE-2019-18422)
XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
XSA-306: Device quarantine for alternate pci assignment methods
(CVE-2019-19579)
XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
XSA-308: VMX: VMentry failure with debug exceptions and blocked states
(CVE-2019-19583)
XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
XSA-310: Further issues with restartable PV type change operations
(CVE-2019-19580)
XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
(CVE-2019-19577)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
package/xen/xen.hash | 2 +-
package/xen/xen.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/xen/xen.hash b/package/xen/xen.hash
index a15bc7d852..ad6220d94b 100644
--- a/package/xen/xen.hash
+++ b/package/xen/xen.hash
@@ -1,3 +1,3 @@
# Locally computed
-sha256 5450a85497b84167df1d229b3ab98fb24ef4d6b0510dce522798c13c1b090159 xen-4.12.1.tar.gz
+sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
diff --git a/package/xen/xen.mk b/package/xen/xen.mk
index 167f0ad638..7eb2643343 100644
--- a/package/xen/xen.mk
+++ b/package/xen/xen.mk
@@ -4,7 +4,7 @@
#
################################################################################
-XEN_VERSION = 4.12.1
+XEN_VERSION = 4.12.2
XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
XEN_LICENSE = GPL-2.0
XEN_LICENSE_FILES = COPYING
--
2.20.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2
2020-01-19 17:03 ` [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2 Peter Korsgaard
@ 2020-01-20 0:26 ` Alistair Francis
2020-01-20 7:39 ` Peter Korsgaard
2020-03-05 20:25 ` Peter Korsgaard
2 siblings, 0 replies; 15+ messages in thread
From: Alistair Francis @ 2020-01-20 0:26 UTC (permalink / raw)
To: buildroot
On Mon, Jan 20, 2020 at 3:04 AM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> The 4.12.2 release brings a large number of fixes:
>
> https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/
>
> Including a number of security fixes:
>
> XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
> XSA-298: missing descriptor table limit checking in x86 PV emulation
> (CVE-2019-18425)
> XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
> XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
> XSA-302: passed through PCI devices may corrupt host memory after
> deassignment (CVE-2019-18424)
> XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
> (CVE-2019-18422)
> XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
> XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
> XSA-306: Device quarantine for alternate pci assignment methods
> (CVE-2019-19579)
> XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
> XSA-308: VMX: VMentry failure with debug exceptions and blocked states
> (CVE-2019-19583)
> XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
> XSA-310: Further issues with restartable PV type change operations
> (CVE-2019-19580)
> XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
> (CVE-2019-19577)
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> package/xen/xen.hash | 2 +-
> package/xen/xen.mk | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/package/xen/xen.hash b/package/xen/xen.hash
> index a15bc7d852..ad6220d94b 100644
> --- a/package/xen/xen.hash
> +++ b/package/xen/xen.hash
> @@ -1,3 +1,3 @@
> # Locally computed
> -sha256 5450a85497b84167df1d229b3ab98fb24ef4d6b0510dce522798c13c1b090159 xen-4.12.1.tar.gz
> +sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
> sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index 167f0ad638..7eb2643343 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -XEN_VERSION = 4.12.1
> +XEN_VERSION = 4.12.2
> XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
> XEN_LICENSE = GPL-2.0
> XEN_LICENSE_FILES = COPYING
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2
2020-01-19 17:03 ` [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2 Peter Korsgaard
2020-01-20 0:26 ` Alistair Francis
@ 2020-01-20 7:39 ` Peter Korsgaard
2020-03-05 20:25 ` Peter Korsgaard
2 siblings, 0 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-01-20 7:39 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> The 4.12.2 release brings a large number of fixes:
> https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/
> Including a number of security fixes:
> XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
> XSA-298: missing descriptor table limit checking in x86 PV emulation
> (CVE-2019-18425)
> XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
> XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
> XSA-302: passed through PCI devices may corrupt host memory after
> deassignment (CVE-2019-18424)
> XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
> (CVE-2019-18422)
> XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
> XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
> XSA-306: Device quarantine for alternate pci assignment methods
> (CVE-2019-19579)
> XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
> XSA-308: VMX: VMentry failure with debug exceptions and blocked states
> (CVE-2019-19583)
> XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
> XSA-310: Further issues with restartable PV type change operations
> (CVE-2019-19580)
> XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
> (CVE-2019-19577)
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2
2020-01-19 17:03 ` [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2 Peter Korsgaard
2020-01-20 0:26 ` Alistair Francis
2020-01-20 7:39 ` Peter Korsgaard
@ 2020-03-05 20:25 ` Peter Korsgaard
2 siblings, 0 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-03-05 20:25 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> The 4.12.2 release brings a large number of fixes:
> https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/
> Including a number of security fixes:
> XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
> XSA-298: missing descriptor table limit checking in x86 PV emulation
> (CVE-2019-18425)
> XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
> XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
> XSA-302: passed through PCI devices may corrupt host memory after
> deassignment (CVE-2019-18424)
> XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
> (CVE-2019-18422)
> XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
> XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
> XSA-306: Device quarantine for alternate pci assignment methods
> (CVE-2019-19579)
> XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
> XSA-308: VMX: VMentry failure with debug exceptions and blocked states
> (CVE-2019-19583)
> XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
> XSA-310: Further issues with restartable PV type change operations
> (CVE-2019-19580)
> XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
> (CVE-2019-19577)
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed to 2019.11.x, thanks.
For 2019.02.x I will instead bump to 4.11.3.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312
2020-01-19 17:03 [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Peter Korsgaard
2020-01-19 17:03 ` [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2 Peter Korsgaard
@ 2020-01-19 17:03 ` Peter Korsgaard
2020-01-20 0:28 ` Alistair Francis
` (2 more replies)
2020-01-20 0:23 ` [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Alistair Francis
` (3 subsequent siblings)
5 siblings, 3 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-01-19 17:03 UTC (permalink / raw)
To: buildroot
Fixes the following security issue:
XSA-312: arm: a CPU may speculate past the ERET instruction
For further details, see the advisory:
https://xenbits.xenproject.org/xsa/advisory-312.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
package/xen/xen.hash | 1 +
package/xen/xen.mk | 2 ++
2 files changed, 3 insertions(+)
diff --git a/package/xen/xen.hash b/package/xen/xen.hash
index ad6220d94b..672ba5cb8d 100644
--- a/package/xen/xen.hash
+++ b/package/xen/xen.hash
@@ -1,3 +1,4 @@
# Locally computed
sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
+sha256 9b2078d448e4815c9ddc6554bf869d64412dc787b1b94830a24e47df6a9f30e7 xsa312.patch
sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
diff --git a/package/xen/xen.mk b/package/xen/xen.mk
index 7eb2643343..d0c6bebe9d 100644
--- a/package/xen/xen.mk
+++ b/package/xen/xen.mk
@@ -6,6 +6,8 @@
XEN_VERSION = 4.12.2
XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
+XEN_PATCH = \
+ https://xenbits.xenproject.org/xsa/xsa312.patch
XEN_LICENSE = GPL-2.0
XEN_LICENSE_FILES = COPYING
XEN_DEPENDENCIES = host-acpica host-python
--
2.20.1
^ permalink raw reply related [flat|nested] 15+ messages in thread* [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312
2020-01-19 17:03 ` [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312 Peter Korsgaard
@ 2020-01-20 0:28 ` Alistair Francis
2020-01-20 7:39 ` Peter Korsgaard
2020-03-05 20:25 ` Peter Korsgaard
2 siblings, 0 replies; 15+ messages in thread
From: Alistair Francis @ 2020-01-20 0:28 UTC (permalink / raw)
To: buildroot
On Mon, Jan 20, 2020 at 3:04 AM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> Fixes the following security issue:
>
> XSA-312: arm: a CPU may speculate past the ERET instruction
>
> For further details, see the advisory:
>
> https://xenbits.xenproject.org/xsa/advisory-312.html
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> package/xen/xen.hash | 1 +
> package/xen/xen.mk | 2 ++
> 2 files changed, 3 insertions(+)
>
> diff --git a/package/xen/xen.hash b/package/xen/xen.hash
> index ad6220d94b..672ba5cb8d 100644
> --- a/package/xen/xen.hash
> +++ b/package/xen/xen.hash
> @@ -1,3 +1,4 @@
> # Locally computed
> sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
> +sha256 9b2078d448e4815c9ddc6554bf869d64412dc787b1b94830a24e47df6a9f30e7 xsa312.patch
> sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index 7eb2643343..d0c6bebe9d 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -6,6 +6,8 @@
>
> XEN_VERSION = 4.12.2
> XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
> +XEN_PATCH = \
> + https://xenbits.xenproject.org/xsa/xsa312.patch
> XEN_LICENSE = GPL-2.0
> XEN_LICENSE_FILES = COPYING
> XEN_DEPENDENCIES = host-acpica host-python
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312
2020-01-19 17:03 ` [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312 Peter Korsgaard
2020-01-20 0:28 ` Alistair Francis
@ 2020-01-20 7:39 ` Peter Korsgaard
2020-03-05 20:25 ` Peter Korsgaard
2 siblings, 0 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-01-20 7:39 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> Fixes the following security issue:
> XSA-312: arm: a CPU may speculate past the ERET instruction
> For further details, see the advisory:
> https://xenbits.xenproject.org/xsa/advisory-312.html
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312
2020-01-19 17:03 ` [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312 Peter Korsgaard
2020-01-20 0:28 ` Alistair Francis
2020-01-20 7:39 ` Peter Korsgaard
@ 2020-03-05 20:25 ` Peter Korsgaard
2 siblings, 0 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-03-05 20:25 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> Fixes the following security issue:
> XSA-312: arm: a CPU may speculate past the ERET instruction
> For further details, see the advisory:
> https://xenbits.xenproject.org/xsa/advisory-312.html
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
2020-01-19 17:03 [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Peter Korsgaard
2020-01-19 17:03 ` [Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2 Peter Korsgaard
2020-01-19 17:03 ` [Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312 Peter Korsgaard
@ 2020-01-20 0:23 ` Alistair Francis
2020-01-20 7:39 ` Peter Korsgaard
` (2 subsequent siblings)
5 siblings, 0 replies; 15+ messages in thread
From: Alistair Francis @ 2020-01-20 0:23 UTC (permalink / raw)
To: buildroot
On Mon, Jan 20, 2020 at 3:04 AM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> Fixes:
> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
>
> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> Security Kernel) security policy if it detects SELinux checkpolicy on the
> build machine.
>
> If enabled, a gen-policy.py python script is used to convert the binary
> FLASK policy to a C array initialization list to embed it in the Xen binary.
> Depending on the python version and locale available on the host, this fails
> with byte values outside the 0..255 range:
>
> policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
> 0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,
>
> To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
> disable the checkpolicy detection.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Alistair
> ---
> package/xen/xen.mk | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index b0dc2dfe4c..167f0ad638 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -26,6 +26,7 @@ XEN_MAKE_ENV = \
> XEN_TARGET_ARCH=$(XEN_ARCH) \
> CROSS_COMPILE=$(TARGET_CROSS) \
> HOST_EXTRACFLAGS="-Wno-error" \
> + XEN_HAS_CHECKPOLICY=n \
> $(TARGET_CONFIGURE_OPTS)
>
> ifeq ($(BR2_PACKAGE_XEN_HYPERVISOR),y)
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 15+ messages in thread* [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
2020-01-19 17:03 [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Peter Korsgaard
` (2 preceding siblings ...)
2020-01-20 0:23 ` [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Alistair Francis
@ 2020-01-20 7:39 ` Peter Korsgaard
2020-01-21 21:29 ` Arnout Vandecappelle
2020-03-05 20:21 ` Peter Korsgaard
5 siblings, 0 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-01-20 7:39 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> Fixes:
> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> Security Kernel) security policy if it detects SELinux checkpolicy on the
> build machine.
> If enabled, a gen-policy.py python script is used to convert the binary
> FLASK policy to a C array initialization list to embed it in the Xen binary.
> Depending on the python version and locale available on the host, this fails
> with byte values outside the 0..255 range:
> policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
> 0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,
> To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
> disable the checkpolicy detection.
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread* [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
2020-01-19 17:03 [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Peter Korsgaard
` (3 preceding siblings ...)
2020-01-20 7:39 ` Peter Korsgaard
@ 2020-01-21 21:29 ` Arnout Vandecappelle
2020-01-21 21:45 ` Peter Korsgaard
2020-03-05 20:21 ` Peter Korsgaard
5 siblings, 1 reply; 15+ messages in thread
From: Arnout Vandecappelle @ 2020-01-21 21:29 UTC (permalink / raw)
To: buildroot
On 19/01/2020 18:03, Peter Korsgaard wrote:
> Fixes:
> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
>
> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> Security Kernel) security policy if it detects SELinux checkpolicy on the
> build machine.
>
> If enabled, a gen-policy.py python script is used to convert the binary
> FLASK policy to a C array initialization list to embed it in the Xen binary.
> Depending on the python version and locale available on the host, this fails
The more appropriate thing to do would be to:
- set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
- do not set it when selinux is enabled, and depend on host-checkpolicy
- depend on host-python
- set LC_ALL=C
However, the latter two are already done. So except for incorrectly detecting
checkpolicy installed on the system, I wonder what is really triggering this
issue...
Regards,
Arnout
> with byte values outside the 0..255 range:
>
> policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
> 0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,
>
> To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
> disable the checkpolicy detection.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
> package/xen/xen.mk | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index b0dc2dfe4c..167f0ad638 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -26,6 +26,7 @@ XEN_MAKE_ENV = \
> XEN_TARGET_ARCH=$(XEN_ARCH) \
> CROSS_COMPILE=$(TARGET_CROSS) \
> HOST_EXTRACFLAGS="-Wno-error" \
> + XEN_HAS_CHECKPOLICY=n \
> $(TARGET_CONFIGURE_OPTS)
>
> ifeq ($(BR2_PACKAGE_XEN_HYPERVISOR),y)
>
^ permalink raw reply [flat|nested] 15+ messages in thread* [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
2020-01-21 21:29 ` Arnout Vandecappelle
@ 2020-01-21 21:45 ` Peter Korsgaard
2020-01-22 7:57 ` Arnout Vandecappelle
0 siblings, 1 reply; 15+ messages in thread
From: Peter Korsgaard @ 2020-01-21 21:45 UTC (permalink / raw)
To: buildroot
>>>>> "Arnout" == Arnout Vandecappelle <arnout@mind.be> writes:
> On 19/01/2020 18:03, Peter Korsgaard wrote:
>> Fixes:
>> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
>>
>> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
>> Security Kernel) security policy if it detects SELinux checkpolicy on the
>> build machine.
>>
>> If enabled, a gen-policy.py python script is used to convert the binary
>> FLASK policy to a C array initialization list to embed it in the Xen binary.
>> Depending on the python version and locale available on the host, this fails
> The more appropriate thing to do would be to:
> - set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
> - do not set it when selinux is enabled, and depend on host-checkpolicy
Yes, that can be done in the future by someone interested in xen with
XSM/selinux support.
> - depend on host-python
> - set LC_ALL=C
Hmm, where are we setting LC_ALL=C in the package build step?
> However, the latter two are already done. So except for incorrectly detecting
> checkpolicy installed on the system, I wonder what is really triggering this
> issue...
I was also unable to reproduce the issue locally, but given the > 255
byte values I assume it is related to locale. Looking at the issue I
noticed the invalid checkpolicy logic and that disabling it would get
rid of the entire code path.
But I am fine with people sending patches to improve it. I don't use Xen
myself, I only looked at the build issues while doing security support
and noticed they have been occuring for quite a long time.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
2020-01-21 21:45 ` Peter Korsgaard
@ 2020-01-22 7:57 ` Arnout Vandecappelle
0 siblings, 0 replies; 15+ messages in thread
From: Arnout Vandecappelle @ 2020-01-22 7:57 UTC (permalink / raw)
To: buildroot
On 21/01/2020 22:45, Peter Korsgaard wrote:
>>>>>> "Arnout" == Arnout Vandecappelle <arnout@mind.be> writes:
>
> > On 19/01/2020 18:03, Peter Korsgaard wrote:
> >> Fixes:
> >> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
> >>
> >> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> >> Security Kernel) security policy if it detects SELinux checkpolicy on the
> >> build machine.
> >>
> >> If enabled, a gen-policy.py python script is used to convert the binary
> >> FLASK policy to a C array initialization list to embed it in the Xen binary.
> >> Depending on the python version and locale available on the host, this fails
>
> > The more appropriate thing to do would be to:
>
> > - set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
> > - do not set it when selinux is enabled, and depend on host-checkpolicy
>
> Yes, that can be done in the future by someone interested in xen with
> XSM/selinux support.
>
>
> > - depend on host-python
> > - set LC_ALL=C
>
> Hmm, where are we setting LC_ALL=C in the package build step?
Ugh, I grepped for it and I saw it, but now it vanished :-)
Regards,
Arnout
> > However, the latter two are already done. So except for incorrectly detecting
> > checkpolicy installed on the system, I wonder what is really triggering this
> > issue...
>
> I was also unable to reproduce the issue locally, but given the > 255
> byte values I assume it is related to locale. Looking at the issue I
> noticed the invalid checkpolicy logic and that disabling it would get
> rid of the entire code path.
>
> But I am fine with people sending patches to improve it. I don't use Xen
> myself, I only looked at the build issues while doing security support
> and noticed they have been occuring for quite a long time.
>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic
2020-01-19 17:03 [Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic Peter Korsgaard
` (4 preceding siblings ...)
2020-01-21 21:29 ` Arnout Vandecappelle
@ 2020-03-05 20:21 ` Peter Korsgaard
5 siblings, 0 replies; 15+ messages in thread
From: Peter Korsgaard @ 2020-03-05 20:21 UTC (permalink / raw)
To: buildroot
>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
> Fixes:
> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> Security Kernel) security policy if it detects SELinux checkpolicy on the
> build machine.
> If enabled, a gen-policy.py python script is used to convert the binary
> FLASK policy to a C array initialization list to embed it in the Xen binary.
> Depending on the python version and locale available on the host, this fails
> with byte values outside the 0..255 range:
> policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
> 0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,
> To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
> disable the checkpolicy detection.
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Committed to 2019.02.x and 2019.11.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 15+ messages in thread