[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Peter Korsgaard]

Fixes:
http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde

The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
Security Kernel) security policy if it detects SELinux checkpolicy on the
build machine.

If enabled, a gen-policy.py python script is used to convert the binary
FLASK policy to a C array initialization list to embed it in the Xen binary.
Depending on the python version and locale available on the host, this fails
with byte values outside the 0..255 range:

policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
  0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,

To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
disable the checkpolicy detection.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/xen/xen.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/package/xen/xen.mk b/package/xen/xen.mk
index b0dc2dfe4c..167f0ad638 100644
--- a/package/xen/xen.mk
+++ b/package/xen/xen.mk
@@ -26,6 +26,7 @@ XEN_MAKE_ENV = \
 	XEN_TARGET_ARCH=$(XEN_ARCH) \
 	CROSS_COMPILE=$(TARGET_CROSS) \
 	HOST_EXTRACFLAGS="-Wno-error" \
+	XEN_HAS_CHECKPOLICY=n \
 	$(TARGET_CONFIGURE_OPTS)
 
 ifeq ($(BR2_PACKAGE_XEN_HYPERVISOR),y)
-- 
2.20.1

[Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2

[Peter Korsgaard]

The 4.12.2 release brings a large number of fixes:

https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/

Including a number of security fixes:

XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
XSA-298: missing descriptor table limit checking in x86 PV emulation
	 (CVE-2019-18425)
XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
XSA-302: passed through PCI devices may corrupt host memory after
         deassignment (CVE-2019-18424)
XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
	 (CVE-2019-18422)
XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
XSA-306: Device quarantine for alternate pci assignment methods
	 (CVE-2019-19579)
XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
XSA-308: VMX: VMentry failure with debug exceptions and blocked states
	 (CVE-2019-19583)
XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
XSA-310: Further issues with restartable PV type change operations
	 (CVE-2019-19580)
XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
	 (CVE-2019-19577)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/xen/xen.hash | 2 +-
 package/xen/xen.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/xen/xen.hash b/package/xen/xen.hash
index a15bc7d852..ad6220d94b 100644
--- a/package/xen/xen.hash
+++ b/package/xen/xen.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256 5450a85497b84167df1d229b3ab98fb24ef4d6b0510dce522798c13c1b090159 xen-4.12.1.tar.gz
+sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
 sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
diff --git a/package/xen/xen.mk b/package/xen/xen.mk
index 167f0ad638..7eb2643343 100644
--- a/package/xen/xen.mk
+++ b/package/xen/xen.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-XEN_VERSION = 4.12.1
+XEN_VERSION = 4.12.2
 XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
 XEN_LICENSE = GPL-2.0
 XEN_LICENSE_FILES = COPYING
-- 
2.20.1

[Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312

[Peter Korsgaard]

Fixes the following security issue:

XSA-312: arm: a CPU may speculate past the ERET instruction

For further details, see the advisory:

https://xenbits.xenproject.org/xsa/advisory-312.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/xen/xen.hash | 1 +
 package/xen/xen.mk   | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/package/xen/xen.hash b/package/xen/xen.hash
index ad6220d94b..672ba5cb8d 100644
--- a/package/xen/xen.hash
+++ b/package/xen/xen.hash
@@ -1,3 +1,4 @@
 # Locally computed
 sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
+sha256 9b2078d448e4815c9ddc6554bf869d64412dc787b1b94830a24e47df6a9f30e7 xsa312.patch
 sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
diff --git a/package/xen/xen.mk b/package/xen/xen.mk
index 7eb2643343..d0c6bebe9d 100644
--- a/package/xen/xen.mk
+++ b/package/xen/xen.mk
@@ -6,6 +6,8 @@
 
 XEN_VERSION = 4.12.2
 XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
+XEN_PATCH = \
+	https://xenbits.xenproject.org/xsa/xsa312.patch
 XEN_LICENSE = GPL-2.0
 XEN_LICENSE_FILES = COPYING
 XEN_DEPENDENCIES = host-acpica host-python
-- 
2.20.1

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Alistair Francis]

On Mon, Jan 20, 2020 at 3:04 AM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> Fixes:
> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
>
> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> Security Kernel) security policy if it detects SELinux checkpolicy on the
> build machine.
>
> If enabled, a gen-policy.py python script is used to convert the binary
> FLASK policy to a C array initialization list to embed it in the Xen binary.
> Depending on the python version and locale available on the host, this fails
> with byte values outside the 0..255 range:
>
> policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
>   0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,
>
> To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
> disable the checkpolicy detection.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  package/xen/xen.mk | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index b0dc2dfe4c..167f0ad638 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -26,6 +26,7 @@ XEN_MAKE_ENV = \
>         XEN_TARGET_ARCH=$(XEN_ARCH) \
>         CROSS_COMPILE=$(TARGET_CROSS) \
>         HOST_EXTRACFLAGS="-Wno-error" \
> +       XEN_HAS_CHECKPOLICY=n \
>         $(TARGET_CONFIGURE_OPTS)
>
>  ifeq ($(BR2_PACKAGE_XEN_HYPERVISOR),y)
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

[Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2

[Alistair Francis]

On Mon, Jan 20, 2020 at 3:04 AM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> The 4.12.2 release brings a large number of fixes:
>
> https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/
>
> Including a number of security fixes:
>
> XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
> XSA-298: missing descriptor table limit checking in x86 PV emulation
>          (CVE-2019-18425)
> XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
> XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
> XSA-302: passed through PCI devices may corrupt host memory after
>          deassignment (CVE-2019-18424)
> XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
>          (CVE-2019-18422)
> XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
> XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
> XSA-306: Device quarantine for alternate pci assignment methods
>          (CVE-2019-19579)
> XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
> XSA-308: VMX: VMentry failure with debug exceptions and blocked states
>          (CVE-2019-19583)
> XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
> XSA-310: Further issues with restartable PV type change operations
>          (CVE-2019-19580)
> XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
>          (CVE-2019-19577)
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  package/xen/xen.hash | 2 +-
>  package/xen/xen.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/package/xen/xen.hash b/package/xen/xen.hash
> index a15bc7d852..ad6220d94b 100644
> --- a/package/xen/xen.hash
> +++ b/package/xen/xen.hash
> @@ -1,3 +1,3 @@
>  # Locally computed
> -sha256 5450a85497b84167df1d229b3ab98fb24ef4d6b0510dce522798c13c1b090159 xen-4.12.1.tar.gz
> +sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
>  sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index 167f0ad638..7eb2643343 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>
> -XEN_VERSION = 4.12.1
> +XEN_VERSION = 4.12.2
>  XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
>  XEN_LICENSE = GPL-2.0
>  XEN_LICENSE_FILES = COPYING
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

[Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312

[Alistair Francis]

On Mon, Jan 20, 2020 at 3:04 AM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> Fixes the following security issue:
>
> XSA-312: arm: a CPU may speculate past the ERET instruction
>
> For further details, see the advisory:
>
> https://xenbits.xenproject.org/xsa/advisory-312.html
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  package/xen/xen.hash | 1 +
>  package/xen/xen.mk   | 2 ++
>  2 files changed, 3 insertions(+)
>
> diff --git a/package/xen/xen.hash b/package/xen/xen.hash
> index ad6220d94b..672ba5cb8d 100644
> --- a/package/xen/xen.hash
> +++ b/package/xen/xen.hash
> @@ -1,3 +1,4 @@
>  # Locally computed
>  sha256 1c75cbe728dfabf02b7f9a17ce96ee7d202d2fd4b4689490018d3a28b63f9fa3 xen-4.12.2.tar.gz
> +sha256 9b2078d448e4815c9ddc6554bf869d64412dc787b1b94830a24e47df6a9f30e7 xsa312.patch
>  sha256 dba0d79260259c013c52e5d4daeaea564a2fbb9ff7fc6778c377a401ec3898de COPYING
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index 7eb2643343..d0c6bebe9d 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -6,6 +6,8 @@
>
>  XEN_VERSION = 4.12.2
>  XEN_SITE = https://downloads.xenproject.org/release/xen/$(XEN_VERSION)
> +XEN_PATCH = \
> +       https://xenbits.xenproject.org/xsa/xsa312.patch
>  XEN_LICENSE = GPL-2.0
>  XEN_LICENSE_FILES = COPYING
>  XEN_DEPENDENCIES = host-acpica host-python
> --
> 2.20.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes:
 > http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde

 > The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
 > Security Kernel) security policy if it detects SELinux checkpolicy on the
 > build machine.

 > If enabled, a gen-policy.py python script is used to convert the binary
 > FLASK policy to a C array initialization list to embed it in the Xen binary.
 > Depending on the python version and locale available on the host, this fails
 > with byte values outside the 0..255 range:

 > policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
 >   0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,

 > To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
 > disable the checkpolicy detection.

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > The 4.12.2 release brings a large number of fixes:
 > https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/

 > Including a number of security fixes:

 > XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
 > XSA-298: missing descriptor table limit checking in x86 PV emulation
 > 	 (CVE-2019-18425)
 > XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
 > XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
 > XSA-302: passed through PCI devices may corrupt host memory after
 >          deassignment (CVE-2019-18424)
 > XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
 > 	 (CVE-2019-18422)
 > XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
 > XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
 > XSA-306: Device quarantine for alternate pci assignment methods
 > 	 (CVE-2019-19579)
 > XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
 > XSA-308: VMX: VMentry failure with debug exceptions and blocked states
 > 	 (CVE-2019-19583)
 > XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
 > XSA-310: Further issues with restartable PV type change operations
 > 	 (CVE-2019-19580)
 > XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
 > 	 (CVE-2019-19577)

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security issue:
 > XSA-312: arm: a CPU may speculate past the ERET instruction

 > For further details, see the advisory:

 > https://xenbits.xenproject.org/xsa/advisory-312.html

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Arnout Vandecappelle]

On 19/01/2020 18:03, Peter Korsgaard wrote:
> Fixes:
> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
> 
> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
> Security Kernel) security policy if it detects SELinux checkpolicy on the
> build machine.
> 
> If enabled, a gen-policy.py python script is used to convert the binary
> FLASK policy to a C array initialization list to embed it in the Xen binary.
> Depending on the python version and locale available on the host, this fails

 The more appropriate thing to do would be to:

- set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
- do not set it when selinux is enabled, and depend on host-checkpolicy
- depend on host-python
- set LC_ALL=C

 However, the latter two are already done. So except for incorrectly detecting
checkpolicy installed on the system, I wonder what is really triggering this
issue...

 Regards,
 Arnout


> with byte values outside the 0..255 range:
> 
> policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
>   0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,
> 
> To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
> disable the checkpolicy detection.
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
>  package/xen/xen.mk | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/package/xen/xen.mk b/package/xen/xen.mk
> index b0dc2dfe4c..167f0ad638 100644
> --- a/package/xen/xen.mk
> +++ b/package/xen/xen.mk
> @@ -26,6 +26,7 @@ XEN_MAKE_ENV = \
>  	XEN_TARGET_ARCH=$(XEN_ARCH) \
>  	CROSS_COMPILE=$(TARGET_CROSS) \
>  	HOST_EXTRACFLAGS="-Wno-error" \
> +	XEN_HAS_CHECKPOLICY=n \
>  	$(TARGET_CONFIGURE_OPTS)
>  
>  ifeq ($(BR2_PACKAGE_XEN_HYPERVISOR),y)
> 

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Peter Korsgaard]

>>>>> "Arnout" == Arnout Vandecappelle <arnout@mind.be> writes:

 > On 19/01/2020 18:03, Peter Korsgaard wrote:
 >> Fixes:
 >> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
 >> 
 >> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
 >> Security Kernel) security policy if it detects SELinux checkpolicy on the
 >> build machine.
 >> 
 >> If enabled, a gen-policy.py python script is used to convert the binary
 >> FLASK policy to a C array initialization list to embed it in the Xen binary.
 >> Depending on the python version and locale available on the host, this fails

 >  The more appropriate thing to do would be to:

 > - set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
 > - do not set it when selinux is enabled, and depend on host-checkpolicy

Yes, that can be done in the future by someone interested in xen with
XSM/selinux support.


 > - depend on host-python
 > - set LC_ALL=C

Hmm, where are we setting LC_ALL=C in the package build step?

 >  However, the latter two are already done. So except for incorrectly detecting
 > checkpolicy installed on the system, I wonder what is really triggering this
 > issue...

I was also unable to reproduce the issue locally, but given the > 255
byte values I assume it is related to locale. Looking at the issue I
noticed the invalid checkpolicy logic and that disabling it would get
rid of the entire code path.

But I am fine with people sending patches to improve it. I don't use Xen
myself, I only looked at the build issues while doing security support
and noticed they have been occuring for quite a long time.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Arnout Vandecappelle]

On 21/01/2020 22:45, Peter Korsgaard wrote:
>>>>>> "Arnout" == Arnout Vandecappelle <arnout@mind.be> writes:
> 
>  > On 19/01/2020 18:03, Peter Korsgaard wrote:
>  >> Fixes:
>  >> http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde
>  >> 
>  >> The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
>  >> Security Kernel) security policy if it detects SELinux checkpolicy on the
>  >> build machine.
>  >> 
>  >> If enabled, a gen-policy.py python script is used to convert the binary
>  >> FLASK policy to a C array initialization list to embed it in the Xen binary.
>  >> Depending on the python version and locale available on the host, this fails
> 
>  >  The more appropriate thing to do would be to:
> 
>  > - set this XEN_HAS_CHECKPOLICY=n if selinux is disabled;
>  > - do not set it when selinux is enabled, and depend on host-checkpolicy
> 
> Yes, that can be done in the future by someone interested in xen with
> XSM/selinux support.
> 
> 
>  > - depend on host-python
>  > - set LC_ALL=C
> 
> Hmm, where are we setting LC_ALL=C in the package build step?

 Ugh, I grepped for it and I saw it, but now it vanished :-)


 Regards,
 Arnout

>  >  However, the latter two are already done. So except for incorrectly detecting
>  > checkpolicy installed on the system, I wonder what is really triggering this
>  > issue...
> 
> I was also unable to reproduce the issue locally, but given the > 255
> byte values I assume it is related to locale. Looking at the issue I
> noticed the invalid checkpolicy logic and that disabling it would get
> rid of the entire code path.
> 
> But I am fine with people sending patches to improve it. I don't use Xen
> myself, I only looked at the build issues while doing security support
> and noticed they have been occuring for quite a long time.
> 

[Buildroot] [PATCH 1/3] package/xen: explicitly disable checkpolicy logic

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes:
 > http://autobuild.buildroot.net/results/14af2dc3219847a92c6ec2db14ba387159b61fde

 > The Xen build system builds and embeds a default XSM FLASK (Flux Advanced
 > Security Kernel) security policy if it detects SELinux checkpolicy on the
 > build machine.

 > If enabled, a gen-policy.py python script is used to convert the binary
 > FLASK policy to a C array initialization list to embed it in the Xen binary.
 > Depending on the python version and locale available on the host, this fails
 > with byte values outside the 0..255 range:

 > policy.c:7:10: error: unsigned conversion from 'int' to 'unsigned char' changes value from '56575' to '255' [-Werror=overflow]
 >   0xdc8c, 0xdcff, 0x7c, 0xdcf9, 0x08, 0x00, 0x00, 0x00, 0x58, 0x65, 0x6e, 0x46, 0x6c,

 > To fix this and ensure a consistent build, pass XEN_HAS_CHECKPOLICY=n to
 > disable the checkpolicy detection.

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2019.02.x and 2019.11.x, thanks.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH 2/3] package/xen: security bump to version 4.12.2

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > The 4.12.2 release brings a large number of fixes:
 > https://xenproject.org/downloads/xen-project-archives/xen-project-4-12-series/xen-project-4-12-2/

 > Including a number of security fixes:

 > XSA-296: VCPUOP_initialise DoS (CVE-2019-18420)
 > XSA-298: missing descriptor table limit checking in x86 PV emulation
 > 	 (CVE-2019-18425)
 > XSA-299: Issues with restartable PV type change operations (CVE-2019-18421)
 > XSA-301: add-to-physmap can be abused to DoS Arm hosts (CVE-2019-18423)
 > XSA-302: passed through PCI devices may corrupt host memory after
 >          deassignment (CVE-2019-18424)
 > XSA-303: ARM: Interrupts are unconditionally unmasked in exception handlers
 > 	 (CVE-2019-18422)
 > XSA-304: x86: Machine Check Error on Page Size Change DoS (CVE-2018-12207)
 > XSA-305: TSX Asynchronous Abort speculative side channel (CVE-2019-11135)
 > XSA-306: Device quarantine for alternate pci assignment methods
 > 	 (CVE-2019-19579)
 > XSA-307: find_next_bit() issues (CVE-2019-19581 CVE-2019-19582)
 > XSA-308: VMX: VMentry failure with debug exceptions and blocked states
 > 	 (CVE-2019-19583)
 > XSA-309: Linear pagetable use / entry miscounts (CVE-2019-19578)
 > XSA-310: Further issues with restartable PV type change operations
 > 	 (CVE-2019-19580)
 > XSA-311: Bugs in dynamic height handling for AMD IOMMU pagetables
 > 	 (CVE-2019-19577)

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2019.11.x, thanks.

For 2019.02.x I will instead bump to 4.11.3.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH 3/3] package/xen: add upstream security fix for XSA-312

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security issue:
 > XSA-312: arm: a CPU may speculate past the ERET instruction

 > For further details, see the advisory:

 > https://xenbits.xenproject.org/xsa/advisory-312.html

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard