Re: [Buildroot] [PATCH v2] package/util-linux: bump version to 2.37.3 (fixes CVE-2021-3996, CVE-2021-3995)

[Peter Seiderer <ps.report@gmx.net>]

Hello Arnout,

On Tue, 1 Feb 2022 23:00:06 +0100, Arnout Vandecappelle <arnout@mind.be> wrote:

> On 25/01/2022 23:15, Peter Seiderer wrote:
> > - add 'touch' workaround for missing disk-utils/raw.8 file ([1], [2]) in
> >    util-linux-2.37.4 release download package
>
> 2.37.3 I assume.

Yes...

>
> >
> > For details see [1].
> >
> > [1] https://www.spinics.net/lists/util-linux-ng/msg17037.html

This reference should be [3] and the links for [1] and [2] are missing:

[1] https://github.com/util-linux/util-linux/issues/1579
[2] https://github.com/util-linux/util-linux/issues/1577

> >
> > Signed-off-by: Peter Seiderer <ps.report@gmx.net>
> > Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
> > ---
> > Changes v1 -> v2:
> >    - add workaround for missing disk-utils/raw.8 file
> > ---
> >   package/util-linux/util-linux.hash | 2 +-
> >   package/util-linux/util-linux.mk   | 9 ++++++++-
> >   2 files changed, 9 insertions(+), 2 deletions(-)
> >
> > diff --git a/package/util-linux/util-linux.hash b/package/util-linux/util-linux.hash
> > index eafbe9254a..9c10a42dca 100644
> > --- a/package/util-linux/util-linux.hash
> > +++ b/package/util-linux/util-linux.hash
> > @@ -1,5 +1,5 @@
> >   # From https://www.kernel.org/pub/linux/utils/util-linux/v2.37/sha256sums.asc
> > -sha256  6a0764c1aae7fb607ef8a6dd2c0f6c47d5e5fd27aa08820abaad9ec14e28e9d9  util-linux-2.37.2.tar.xz
> > +sha256  590c592e58cd6bf38519cb467af05ce6a1ab18040e3e3418f24bcfb2f55f9776  util-linux-2.37.3.tar.xz
> >   # License files, locally calculated
> >   sha256  869660b5269f4f40a8a679da7f403ea3a6e71d46087aab5e14871b09bcb55955  README.licensing
> >   sha256  9b718a9460fed5952466421235bc79eb49d4e9eacc920d7a9dd6285ab8fd6c6d  Documentation/licenses/COPYING.BSD-3-Clause
> > diff --git a/package/util-linux/util-linux.mk b/package/util-linux/util-linux.mk
> > index cf0fee409b..baf9ed3406 100644
> > --- a/package/util-linux/util-linux.mk
> > +++ b/package/util-linux/util-linux.mk
> > @@ -8,7 +8,7 @@
> >   # util-linux-libs/util-linux-libs.mk needs to be updated accordingly as well.
> >
> >   UTIL_LINUX_VERSION_MAJOR = 2.37
> > -UTIL_LINUX_VERSION = $(UTIL_LINUX_VERSION_MAJOR).2
> > +UTIL_LINUX_VERSION = $(UTIL_LINUX_VERSION_MAJOR).3
> >   UTIL_LINUX_SOURCE = util-linux-$(UTIL_LINUX_VERSION).tar.xz
> >   UTIL_LINUX_SITE = $(BR2_KERNEL_MIRROR)/linux/utils/util-linux/v$(UTIL_LINUX_VERSION_MAJOR)
> >
> > @@ -267,6 +267,13 @@ else
> >   UTIL_LINUX_CONF_OPTS += --without-libmagic
> >   endif
> >
> > +# workaround missing disk-utils/raw.8 file in util-linux-2.37.4
>
>   2.37.3 as well.

Yes...
>
>   I moved this hunk to the beginning of the file, to increase the chance that it
> is noticed on next bump (which hopefully makes it unneeded).
>
> > +# release download package
> > +define UTIL_LINUX_FIX_DISK_UTILS_COMPILE
> > +	touch $(@D)/disk-utils/raw.8
> > +endef
> > +UTIL_LINUX_PRE_BUILD_HOOKS += UTIL_LINUX_FIX_DISK_UTILS_COMPILE
>
>   I moved this to a post-patch instead of pre-build hook.
>
>
>   Applied to master, thanks.

Thanks for cleaning up my mess...

Regards,
Peter

>
>   Regards,
>   Arnout
>
> > +
> >   # Install PAM configuration files
> >   ifeq ($(BR2_PACKAGE_UTIL_LINUX_SU)$(BR2_PACKAGE_LINUX_PAM),yy)
> >   define UTIL_LINUX_INSTALL_PAMFILES
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot