added my Recipes
This commit is contained in:
26
meta-openembedded/meta-oe/recipes-shells/dash/dash_0.5.12.bb
Normal file
26
meta-openembedded/meta-oe/recipes-shells/dash/dash_0.5.12.bb
Normal file
@@ -0,0 +1,26 @@
|
||||
SUMMARY = "Small and fast POSIX-compliant shell"
|
||||
HOMEPAGE = "http://gondor.apana.org.au/~herbert/dash/"
|
||||
SECTION = "System Environment/Shells"
|
||||
|
||||
LICENSE = "BSD-3-Clause & GPL-2.0-or-later"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=b5262b4a1a1bff72b48e935531976d2e"
|
||||
|
||||
inherit autotools update-alternatives
|
||||
|
||||
SRC_URI = "http://gondor.apana.org.au/~herbert/${BPN}/files/${BP}.tar.gz"
|
||||
SRC_URI[sha256sum] = "6a474ac46e8b0b32916c4c60df694c82058d3297d8b385b74508030ca4a8f28a"
|
||||
|
||||
EXTRA_OECONF += "--bindir=${base_bindir}"
|
||||
|
||||
ALTERNATIVE:${PN} = "sh"
|
||||
ALTERNATIVE_LINK_NAME[sh] = "${base_bindir}/sh"
|
||||
ALTERNATIVE_TARGET[sh] = "${base_bindir}/dash"
|
||||
ALTERNATIVE_PRIORITY = "10"
|
||||
|
||||
pkg_postinst:${PN} () {
|
||||
grep -q "^${base_bindir}/dash$" $D${sysconfdir}/shells || echo ${base_bindir}/dash >> $D${sysconfdir}/shells
|
||||
}
|
||||
|
||||
pkg_postrm:${PN} () {
|
||||
printf "$(grep -v "^${base_bindir}/dash$" $D${sysconfdir}/shells)\n" > $D${sysconfdir}/shells
|
||||
}
|
||||
36
meta-openembedded/meta-oe/recipes-shells/mksh/mksh_59.bb
Normal file
36
meta-openembedded/meta-oe/recipes-shells/mksh/mksh_59.bb
Normal file
@@ -0,0 +1,36 @@
|
||||
DESCRIPTION = "The MirBSD Korn Shell - an enhanced version of the public domain ksh"
|
||||
HOMEPAGE = "http://www.mirbsd.org/mksh.htm"
|
||||
SECTION = "base/shell"
|
||||
|
||||
LICENSE = "${@bb.utils.contains("TCLIBC", "glibc", "MirOS & ISC", "MirOS", d)}"
|
||||
LIC_FILES_CHKSUM = "file://main.c;beginline=6;endline=26;md5=6efc2c249328e4d2bd3e595d5b1f9d31 \
|
||||
file://strlcpy.c;beginline=1;endline=17;md5=d953f28f0c43ee29e238ec9bc15df2a0 \
|
||||
"
|
||||
|
||||
SRC_URI = "http://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R59b.tgz"
|
||||
|
||||
SRC_URI[md5sum] = "dce6abffc2036288540b9ba11dfb2ec8"
|
||||
SRC_URI[sha256sum] = "907ed1a9586e7f18bdefdd4a763aaa8397b755e15034aa54f4d753bfb272e0e6"
|
||||
|
||||
inherit update-alternatives
|
||||
|
||||
S = "${WORKDIR}/${BPN}"
|
||||
|
||||
ALTERNATIVE:${PN} = "sh"
|
||||
ALTERNATIVE_LINK_NAME[sh] = "${base_bindir}/sh"
|
||||
ALTERNATIVE_TARGET[sh] = "${base_bindir}/${BPN}"
|
||||
ALTERNATIVE_PRIORITY = "100"
|
||||
|
||||
do_compile() {
|
||||
sh ${S}/Build.sh -r
|
||||
}
|
||||
|
||||
do_install() {
|
||||
install -d ${D}${base_bindir}
|
||||
install -m 0755 ${S}/mksh ${D}${base_bindir}/mksh
|
||||
|
||||
install -d ${D}${sysconfdir}/skel
|
||||
install -m 0644 ${S}/dot.mkshrc ${D}${sysconfdir}/skel/.mkshrc
|
||||
}
|
||||
|
||||
RPROVIDES:${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '/bin/sh', '', d)}"
|
||||
@@ -0,0 +1,30 @@
|
||||
From 0553455813a1f717ef50cc911e4db73da3d23c32 Mon Sep 17 00:00:00 2001
|
||||
From: Khem Raj <raj.khem@gmail.com>
|
||||
Date: Wed, 22 Mar 2017 18:47:40 -0700
|
||||
Subject: [PATCH 1/2] Enable system malloc on all linux
|
||||
|
||||
Dont trigger on being just android or glibc
|
||||
internal malloc falls flat on musl based systems
|
||||
as well. So switch to using system malloc
|
||||
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
config_f.h | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/config_f.h b/config_f.h
|
||||
index fb9e69b..c207c25 100644
|
||||
--- a/config_f.h
|
||||
+++ b/config_f.h
|
||||
@@ -147,7 +147,7 @@
|
||||
* This can be much slower and no memory statistics will be
|
||||
* provided.
|
||||
*/
|
||||
-#if defined(__MACHTEN__) || defined(PURIFY) || defined(MALLOC_TRACE) || defined(_OSD_POSIX) || defined(__MVS__) || defined (__CYGWIN__) || defined(__GLIBC__) || defined(__OpenBSD__) || defined(__APPLE__) || defined (__ANDROID__) || defined(__NetBSD__) || !defined(HAVE_WORKING_SBRK)
|
||||
+#if defined(__MACHTEN__) || defined(PURIFY) || defined(MALLOC_TRACE) || defined(_OSD_POSIX) || defined(__MVS__) || defined (__CYGWIN__) || defined(__linux__) || defined(__OpenBSD__) || defined(__APPLE__) || defined (__ANDROID__) || defined(__NetBSD__) || !defined(HAVE_WORKING_SBRK)
|
||||
# define SYSMALLOC
|
||||
#else
|
||||
# undef SYSMALLOC
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@@ -0,0 +1,60 @@
|
||||
From 60271713025f6b17dda29721be012a8428e77185 Mon Sep 17 00:00:00 2001
|
||||
From: Khem Raj <raj.khem@gmail.com>
|
||||
Date: Wed, 22 Mar 2017 18:56:49 -0700
|
||||
Subject: [PATCH 2/2] Add debian csh scripts
|
||||
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
csh.cshrc | 15 +++++++++++++++
|
||||
csh.login | 8 ++++++++
|
||||
csh.logout | 1 +
|
||||
3 files changed, 24 insertions(+)
|
||||
create mode 100644 csh.cshrc
|
||||
create mode 100644 csh.login
|
||||
create mode 100644 csh.logout
|
||||
|
||||
diff --git a/csh.cshrc b/csh.cshrc
|
||||
new file mode 100644
|
||||
index 0000000..29c934a
|
||||
--- /dev/null
|
||||
+++ b/csh.cshrc
|
||||
@@ -0,0 +1,15 @@
|
||||
+# /etc/csh.cshrc: system-wide .cshrc file for csh(1) and tcsh(1)
|
||||
+
|
||||
+if ($?tcsh && $?prompt) then
|
||||
+
|
||||
+ bindkey "\e[1~" beginning-of-line # Home
|
||||
+ bindkey "\e[7~" beginning-of-line # Home rxvt
|
||||
+ bindkey "\e[2~" overwrite-mode # Ins
|
||||
+ bindkey "\e[3~" delete-char # Delete
|
||||
+ bindkey "\e[4~" end-of-line # End
|
||||
+ bindkey "\e[8~" end-of-line # End rxvt
|
||||
+
|
||||
+ set autoexpand
|
||||
+ set autolist
|
||||
+ set prompt = "%U%m%u:%B%~%b%# "
|
||||
+endif
|
||||
diff --git a/csh.login b/csh.login
|
||||
new file mode 100644
|
||||
index 0000000..2455c3c
|
||||
--- /dev/null
|
||||
+++ b/csh.login
|
||||
@@ -0,0 +1,8 @@
|
||||
+# /etc/csh.login: system-wide .login file for csh(1) and tcsh(1)
|
||||
+
|
||||
+# allow for other packages/system admins to customize the shell environment
|
||||
+if (-e /etc/csh/login.d && `/bin/ls /etc/csh/login.d` != "") then
|
||||
+ foreach FILE (`/bin/ls /etc/csh/login.d/*`)
|
||||
+ source $FILE;
|
||||
+ end;
|
||||
+endif
|
||||
diff --git a/csh.logout b/csh.logout
|
||||
new file mode 100644
|
||||
index 0000000..a207eba
|
||||
--- /dev/null
|
||||
+++ b/csh.logout
|
||||
@@ -0,0 +1 @@
|
||||
+# /etc/csh.logout: system-wide .logout file for csh(1) and tcsh(1)
|
||||
--
|
||||
2.12.1
|
||||
|
||||
@@ -0,0 +1,46 @@
|
||||
DESCRIPTION = "TENEX C Shell, an enhanced version of Berkeley csh \
|
||||
The TENEX C Shell is an enhanced version of the Berkeley Unix C shell. \
|
||||
It includes all features of 4.4BSD C shell, plus a command-line editor, \
|
||||
programmable word completion, spelling correction and more."
|
||||
|
||||
HOMEPAGE = "http://www.tcsh.org/"
|
||||
LICENSE = "BSD-3-Clause"
|
||||
LIC_FILES_CHKSUM = "file://Copyright;md5=575cf2715c3bf894e1f79aec1d4eaaf5"
|
||||
SECTION = "base"
|
||||
DEPENDS = "ncurses virtual/crypt gettext-native"
|
||||
SRC_URI = " \
|
||||
https://astron.com/pub/${BPN}/${BP}.tar.gz \
|
||||
file://0001-Enable-system-malloc-on-all-linux.patch \
|
||||
file://0002-Add-debian-csh-scripts.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "74e4e9805cbd9413ed34b4ffa1d72fc8d0ef81a5b79476854091416ce9336995"
|
||||
|
||||
EXTRA_OEMAKE += "CC_FOR_GETHOST='${BUILD_CC}'"
|
||||
inherit autotools
|
||||
|
||||
do_compile:prepend() {
|
||||
oe_runmake CC_FOR_GETHOST='${BUILD_CC}' CFLAGS='${BUILD_CFLAGS}' LDFLAGS='${BUILD_LDFLAGS}' gethost
|
||||
}
|
||||
|
||||
do_install:append () {
|
||||
oe_runmake install.man DESTDIR=${D}
|
||||
|
||||
install -d ${D}${base_bindir}
|
||||
if ! ${@bb.utils.contains('DISTRO_FEATURES','usrmerge','true','false',d)}; then
|
||||
ln -s /usr/bin/tcsh ${D}${base_bindir}/tcsh
|
||||
ln -s /usr/bin/tcsh ${D}${base_bindir}/csh
|
||||
fi
|
||||
install -d ${D}${sysconfdir}/csh/login.d
|
||||
install -m 0644 ${S}/csh.cshrc ${S}/csh.login ${S}/csh.logout ${S}/complete.tcsh ${D}${sysconfdir}
|
||||
install -D -m 0644 ${S}/csh-mode.el ${D}${datadir}/emacs/site-lisp/csh-mode.el
|
||||
}
|
||||
|
||||
FILES:${PN} += "${datadir}/emacs/site-lisp/csh-mode.el"
|
||||
|
||||
|
||||
pkg_postinst:${PN} () {
|
||||
#!/bin/sh -e
|
||||
echo /usr/bin/tcsh >> $D/etc/shells
|
||||
echo /usr/bin/csh >> $D/etc/shells
|
||||
}
|
||||
BBCLASSEXTEND = "native nativesdk"
|
||||
@@ -0,0 +1,60 @@
|
||||
Origin: commit c187154f47697cdbf822c2f9d714d570ed4a0fd1
|
||||
From: Oliver Kiddle <opk@zsh.org>
|
||||
Date: Wed, 15 Dec 2021 01:56:40 +0100
|
||||
Subject: [PATCH 1/9] security/41: Don't perform PROMPT_SUBST evaluation on
|
||||
%F/%K arguments
|
||||
|
||||
Mitigates CVE-2021-45444
|
||||
|
||||
https://salsa.debian.org/debian/zsh/-/raw/debian/5.8-6+deb11u1/debian/patches/cherry-pick-CVE-2021-45444_1.patch?inline=false
|
||||
Upstream-Status: Backport
|
||||
CVE: CVE-2021-45444
|
||||
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
||||
---
|
||||
ChangeLog | 5 +++++
|
||||
Src/prompt.c | 10 ++++++++++
|
||||
2 files changed, 15 insertions(+)
|
||||
|
||||
diff --git a/ChangeLog b/ChangeLog
|
||||
index 8d7dfc169..eb248ec06 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -1,3 +1,8 @@
|
||||
+2022-01-27 dana <dana@dana.is>
|
||||
+
|
||||
+ * Oliver Kiddle: security/41: Src/prompt.c: Prevent recursive
|
||||
+ PROMPT_SUBST
|
||||
+
|
||||
2020-02-14 dana <dana@dana.is>
|
||||
|
||||
* unposted: Config/version.mk: Update for 5.8
|
||||
diff --git a/Src/prompt.c b/Src/prompt.c
|
||||
index b65bfb86b..91e21c8e9 100644
|
||||
--- a/Src/prompt.c
|
||||
+++ b/Src/prompt.c
|
||||
@@ -244,6 +244,12 @@ parsecolorchar(zattr arg, int is_fg)
|
||||
bv->fm += 2; /* skip over F{ */
|
||||
if ((ep = strchr(bv->fm, '}'))) {
|
||||
char oc = *ep, *col, *coll;
|
||||
+ int ops = opts[PROMPTSUBST], opb = opts[PROMPTBANG];
|
||||
+ int opp = opts[PROMPTPERCENT];
|
||||
+
|
||||
+ opts[PROMPTPERCENT] = 1;
|
||||
+ opts[PROMPTSUBST] = opts[PROMPTBANG] = 0;
|
||||
+
|
||||
*ep = '\0';
|
||||
/* expand the contents of the argument so you can use
|
||||
* %v for example */
|
||||
@@ -252,6 +258,10 @@ parsecolorchar(zattr arg, int is_fg)
|
||||
arg = match_colour((const char **)&coll, is_fg, 0);
|
||||
free(col);
|
||||
bv->fm = ep;
|
||||
+
|
||||
+ opts[PROMPTSUBST] = ops;
|
||||
+ opts[PROMPTBANG] = opb;
|
||||
+ opts[PROMPTPERCENT] = opp;
|
||||
} else {
|
||||
arg = match_colour((const char **)&bv->fm, is_fg, 0);
|
||||
if (*bv->fm != '}')
|
||||
--
|
||||
2.34.1
|
||||
@@ -0,0 +1,140 @@
|
||||
From 8a4d65ef6d0023ab9b238529410afb433553d2fa Mon Sep 17 00:00:00 2001
|
||||
From: Marc Cornellà <hello@mcornella.com>
|
||||
Date: Mon, 24 Jan 2022 09:43:28 +0100
|
||||
Subject: [PATCH 2/9] security/89: Add patch which can optionally be used to
|
||||
work around CVE-2021-45444 in VCS_Info
|
||||
Comment: Updated to use the same file name without blanks as actually
|
||||
used in the final 5.8.1 release.
|
||||
|
||||
|
||||
https://salsa.debian.org/debian/zsh/-/blob/debian/5.8-6+deb11u1/debian/patches/cherry-pick-CVE-2021-45444_2.patch
|
||||
Upstream-Status: Backport
|
||||
CVE: CVE-2021-45444
|
||||
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
||||
---
|
||||
ChangeLog | 5 +
|
||||
Etc/CVE-2021-45444-VCS_Info-workaround.patch | 98 ++++++++++++++++++++
|
||||
2 files changed, 103 insertions(+)
|
||||
create mode 100644 Etc/CVE-2021-45444-VCS_Info-workaround.patch
|
||||
|
||||
diff --git a/ChangeLog b/ChangeLog
|
||||
index eb248ec06..9a05a09e1 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -1,5 +1,10 @@
|
||||
2022-01-27 dana <dana@dana.is>
|
||||
|
||||
+ * Marc Cornellà: security/89:
|
||||
+ Etc/CVE-2021-45444-VCS_Info-workaround.patch: Add patch which
|
||||
+ can optionally be used to work around recursive PROMPT_SUBST
|
||||
+ issue in VCS_Info
|
||||
+
|
||||
* Oliver Kiddle: security/41: Src/prompt.c: Prevent recursive
|
||||
PROMPT_SUBST
|
||||
|
||||
diff --git a/Etc/CVE-2021-45444-VCS_Info-workaround.patch b/Etc/CVE-2021-45444-VCS_Info-workaround.patch
|
||||
new file mode 100644
|
||||
index 000000000..13e54be77
|
||||
--- /dev/null
|
||||
+++ b/Etc/CVE-2021-45444-VCS_Info-workaround.patch
|
||||
@@ -0,0 +1,98 @@
|
||||
+From 972887bbe5eb6a00e5f0e73781d6d73bfdcafb93 Mon Sep 17 00:00:00 2001
|
||||
+From: =?UTF-8?q?Marc=20Cornell=C3=A0?= <hello@mcornella.com>
|
||||
+Date: Mon, 24 Jan 2022 09:43:28 +0100
|
||||
+Subject: [PATCH] security/89: Partially work around CVE-2021-45444 in VCS_Info
|
||||
+MIME-Version: 1.0
|
||||
+Content-Type: text/plain; charset=UTF-8
|
||||
+Content-Transfer-Encoding: 8bit
|
||||
+
|
||||
+This patch is a partial, VCS_Info-specific work-around for CVE-2021-45444,
|
||||
+which is mitigated in the shell itself in 5.8.1 and later versions. It is
|
||||
+offered for users who are concerned about an exploit but are unable to update
|
||||
+their binaries to receive the complete fix.
|
||||
+
|
||||
+The patch works around the vulnerability by pre-escaping values substituted
|
||||
+into format strings in VCS_Info. Please note that this may break some user
|
||||
+configurations that rely on those values being un-escaped (which is why it was
|
||||
+not included directly in 5.8.1). It may be possible to limit this breakage by
|
||||
+adjusting exactly which ones are pre-escaped, but of course this may leave
|
||||
+them vulnerable again.
|
||||
+
|
||||
+If applying the patch to the file system is inconvenient or not possible, the
|
||||
+following script can be used to idempotently patch the relevant function
|
||||
+running in memory (and thus must be re-run when the shell is restarted):
|
||||
+
|
||||
+
|
||||
+# Impacted versions go from v5.0.3 to v5.8 (v5.8.1 is the first patched version)
|
||||
+autoload -Uz is-at-least
|
||||
+if is-at-least 5.8.1 || ! is-at-least 5.0.3; then
|
||||
+ return
|
||||
+fi
|
||||
+
|
||||
+# Quote necessary $hook_com[<field>] items just before they are used
|
||||
+# in the line "VCS_INFO_hook 'post-backend'" of the VCS_INFO_formats
|
||||
+# function, where <field> is:
|
||||
+#
|
||||
+# base: the full path of the repository's root directory.
|
||||
+# base-name: the name of the repository's root directory.
|
||||
+# branch: the name of the currently checked out branch.
|
||||
+# revision: an identifier of the currently checked out revision.
|
||||
+# subdir: the path of the current directory relative to the
|
||||
+# repository's root directory.
|
||||
+# misc: a string that may contain anything the vcs_info backend wants.
|
||||
+#
|
||||
+# This patch %-quotes these fields previous to their use in vcs_info hooks and
|
||||
+# the zformat call and, eventually, when they get expanded in the prompt.
|
||||
+# It's important to quote these here, and not later after hooks have modified the
|
||||
+# fields, because then we could be quoting % characters from valid prompt sequences,
|
||||
+# like %F{color}, %B, etc.
|
||||
+#
|
||||
+# 32 │ hook_com[subdir]="$(VCS_INFO_reposub ${hook_com[base]})"
|
||||
+# 33 │ hook_com[subdir_orig]="${hook_com[subdir]}"
|
||||
+# 34 │
|
||||
+# 35 + │ for tmp in base base-name branch misc revision subdir; do
|
||||
+# 36 + │ hook_com[$tmp]="${hook_com[$tmp]//\%/%%}"
|
||||
+# 37 + │ done
|
||||
+# 38 + │
|
||||
+# 39 │ VCS_INFO_hook 'post-backend'
|
||||
+#
|
||||
+# This is especially important so that no command substitution is performed
|
||||
+# due to malicious input as a consequence of CVE-2021-45444, which affects
|
||||
+# zsh versions from 5.0.3 to 5.8.
|
||||
+#
|
||||
+autoload -Uz +X regexp-replace VCS_INFO_formats
|
||||
+
|
||||
+# We use $tmp here because it's already a local variable in VCS_INFO_formats
|
||||
+typeset PATCH='for tmp (base base-name branch misc revision subdir) hook_com[$tmp]="${hook_com[$tmp]//\%/%%}"'
|
||||
+# Unique string to avoid reapplying the patch if this code gets called twice
|
||||
+typeset PATCH_ID=vcs_info-patch-9b9840f2-91e5-4471-af84-9e9a0dc68c1b
|
||||
+# Only patch the VCS_INFO_formats function if not already patched
|
||||
+if [[ "$functions[VCS_INFO_formats]" != *$PATCH_ID* ]]; then
|
||||
+ regexp-replace 'functions[VCS_INFO_formats]' \
|
||||
+ "VCS_INFO_hook 'post-backend'" \
|
||||
+ ': ${PATCH_ID}; ${PATCH}; ${MATCH}'
|
||||
+fi
|
||||
+unset PATCH PATCH_ID
|
||||
+
|
||||
+
|
||||
+---
|
||||
+ Functions/VCS_Info/VCS_INFO_formats | 4 ++++
|
||||
+ 1 file changed, 4 insertions(+)
|
||||
+
|
||||
+diff --git a/Functions/VCS_Info/VCS_INFO_formats b/Functions/VCS_Info/VCS_INFO_formats
|
||||
+index e0e1dc738..4d88e28b6 100644
|
||||
+--- a/Functions/VCS_Info/VCS_INFO_formats
|
||||
++++ b/Functions/VCS_Info/VCS_INFO_formats
|
||||
+@@ -32,6 +32,10 @@ hook_com[base-name_orig]="${hook_com[base_name]}"
|
||||
+ hook_com[subdir]="$(VCS_INFO_reposub ${hook_com[base]})"
|
||||
+ hook_com[subdir_orig]="${hook_com[subdir]}"
|
||||
+
|
||||
++for tmp in base base-name branch misc revision subdir; do
|
||||
++ hook_com[$tmp]="${hook_com[$tmp]//\%/%%}"
|
||||
++done
|
||||
++
|
||||
+ VCS_INFO_hook 'post-backend'
|
||||
+
|
||||
+ ## description (for backend authors):
|
||||
+--
|
||||
+2.34.1
|
||||
--
|
||||
2.34.1
|
||||
@@ -0,0 +1,77 @@
|
||||
From 4abf2fc193fc2f3e680deecbf81289a7b02e245b Mon Sep 17 00:00:00 2001
|
||||
From: dana <dana@dana.is>
|
||||
Date: Tue, 21 Dec 2021 13:13:33 -0600
|
||||
Subject: [PATCH 3/9] CVE-2021-45444: Update NEWS/README
|
||||
|
||||
https://salsa.debian.org/debian/zsh/-/blob/debian/5.8-6+deb11u1/debian/patches/cherry-pick-CVE-2021-45444_3.patch
|
||||
Upstream-Status: Backport
|
||||
CVE: CVE-2021-45444
|
||||
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
||||
---
|
||||
ChangeLog | 2 ++
|
||||
NEWS | 20 ++++++++++++++++++++
|
||||
README | 6 ++++++
|
||||
3 files changed, 28 insertions(+)
|
||||
|
||||
diff --git a/ChangeLog b/ChangeLog
|
||||
index 9a05a09e1..93b0bc337 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -1,5 +1,7 @@
|
||||
2022-01-27 dana <dana@dana.is>
|
||||
|
||||
+ * CVE-2021-45444: NEWS, README: Document preceding two changes
|
||||
+
|
||||
* Marc Cornellà: security/89:
|
||||
Etc/CVE-2021-45444-VCS_Info-workaround.patch: Add patch which
|
||||
can optionally be used to work around recursive PROMPT_SUBST
|
||||
diff --git a/NEWS b/NEWS
|
||||
index 964e1633f..d34b3f79e 100644
|
||||
--- a/NEWS
|
||||
+++ b/NEWS
|
||||
@@ -4,6 +4,26 @@ CHANGES FROM PREVIOUS VERSIONS OF ZSH
|
||||
|
||||
Note also the list of incompatibilities in the README file.
|
||||
|
||||
+Changes since 5.8
|
||||
+-----------------
|
||||
+
|
||||
+CVE-2021-45444: Some prompt expansion sequences, such as %F, support
|
||||
+'arguments' which are themselves expanded in case they contain colour
|
||||
+values, etc. This additional expansion would trigger PROMPT_SUBST
|
||||
+evaluation, if enabled. This could be abused to execute code the user
|
||||
+didn't expect. e.g., given a certain prompt configuration, an attacker
|
||||
+could trick a user into executing arbitrary code by having them check
|
||||
+out a Git branch with a specially crafted name.
|
||||
+
|
||||
+This is fixed in the shell itself by no longer performing PROMPT_SUBST
|
||||
+evaluation on these prompt-expansion arguments.
|
||||
+
|
||||
+Users who are concerned about an exploit but unable to update their
|
||||
+binaries may apply the partial work-around described in the file
|
||||
+'Etc/CVE-2021-45444 VCS_Info workaround.patch' included with the shell
|
||||
+source. [ Reported by RyotaK <security@ryotak.me>. Additional thanks to
|
||||
+Marc Cornellà <hello@mcornella.com>. ]
|
||||
+
|
||||
Changes since 5.7.1-test-3
|
||||
--------------------------
|
||||
|
||||
diff --git a/README b/README
|
||||
index 7f1dd5f92..c9e994ab3 100644
|
||||
--- a/README
|
||||
+++ b/README
|
||||
@@ -31,6 +31,12 @@ Zsh is a shell with lots of features. For a list of some of these, see the
|
||||
file FEATURES, and for the latest changes see NEWS. For more
|
||||
details, see the documentation.
|
||||
|
||||
+Incompatibilities since 5.8
|
||||
+---------------------------
|
||||
+
|
||||
+PROMPT_SUBST expansion is no longer performed on arguments to prompt-
|
||||
+expansion sequences such as %F.
|
||||
+
|
||||
Incompatibilities since 5.7.1
|
||||
-----------------------------
|
||||
|
||||
--
|
||||
2.34.1
|
||||
62
meta-openembedded/meta-oe/recipes-shells/zsh/zsh_5.8.bb
Normal file
62
meta-openembedded/meta-oe/recipes-shells/zsh/zsh_5.8.bb
Normal file
@@ -0,0 +1,62 @@
|
||||
SUMMARY = "UNIX Shell similar to the Korn shell"
|
||||
DESCRIPTION = "Zsh is a shell designed for interactive use, although it is also a \
|
||||
powerful scripting language. Many of the useful features of bash, \
|
||||
ksh, and tcsh were incorporated into zsh; many original features were added."
|
||||
HOMEPAGE = "http://www.zsh.org"
|
||||
SECTION = "base/shell"
|
||||
|
||||
LICENSE = "zsh"
|
||||
LIC_FILES_CHKSUM = "file://LICENCE;md5=1a4c4cda3e8096d2fd483ff2f4514fec"
|
||||
|
||||
DEPENDS = "ncurses bison-native libcap libpcre gdbm groff-native"
|
||||
|
||||
SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}/5.8/${BP}.tar.xz \
|
||||
file://CVE-2021-45444_1.patch \
|
||||
file://CVE-2021-45444_2.patch \
|
||||
file://CVE-2021-45444_3.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "dcc4b54cc5565670a65581760261c163d720991f0d06486da61f8d839b52de27"
|
||||
|
||||
inherit autotools-brokensep gettext update-alternatives manpages
|
||||
|
||||
EXTRA_OECONF = " \
|
||||
--bindir=${base_bindir} \
|
||||
--enable-etcdir=${sysconfdir} \
|
||||
--enable-fndir=${datadir}/${BPN}/${PV}/functions \
|
||||
--enable-site-fndir=${datadir}/${BPN}/site-functions \
|
||||
--with-term-lib='ncursesw ncurses' \
|
||||
--with-tcsetpgrp \
|
||||
--enable-cap \
|
||||
--enable-multibyte \
|
||||
--disable-gdbm \
|
||||
--disable-dynamic \
|
||||
zsh_cv_shared_environ=yes \
|
||||
"
|
||||
|
||||
# Configure respects --bindir from EXTRA_OECONF, but then Src/Makefile will read bindir from environment
|
||||
export bindir="${base_bindir}"
|
||||
|
||||
EXTRA_OEMAKE = "-e MAKEFLAGS="
|
||||
|
||||
ALTERNATIVE:${PN} = "sh"
|
||||
ALTERNATIVE_LINK_NAME[sh] = "${base_bindir}/sh"
|
||||
ALTERNATIVE_TARGET[sh] = "${base_bindir}/${BPN}"
|
||||
ALTERNATIVE_PRIORITY = "90"
|
||||
|
||||
export AUTOHEADER = "true"
|
||||
|
||||
do_configure () {
|
||||
gnu-configize --force ${S}
|
||||
oe_runconf
|
||||
}
|
||||
|
||||
pkg_postinst:${PN} () {
|
||||
touch $D${sysconfdir}/shells
|
||||
grep -q "bin/zsh" $D${sysconfdir}/shells || echo /bin/zsh >> $D${sysconfdir}/shells
|
||||
grep -q "bin/sh" $D${sysconfdir}/shells || echo /bin/sh >> $D${sysconfdir}/shells
|
||||
}
|
||||
|
||||
# work around QA failures with usrmerge installing zsh in /usr/bin/zsh instead of /bin/zsh
|
||||
# ERROR: QA Issue: /usr/share/zsh/5.8/functions/zed contained in package zsh requires /bin/zsh, but no providers found in RDEPENDS:zsh? [file-rdeps]
|
||||
# like bash does since https://git.openembedded.org/openembedded-core/commit/?id=4759408677a4e60c5fa7131afcb5bc184cf2f90a
|
||||
RPROVIDES:${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '/bin/zsh', '', d)}"
|
||||
Reference in New Issue
Block a user