Re: [ptxdist] [PATCH] openssh: Version bump. v8.8p1 -> v8.9p1

[Christian Melki <christian.melki@t2data.com>]

On 4/5/22 12:20, Michael Olbrich wrote:
> On Wed, Mar 30, 2022 at 08:53:47PM +0200, Christian Melki wrote:
>> On 3/30/22 19:48, Michael Olbrich wrote:
>>> On Wed, Mar 30, 2022 at 03:25:39PM +0200, Christian Melki wrote:
>>>> Security miss, integer overflow in the user auth path.
>>>> Not exploitable due to privsep.
>>>>
>>>> * Update license. md5crypt removed, bcrypt relicensed.
>>>> 4-Clause license removed.
>>>> * Minor spelling fixes in the license file.
>>>> * Remove configure option due to the removal of md5crypt.
>>>
>>> Fails to build here with:
>>>
>>> ssherr.c: In function 'ssh_err':
>>> ssherr.c:151:1: sorry, unimplemented: '-fzero-call-used-regs' not supported on this target
>>> make: *** [Makefile:200: ssherr.o] Error 1
>>>
>>> The stange thing is there is a configure check for it that that one
>>> succeeds:
>>>
>>> checking if arm-v7a-linux-gnueabihf-gcc supports compile flag -fzero-call-used-regs=all... yes
>>>
>>> Michael
>>>
>>
>> Ack. Will look into it. Could you please tell me which gcc version
>> you've used?
>> I've successfully built it for an armv7-a target, but I am using 11.2.
> 
> gcc 11.1 from OSELAS.Toolchain-2021.07.0. Or maybe this was triggered by
> one of the hardening options in the platformconfig:
> 
> PTXCONF_TARGET_HARDEN_STACK_STRONG=y
> PTXCONF_TARGET_HARDEN_FORTIFY=y
> PTXCONF_TARGET_HARDEN_RELRO=y
> PTXCONF_TARGET_HARDEN_BINDNOW=y
> PTXCONF_TARGET_HARDEN_PIE=y
> PTXCONF_TARGET_HARDEN_GLIBCXX_ASSERTIONS=y
> 
> Michael
> 

I have approx the same hardening enabled.
It's a new function. Introduced in GCC11 I believe?
Don't remember but I don't think ARM support was really that complete
early on. x86_64 and aarch64 should work though.

Anyway. Did the patch help?

Regards,
Christian

>>>> Signed-off-by: Christian Melki <christian.melki@t2data.com>
>>>> ---
>>>>  rules/openssh.make | 11 +++++------
>>>>  1 file changed, 5 insertions(+), 6 deletions(-)
>>>>
>>>> diff --git a/rules/openssh.make b/rules/openssh.make
>>>> index c801d8a6a..8f48e426e 100644
>>>> --- a/rules/openssh.make
>>>> +++ b/rules/openssh.make
>>>> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_OPENSSH) += openssh
>>>>  #
>>>>  # Paths and names
>>>>  #
>>>> -OPENSSH_VERSION	:= 8.8p1
>>>> -OPENSSH_MD5	:= 8ce5f390958baeeab635aafd0ef41453
>>>> +OPENSSH_VERSION	:= 8.9p1
>>>> +OPENSSH_MD5	:= f33910174f0af52491277211e2b105bb
>>>>  OPENSSH		:= openssh-$(OPENSSH_VERSION)
>>>>  OPENSSH_SUFFIX	:= tar.gz
>>>>  OPENSSH_URL	:= \
>>>> @@ -25,8 +25,8 @@ OPENSSH_URL	:= \
>>>>  
>>>>  OPENSSH_SOURCE	:= $(SRCDIR)/$(OPENSSH).$(OPENSSH_SUFFIX)
>>>>  OPENSSH_DIR	:= $(BUILDDIR)/$(OPENSSH)
>>>> -OPENSSH_LICENSE	:= BSD AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND MIT AND Beerware AND ISC
>>>> -OPENSSH_LICENSE_FILES := file://LICENCE;md5=d9d2753bdef9f19466dc7bc959114b11
>>>> +OPENSSH_LICENSE	:= BSD AND BSD-2-Clause AND BSD-3-Clause AND MIT AND Beerware AND ISC
>>>> +OPENSSH_LICENSE_FILES := file://LICENCE;md5=8baf365614c9bdd63705f298c9afbfb9
>>>>  
>>>>  # ----------------------------------------------------------------------------
>>>>  # Prepare
>>>> @@ -78,8 +78,7 @@ OPENSSH_CONF_OPT	:= \
>>>>  	--with-privsep-user=sshd \
>>>>  	--with-sandbox=$(OPENSSH_SANDBOX-y) \
>>>>  	--$(call ptx/wwo, PTXCONF_GLOBAL_SELINUX)-selinux \
>>>> -	--with-privsep-path=/var/run/sshd \
>>>> -	--without-md5-passwords
>>>> +	--with-privsep-path=/var/run/sshd
>>>>  
>>>>  # ----------------------------------------------------------------------------
>>>>  # Target-Install
>>>> -- 
>>>> 2.32.0
>>>>
>>>>
>>>> _______________________________________________
>>>> ptxdist mailing list
>>>> ptxdist@pengutronix.de
>>>> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
>>>>
>>>
>>
>>
> 


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de