[v2] util-linux: security bump to version 2.31

Fix CVE-2016-2779: runuser in util-linux allows local users to escape to
the parent session via a crafted TIOCSTI ioctl call, which pushes
characters to the terminal's input buffer.

The new experimental "su --pty" feature has been implemented to fix this
issue. The feature is not enabled by default and the new command line
option --pty is necessary.

Add rfkill, a command for enabling and disabling wireless devices. This
implementation is based upon, and backward compatible with, the original
rfkill from Johannes Berg and Marcel Holtmann, currently provided by the
standalone "rfkill" package.

Add uuidparse, a command to analyze and print information about UUID's.

The "reset" script is not part of utill-linux anymore. Add a legacy
config telling the user to use either BusyBox or the ncurses program.

Drop the ncursesw patch, allready applied upstream. AUTORECONF is not
required anymore.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
---
Changes v1->v2:
- Rebased due to parallel modifications in Config.in.legacy and commit
  5868ab5f22300e920474005e3ae4f78e0b210473, which removed
  PKG_VERSION_MINOR.
---
 Config.in.legacy                                   |  8 +++
 ...upport-ncursesw-without-headers-in-ncurse.patch | 58 ----------------------
 package/util-linux/Config.in                       | 13 +++--
 package/util-linux/util-linux.hash                 |  4 +-
 package/util-linux/util-linux.mk                   | 15 +++---
 5 files changed, 25 insertions(+), 73 deletions(-)
 delete mode 100644 package/util-linux/0001-build-sys-support-ncursesw-without-headers-in-ncurse.patch

>>>>> "Carlos" == Carlos Santos <casantos@datacom.ind.br> writes:

 > Fix CVE-2016-2779: runuser in util-linux allows local users to escape to
 > the parent session via a crafted TIOCSTI ioctl call, which pushes
 > characters to the terminal's input buffer.

 > The new experimental "su --pty" feature has been implemented to fix this
 > issue. The feature is not enabled by default and the new command line
 > option --pty is necessary.

 > Add rfkill, a command for enabling and disabling wireless devices. This
 > implementation is based upon, and backward compatible with, the original
 > rfkill from Johannes Berg and Marcel Holtmann, currently provided by the
 > standalone "rfkill" package.

Do you know if there's any reason to prefer this version over our
existing rfkill package? The fact that it isn't available on nommu
probably means we cannot get rid of the separate package, but we may
want to add it to UTIL_LINUX_DEPENDENCIES so the util-linux version
"wins".

 > Add uuidparse, a command to analyze and print information about UUID's.

 > The "reset" script is not part of utill-linux anymore. Add a legacy
 > config telling the user to use either BusyBox or the ncurses program.

 > Drop the ncursesw patch, allready applied upstream. AUTORECONF is not
 > required anymore.

 > Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
 > ---
 > Changes v1->v2:
 > - Rebased due to parallel modifications in Config.in.legacy and commit
 >   5868ab5f22300e920474005e3ae4f78e0b210473, which removed
 >   PKG_VERSION_MINOR.

Sorry about that - Committed, thanks!

> From: "Peter Korsgaard" <peter@korsgaard.com>
> To: "Carlos Santos" <casantos@datacom.ind.br>
> Cc: buildroot@buildroot.org
> Sent: Tuesday, October 31, 2017 8:04:33 PM
> Subject: Re: [PATCH v2] util-linux: security bump to version 2.31

>>>>>> "Carlos" == Carlos Santos <casantos@datacom.ind.br> writes:
> 
> > Fix CVE-2016-2779: runuser in util-linux allows local users to escape to
> > the parent session via a crafted TIOCSTI ioctl call, which pushes
> > characters to the terminal's input buffer.
> 
> > The new experimental "su --pty" feature has been implemented to fix this
> > issue. The feature is not enabled by default and the new command line
> > option --pty is necessary.
> 
> > Add rfkill, a command for enabling and disabling wireless devices. This
> > implementation is based upon, and backward compatible with, the original
> > rfkill from Johannes Berg and Marcel Holtmann, currently provided by the
> > standalone "rfkill" package.
> 
> Do you know if there's any reason to prefer this version over our
> existing rfkill package? The fact that it isn't available on nommu
> probably means we cannot get rid of the separate package, but we may
> want to add it to UTIL_LINUX_DEPENDENCIES so the util-linux version
> "wins".

I think this one is preferable because util-linux is actively maintained
while the original rfkill seems to be abandoned (the last commit in its
git repository is from Jan 8 2015).

How many nommu architectures does Buildroot support? The only boards I
found without BR2_USE_MMU were qemu_{arm_versatile,xtensa_lx60}_nommu,
which obviously do not even have RF radios to turn on/off.

>>>>> "Carlos" == Carlos Santos <casantos@datacom.ind.br> writes:

Hi,

 >> Do you know if there's any reason to prefer this version over our
 >> existing rfkill package? The fact that it isn't available on nommu
 >> probably means we cannot get rid of the separate package, but we may
 >> want to add it to UTIL_LINUX_DEPENDENCIES so the util-linux version
 >> "wins".

 > I think this one is preferable because util-linux is actively maintained
 > while the original rfkill seems to be abandoned (the last commit in its
 > git repository is from Jan 8 2015).

Ok.

 > How many nommu architectures does Buildroot support? The only boards I
 > found without BR2_USE_MMU were qemu_{arm_versatile,xtensa_lx60}_nommu,
 > which obviously do not even have RF radios to turn on/off.

It is indeed probably a quite rare combination. Perhaps we should get
rid of the separate rfkill package then and add Config.in.legacy
handling for it selecting the util-linux option?

Volkov, you added the rfkill package. Any issues with moving to the
util-linux variant instead?

> From: "Peter Korsgaard" <peter@korsgaard.com>
> To: "Carlos Santos" <casantos@datacom.ind.br>, sv99@inbox.ru
> Cc: buildroot@buildroot.org
> Sent: Thursday, November 2, 2017 7:00:02 AM
> Subject: Re: [PATCH v2] util-linux: security bump to version 2.31

>>>>>> "Carlos" == Carlos Santos <casantos@datacom.ind.br> writes:
> 
> > How many nommu architectures does Buildroot support? The only boards I
> > found without BR2_USE_MMU were qemu_{arm_versatile,xtensa_lx60}_nommu,
> > which obviously do not even have RF radios to turn on/off.
> 
> It is indeed probably a quite rare combination. Perhaps we should get
> rid of the separate rfkill package then and add Config.in.legacy
> handling for it selecting the util-linux option?
> 
> Volkov, you added the rfkill package. Any issues with moving to the
> util-linux variant instead?

I already submitted a patch to remove the rfkill package:

    https://patchwork.ozlabs.org/patch/828969/

On 01-11-17 02:34, Carlos Santos wrote:
>> From: "Peter Korsgaard" <peter@korsgaard.com>
>> To: "Carlos Santos" <casantos@datacom.ind.br>
>> Cc: buildroot@buildroot.org
>> Sent: Tuesday, October 31, 2017 8:04:33 PM
>> Subject: Re: [PATCH v2] util-linux: security bump to version 2.31
> 
>>>>>>> "Carlos" == Carlos Santos <casantos@datacom.ind.br> writes:
>>
>>> Fix CVE-2016-2779: runuser in util-linux allows local users to escape to
>>> the parent session via a crafted TIOCSTI ioctl call, which pushes
>>> characters to the terminal's input buffer.
>>
>>> The new experimental "su --pty" feature has been implemented to fix this
>>> issue. The feature is not enabled by default and the new command line
>>> option --pty is necessary.
>>
>>> Add rfkill, a command for enabling and disabling wireless devices. This
>>> implementation is based upon, and backward compatible with, the original
>>> rfkill from Johannes Berg and Marcel Holtmann, currently provided by the
>>> standalone "rfkill" package.
>>
>> Do you know if there's any reason to prefer this version over our
>> existing rfkill package? The fact that it isn't available on nommu
>> probably means we cannot get rid of the separate package, but we may
>> want to add it to UTIL_LINUX_DEPENDENCIES so the util-linux version
>> "wins".
> 
> I think this one is preferable because util-linux is actively maintained
> while the original rfkill seems to be abandoned (the last commit in its
> git repository is from Jan 8 2015).
> 
> How many nommu architectures does Buildroot support? The only boards I
> found without BR2_USE_MMU were qemu_{arm_versatile,xtensa_lx60}_nommu,
> which obviously do not even have RF radios to turn on/off.

stm32f429_disco_defconfig and stm32f469_disco_defconfig are NOMMU. I don't think
these two have RF, but STM32L4 Discovery boards do have Wifi, Bluetooth, NFC and
900 MHz radio. Probably not supported by rfkill however :-)

 Anyway, if anybody needs it, the MMU requirement of libsmartcols could be
removed. It is only there for the pager functionality which is not used by
either libsmartcols or rfkill, but just happens to be linked into the .so file...

 Regards,
 Arnout