Michael Marineau
9eaacc58c6
bash: function export hardening patch
...
Another day another bash version bump. This is the final version of the
patch to add a special prefix and suffix to exported functions in the
environment, preventing bugs similar to the previous two from becoming
remotely exploitable.
http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00279.html
There still remain two less significant memory-access issues, dubbed
CVE-2014-7186 and CVE-2014-7187. So expect another bump soon.
http://www.openwall.com/lists/oss-security/2014/09/25/32
2014-09-28 20:10:36 -07:00
Vito Caputo
2a1aa70606
Merge pull request #887 from vcaputo/nohpnssh
...
Disable "high performance ssh" openssh patch Gentoo includes
2014-09-26 14:59:34 -07:00
Vito Caputo
21cd882a03
Disable "high performance ssh" openssh patch Gentoo includes
...
Prioritizing security and stability over performance in SSH, omitting
this kind of patch is generally more consistent with our objectives.
Visibly this removes "-hpn14v4" from the OpenSSH protocol banner:
SSH-2.0-OpenSSH_6.6p1-hpn14v4
Discussion: https://github.com/coreos/bugs/issues/149
2014-09-26 15:18:20 -04:00
Michael Marineau
85a218d3a1
Merge pull request #886 from marineam/gsutil
...
gsutil: upgrade to 4.6, switch to using upstream ebuilds
2014-09-26 12:12:36 -07:00
Michael Marineau
b72b7dc94d
gsutil: upgrade to 4.6, switch to using upstream ebuilds
2014-09-25 22:17:10 -07:00
Michael Marineau
5cf6b403b3
go: update to go 1.3.2
2014-09-25 20:05:57 -07:00
Michael Marineau
fe831fce74
bash: fix CVE-2014-7169
...
http://www.openwall.com/lists/oss-security/2014/09/26/1
2014-09-25 18:58:28 -07:00
Michael Marineau
cc17c350cd
coreos-init: re-enable motdgen
...
Pull in https://github.com/coreos/init/pull/133
Fixes https://github.com/coreos/bugs/issues/145
2014-09-25 17:02:26 -07:00
Michael Marineau
d7f17be6cd
Merge pull request #879 from marineam/etc
...
profiles: trim more config files from /etc
2014-09-25 16:55:37 -07:00
Michael Marineau
afe2048e20
profiles: trim more config files from /etc
...
Some of these were deleted by build_image, others were still being
shipped but aren't really needed.
The big question mark is LVM, it isn't clear if LVM's default behavior
is actually sane or if the configs are needed to make it sane. Either
way we were already removing this, but something to note in case issues
crop up eventually.
2014-09-25 16:11:57 -07:00
Michael Marineau
96a4cafe23
Merge pull request #878 from marineam/bash
...
bash: disable extra performance patches and networking support
2014-09-25 15:31:13 -07:00
Michael Marineau
7a2cfade6f
bash: disable extra performance patches and networking support
...
Killing the performance patch was suggested by @vcaputo and I think we
can go without networking support as well.
2014-09-25 15:05:40 -07:00
Michael Marineau
7d654662b9
Merge pull request #877 from marineam/bash
...
bash: sync up with latest version in Gentoo
2014-09-25 14:02:19 -07:00
Michael Marineau
028dadfb13
bash: sync up with latest version in Gentoo
...
This fixes another piece of the mess but the story isn't over yet.
http://www.openwall.com/lists/oss-security/2014/09/25/10
https://bugs.gentoo.org/show_bug.cgi?id=523592
2014-09-25 13:35:16 -07:00
Alex Crawford
9fb5e1779d
Merge pull request #850 from crawford/flags
...
oems: use --oem flag when running cloudinit
2014-09-24 19:17:18 -07:00
Michael Marineau
179619b008
coreos-init: disable downloading images over ipv6 in coreos-install
...
Some users are unable to fetch images over IPv6, use IPv4 only until we
sort out what is wrong with Google storage.
2014-09-24 15:58:00 -07:00
Vito Caputo
2b72b5113b
Merge pull request #873 from vcaputo/ue_workon_bump
...
Update update_engine ebuild for oemversion support
2014-09-24 13:58:08 -07:00
Alex Crawford
0a00950f62
coreos-base/oem-rackspace-onmetal: use --oem flag
2014-09-24 13:39:19 -07:00
Alex Crawford
cc7bd7a792
coreos-base/oem-ec2-compat: use --oem flag
2014-09-24 13:38:53 -07:00
Alex Crawford
6448bf8198
coreos-base/oem-digitalocean: use --oem flag
2014-09-24 13:37:58 -07:00
Vito Caputo
ab5cd0b1bc
Update update_engine ebuild for oemversion support
2014-09-24 15:29:21 -04:00
Alex Crawford
2d27d88d32
Merge pull request #872 from crawford/bash
...
app-shells/bash: sync ebuild and patches
2014-09-24 12:21:36 -07:00
Michael Marineau
58b0fe08e2
Merge pull request #871 from marineam/cgpt
...
vboot_reference: fix cgpt with cciss block devices
2014-09-24 12:17:07 -07:00
Vito Caputo
e67ee7e0e0
Merge pull request #867 from vcaputo/oem_version
...
Propagate $PVR to the oem-*/files/cloud-config.yml files as version-id
2014-09-24 12:00:37 -07:00
Alex Crawford
46a3c6c009
app-shells/bash: sync ebuild and patches
2014-09-24 11:43:23 -07:00
Michael Marineau
cf329bbc18
vboot_reference: fix cgpt with cciss block devices
2014-09-24 11:41:07 -07:00
Michael Marineau
00e659c1ff
Merge pull request #870 from marineam/scsi
...
coreos-kernel: enable AACRAID and AIC94XX SCSI drivers
2014-09-24 11:16:23 -07:00
Michael Marineau
f23cfcf1a8
coreos-kernel: enable AACRAID and AIC94XX SCSI drivers
2014-09-24 11:05:50 -07:00
Vito Caputo
fd08f00578
Propagate $PVR to the oem-*/files/cloud-config.yml files as version-id
2014-09-24 13:55:39 -04:00
Michael Marineau
81f49d1d5c
Merge pull request #869 from marineam/ipset
...
coreos-kernel: enable support for using ipset with iptables
2014-09-24 10:53:46 -07:00
Michael Marineau
002c31ed53
coreos-kernel: enable support for using ipset with iptables
...
We enabled ipset support a while back but missed NETFILTER_XT_SET which
is needed for using ipsets in iptables rules. Enable a few other
iptables options we were missing just in case someone wants them.
2014-09-24 10:42:22 -07:00
Michael Marineau
59d368e229
Merge pull request #866 from eyakubovich/master
...
docker: wait for docker.socket to fix race in docker.service
2014-09-24 10:25:07 -07:00
Alex Crawford
9b14607d69
app-shells/bash: bump to 4.2_p48
...
Fixes a remote code execution exploit.
http://seclists.org/oss-sec/2014/q3/649
2014-09-24 10:05:50 -07:00
Eugene Yakubovich
86414187aa
docker: wait for docker.socket to fix race in docker.service
2014-09-23 12:36:26 -07:00
Michael Marineau
8d7976808d
Merge pull request #863 from marineam/oem
...
Add minimal OEM packages for Azure and Hyper-V
2014-09-22 13:25:44 -07:00
Michael Marineau
1b8b8e8b65
Add minimal OEM packages for Azure and Hyper-V
...
We can now can generate images for Azure/Hyper-V, add basic cloud config
to generate /etc/oem-release to identify these images. The Azure images
still lack support for the agent required in that environment.
2014-09-22 11:37:35 -07:00
Michael Marineau
52c2795cd1
update_engine: big dead code cleanup remove dependency on udev
2014-09-19 10:53:53 -07:00
Michael Marineau
aaf6ffbfb3
coreos-init: update to latest revision, small coreos-install update
2014-09-19 10:50:36 -07:00
Brian Waldon
12f793980b
fleet: bump to v0.8.1
2014-09-17 21:15:13 -07:00
Brian Waldon
286c858a45
Merge pull request #859 from bcwaldon/etcd-name
...
etcd: use machine-id as default name
2014-09-17 16:31:59 -07:00
Michael Marineau
dfdcc46b63
Merge pull request #860 from marineam/obj
...
Update production image exclude list
2014-09-17 16:26:14 -07:00
Michael Marineau
4c8b9dfc9d
profiles: exclude plain object files from prod images
...
There is no need to include things like glibc's lib64/crt1.o which are
only needed when compiling.
2014-09-17 15:06:20 -07:00
Michael Marineau
0c62fba05b
profiles: Move PROD_INSTALL_MASK list into prod profile
...
The variable PROD_INSTALL_MASK is no longer used, we switch to the prod
portage profile instead these days.
2014-09-17 15:03:52 -07:00
Alex Crawford
a32afdd088
coreos-base/coreos-cloudinit: bump to v0.10.3
2014-09-17 12:23:03 -07:00
Brian Waldon
bc525e53cd
etcd: use machine-id as default name
2014-09-17 11:49:34 -07:00
Greg Kroah-Hartman
4683a5a807
coreos-kernel: enable cp210x and ftdi_sio usb-serial drivers
...
Will resolve issue #856
2014-09-16 10:06:39 -07:00
Michael Marineau
7a6fc3b94b
nova-agent-watcher: fix networkd config generation
...
Pull in https://github.com/coreos/nova-agent-watcher/pull/10
2014-09-15 15:59:00 -07:00
Alex Crawford
8c9f0248b5
coreos-base/coreos-cloudinit: bump to v0.10.2
2014-09-14 08:23:11 -07:00
Alex Crawford
1474da64c7
coreos-base/coreos-cloudinit: bump to v0.10.1
2014-09-12 16:50:43 -07:00
Michael Marineau
f138d1d15c
coreos-kernel: add VIA PATA module for combo SATA/PATA chips
...
This stumped a user:
https://groups.google.com/forum/#!topic/coreos-user/XV6ObtuG_Dk
2014-09-12 10:52:15 -07:00
