[Group.of.nepali.translators] [Bug 1636593] Re: Please update nginx for Xenial, Yakkety, and Zesty to 1.10.2
** Changed in: nginx (Ubuntu Zesty) Status: Triaged => Fix Released ** Changed in: nginx (Ubuntu Xenial) Status: Won't Fix => Triaged ** Changed in: nginx (Ubuntu Yakkety) Status: Won't Fix => Triaged ** Changed in: nginx (Ubuntu Xenial) Assignee: (unassigned) => Thomas Ward (teward) ** Changed in: nginx (Ubuntu Yakkety) Assignee: (unassigned) => Thomas Ward (teward) -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1636593 Title: Please update nginx for Xenial, Yakkety, and Zesty to 1.10.2 Status in nginx package in Ubuntu: Fix Released Status in nginx source package in Xenial: Triaged Status in nginx source package in Yakkety: Triaged Status in nginx source package in Zesty: Fix Released Bug description: 1.10.2 was released back in October. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/1636593/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1649931] Re: systemd-networkd needs to ensure DNS is up before network-online.target
** Also affects: resolvconf (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=847440 Importance: Unknown Status: Unknown ** Changed in: resolvconf (Ubuntu) Importance: Undecided => Medium ** Changed in: resolvconf (Ubuntu Xenial) Importance: Undecided => Medium ** Changed in: resolvconf (Ubuntu Yakkety) Importance: Undecided => Medium ** Changed in: systemd (Ubuntu) Importance: Undecided => Medium ** Changed in: systemd (Ubuntu Xenial) Importance: Undecided => Medium -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1649931 Title: systemd-networkd needs to ensure DNS is up before network- online.target Status in resolvconf package in Ubuntu: Fix Released Status in systemd package in Ubuntu: Fix Released Status in resolvconf source package in Xenial: Fix Committed Status in systemd source package in Xenial: New Status in resolvconf source package in Yakkety: Fix Committed Status in resolvconf package in Debian: Unknown Bug description: Currently resolvconf and systemd-networkd don't ensure DNS has been configured before allowing network-online.target to be reached. This was discussed in https://launchpad.net/bugs/1636912 however it was not a regression since there aren't any users of networkd + DNS early in boot at this time, it was requested that we move this DNS issue to a separate bug. [SRU] Fix: switch resolvconf.service to run Before=network-pre.target and add Wants=network-pre.target. Add a Before=network-online.target to systemd-networkd-resolvconf-update.service to ensure we update /etc/resolv.conf with DNS config prior to reaching network-online.target. Regression potential: Low. networkd is not widely being used outside of netplan/snappy in xenial. Test Case: lxc launch ubuntu-daily:xenial x1 lxc exec x1 /bin/bash # make sure you're on systemd-229-4ubuntu13 apt update && apt install -y systemd # enable networkd and netplan apt install -y nplan cat < /etc/netplan/nplan.yaml network: version: 2 ethernets: eth0: dhcp4: true EOF sed -i.orig -e 's/^source/# source/' /etc/network/interfaces netplan generate # make sure cloud-init.service uses networkd sed -i.orig -e '/After=networking.service/a After=systemd-network-wait-online.service' /lib/systemd/system/cloud-init.service reboot # check that the order of execution with: journalctl -o short-precise --unit resolvconf.service --unit network-online.target --unit systemd-networkd-wait-online.service --unit systemd-networkd-resolvconf-update.service # the order should be: 1. resolvconf: systemd[1]: Started Nameserver information manager. 2. systemd-networkd-wait-online.service: systemd[1]: Starting Wait for Network to be Configured... 3. systemd-networkd-resolvconf-update.service: systemd[1]: Started Update resolvconf for networkd DNS. 4. network-online.target: systemd[1]: Reached target Network is Online. === BAD OUTPUT === On a failing system, Reached target Network is Online occurs before (1, 2, or 3) above, like this output: Dec 15 19:18:15.233443 x4 systemd[1]: Started Nameserver information manager. Dec 15 19:18:15.797857 x4 systemd[1]: Starting Wait for Network to be Configured... Dec 15 19:18:15.799573 x4 systemd-networkd-wait-online[145]: ignoring: lo Dec 15 19:18:15.804949 x4 systemd-networkd-wait-online[145]: ignoring: lo Dec 15 19:18:15.805079 x4 systemd-networkd-wait-online[145]: ignoring: lo Dec 15 19:18:29.100305 x4 systemd[1]: Starting Update resolvconf for networkd DNS... Dec 15 19:18:29.101870 x4 systemd[1]: Started Wait for Network to be Configured. Dec 15 19:18:29.102144 x4 systemd[1]: Reached target Network is Online. Dec 15 19:18:29.212842 x4 systemd[1]: Started Update resolvconf for networkd DNS. === GOOD OUTPUT === On a passing system, Reached target Network is Online occurs after 1, 2, and 3. Dec 15 19:28:42.548545 x4 systemd[1]: Started Nameserver information manager. Dec 15 19:28:43.144389 x4 systemd[1]: Starting Wait for Network to be Configured... Dec 15 19:28:43.146155 x4 systemd-networkd-wait-online[145]: ignoring: lo Dec 15 19:28:56.081487 x4 systemd[1]: Started Wait for Network to be Configured. Dec 15 19:28:56.100353 x4 systemd[1]: Starting Update resolvconf for networkd DNS... Dec 15 19:28:56.124005 x4 systemd[1]: Started Update resolvconf for networkd DNS. Dec 15 19:28:56.124555 x4 systemd[1]: Reached target Network is Online. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/resolvconf/+bug/1649931/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.
[Group.of.nepali.translators] [Bug 1636912] Re: systemd-networkd runs too late for cloud-init.service (net)
** Changed in: systemd (Ubuntu Yakkety) Importance: Undecided => Medium ** No longer affects: resolvconf (Ubuntu Yakkety) ** No longer affects: resolvconf (Ubuntu Xenial) ** No longer affects: resolvconf (Ubuntu) ** Package changed: resolvconf (Debian) => ubuntu-translations ** Changed in: ubuntu-translations Importance: Unknown => Undecided ** Changed in: ubuntu-translations Status: Fix Committed => New ** Changed in: ubuntu-translations Remote watch: Debian Bug tracker #847440 => None ** No longer affects: ubuntu-translations ** Bug watch removed: Debian Bug tracker #847440 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=847440 -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1636912 Title: systemd-networkd runs too late for cloud-init.service (net) Status in systemd: Fix Released Status in cloud-init package in Ubuntu: Triaged Status in systemd package in Ubuntu: Fix Released Status in cloud-init source package in Xenial: Confirmed Status in systemd source package in Xenial: Fix Released Status in cloud-init source package in Yakkety: New Status in systemd source package in Yakkety: Fix Released Bug description: Ubuntu Core 16 images using cloud-init fail to function when the DataSource is over the network (Like OpenStack) as networking is not yet available when cloud-init.service runs. cloud-init service unit deps look like this: [Unit] Description=Initial cloud-init job (metadata service crawler) DefaultDependencies=no Wants=cloud-init-local.service Wants=local-fs.target Wants=sshd-keygen.service Wants=sshd.service After=cloud-init-local.service After=networking.service Requires=networking.service Before=basic.target Before=dbus.socket Before=network-online.target Before=sshd-keygen.service Before=sshd.service Before=systemd-user-sessions.service Conflicts=shutdown.target Here's networkd unit deps: [Unit] Description=Network Service Documentation=man:systemd-networkd.service(8) ConditionCapability=CAP_NET_ADMIN DefaultDependencies=no # dbus.service can be dropped once on kdbus, and systemd-udevd.service can be # dropped once tuntap is moved to netlink After=systemd-udevd.service dbus.service network-pre.target systemd-sysusers.service systemd-sysctl.service Before=network.target multi-user.target shutdown.target Conflicts=shutdown.target Wants=network.target # On kdbus systems we pull in the busname explicitly, because it # carries policy that allows the daemon to acquire its name. Wants=org.freedesktop.network1.busname After=org.freedesktop.network1.busname And a critical-chain output: root@snap-test7:~# systemd-analyze critical-chain systemd-networkd Failed to get ID: Unit name systemd-networkd is not valid. The time after the unit is active or started is printed after the "@" character. The time the unit takes to start is printed after the "+" character. root@snap-test7:~# systemd-analyze critical-chain systemd-networkd.service The time after the unit is active or started is printed after the "@" character. The time the unit takes to start is printed after the "+" character. systemd-networkd.service +440ms └─dbus.service @11.461s └─basic.target @11.403s └─sockets.target @11.401s └─dbus.socket @11.398s └─cloud-init.service @10.127s +1.266s └─networking.service @9.305s +799ms └─network-pre.target @9.295s └─cloud-init-local.service @3.822s +5.469s └─local-fs.target @3.813s └─run-cgmanager-fs.mount @12.687s └─local-fs-pre.target @1.393s └─systemd-tmpfiles-setup-dev.service @1.116s +195ms └─kmod-static-nodes.service @887ms +193ms └─system.slice @783ms └─-.slice @721ms cloud-init would need networkd to run at or before 'networking.service' so it can raise networking to then find and use network-based datasources. # grep systemd /usr/share/snappy/dpkg.list ii libnss-resolve:amd64 229-4ubuntu11 amd64nss module to resolve names via systemd-resolved ii libpam-systemd:amd64 229-4ubuntu11 amd64system and service manager - PAM module ii libsystemd0:amd64 229-4ubuntu11 amd64systemd utility library ii systemd 229-4ubuntu11 amd64system and service manager ii systemd-sysv 229-4ubuntu11 amd64system and service manager - SysV links
[Group.of.nepali.translators] [Bug 1648901] Re: SPNEGO crash on mechanism failure
** Also affects: krb5 (Ubuntu Xenial) Importance: Undecided Status: New -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1648901 Title: SPNEGO crash on mechanism failure Status in krb5 package in Ubuntu: In Progress Status in krb5 source package in Xenial: New Bug description: == SRU JUSTIFICATION == [Impact] Chrome (and other things) crash (segfault) when Kerberos fails to authenticate. Thread 22 "Chrome_IOThread" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffdd687700 (LWP 14851)] spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 2315 ../../../../src/lib/gssapi/spnego/spnego_mech.c: No such file or directory. (gdb) bt #0 spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 #1 0x7fffef72be54 in gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=, src_name=0x7fffdd685788, targ_name=0x7fffdd685750, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685780, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/mechglue/g_inq_context.c:114 [Test Case] * Reproducer It needs Kerberos to fail, while another mechanism is possible. So fix up the packaging errors noted in bug 1648898 so that GSS-NTLMSSP is actually registered properly, then just KRB5CCNAME=/dev/null google-chrome $SOME_URL_WHICH_USES_NEGOTIATE_AUTH [Regression Potential] * none expected Y and Z release already has the krb5 upstream patch. * Debian has the patch as well. [Other Info] * Upstream fix : https://github.com/krb5/krb5/commit/3beb564cea3d219efcf71682b6576cad548c2d23 * Pull Request : https://github.com/krb5/krb5/pull/385 * Chrome Bug : https://bugs.chromium.org/p/chromium/issues/detail?id=554905 == [Original Description] Chrome (and other things) crash when Kerberos fails to authenticate: https://bugs.chromium.org/p/chromium/issues/detail?id=554905 This was fixed in MIT krb5 in January: https://github.com/krb5/krb5/pull/385 Thread 22 "Chrome_IOThread" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffdd687700 (LWP 14851)] spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 2315 ../../../../src/lib/gssapi/spnego/spnego_mech.c: No such file or directory. (gdb) bt #0 spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 #1 0x7fffef72be54 in gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=, src_name=0x7fffdd685788, targ_name=0x7fffdd685750, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685780, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/mechglue/g_inq_context.c:114 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/1648901/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1648901] Re: SPNEGO crash on mechanism failure
** Changed in: krb5 (Ubuntu Xenial) Importance: Undecided => Medium ** Changed in: krb5 (Ubuntu Xenial) Assignee: (unassigned) => Eric Desrochers (slashd) ** Changed in: krb5 (Ubuntu) Status: In Progress => Fix Released ** Changed in: krb5 (Ubuntu Xenial) Status: New => Confirmed ** Changed in: krb5 (Ubuntu Xenial) Status: Confirmed => In Progress -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1648901 Title: SPNEGO crash on mechanism failure Status in krb5 package in Ubuntu: Fix Released Status in krb5 source package in Xenial: In Progress Bug description: == SRU JUSTIFICATION == [Impact] Chrome (and other things) crash (segfault) when Kerberos fails to authenticate. Thread 22 "Chrome_IOThread" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffdd687700 (LWP 14851)] spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 2315 ../../../../src/lib/gssapi/spnego/spnego_mech.c: No such file or directory. (gdb) bt #0 spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 #1 0x7fffef72be54 in gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=, src_name=0x7fffdd685788, targ_name=0x7fffdd685750, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685780, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/mechglue/g_inq_context.c:114 [Test Case] * Reproducer It needs Kerberos to fail, while another mechanism is possible. So fix up the packaging errors noted in bug 1648898 so that GSS-NTLMSSP is actually registered properly, then just KRB5CCNAME=/dev/null google-chrome $SOME_URL_WHICH_USES_NEGOTIATE_AUTH [Regression Potential] * none expected Y and Z release already has the krb5 upstream patch. * Debian has the patch as well. [Other Info] * Upstream fix : https://github.com/krb5/krb5/commit/3beb564cea3d219efcf71682b6576cad548c2d23 * Pull Request : https://github.com/krb5/krb5/pull/385 * Chrome Bug : https://bugs.chromium.org/p/chromium/issues/detail?id=554905 == [Original Description] Chrome (and other things) crash when Kerberos fails to authenticate: https://bugs.chromium.org/p/chromium/issues/detail?id=554905 This was fixed in MIT krb5 in January: https://github.com/krb5/krb5/pull/385 Thread 22 "Chrome_IOThread" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffdd687700 (LWP 14851)] spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 2315 ../../../../src/lib/gssapi/spnego/spnego_mech.c: No such file or directory. (gdb) bt #0 spnego_gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=0x0, src_name=0x7fffdd685670, targ_name=0x7fffdd685668, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685660, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/spnego/spnego_mech.c:2315 #1 0x7fffef72be54 in gss_inquire_context (minor_status=0x7fffdd68573c, context_handle=, src_name=0x7fffdd685788, targ_name=0x7fffdd685750, lifetime_rec=0x7fffdd685738, mech_type=0x7fffdd685780, ctx_flags=0x7fffdd685734, locally_initiated=0x7fffdd685730, opened=0x7fffdd68572c) at ../../../../src/lib/gssapi/mechglue/g_inq_context.c:114 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/1648901/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1646643] Re: Update hio driver to 2.1.0.28
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1646643 Title: Update hio driver to 2.1.0.28 Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: Fix Committed Status in linux source package in Yakkety: Fix Committed Status in linux source package in Zesty: Fix Released Bug description: Please update the hio driver in the Ubuntu kernel to version 2.1.0.28 as released by Huawei. I've reviewed the diff and AFAICS it contains all of our fixes (most crucially Ming Lei's blk_queue_split addition). We (Canonical IS) only need this for Linux 4.8 FWIW. I've yet to test the new version on real hardware but will try to do so shortly. The rather horrible URL to the download is below - I've also attached it as a ZIP for convenience. http://support.huawei.com/enterprise/SoftwareVersionActionNew!showVDetailNew?lang=en&idAbsPath=fixnode01|7919749|9856522|9856629|21242728&pid=21242728&vrc=21243470|21243471|21243473|21992501&from=soft&tab=bz&bz_vr=21243471&bz_vrc=&nbz_vr=null To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1646643/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1643652] Re: [17.04 FEAT] Build IMA and the TPM device drivers into the KVM on POWER host/NV kernel
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1643652 Title: [17.04 FEAT] Build IMA and the TPM device drivers into the KVM on POWER host/NV kernel Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: In Progress Status in linux source package in Yakkety: In Progress Status in linux source package in Zesty: Fix Released Bug description: Update the kernel config such that the I2C TPM device drivers and their dependencies are built into the kernel so that IMA can start measuring from the first file the kernel loads from storage: CONFIG_TCG_TPM=y CONFIG_TCG_TIS_I2C_ATMEL=y CONFIG_TCG_TIS_I2C_INFINEON=y CONFIG_TCG_TIS_I2C_NUVOTON=y Also update IMA and EVM config options and their dependencies such that IMA and EVM are enabled: CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 CONFIG_IMA_LSM_RULES=y CONFIG_IMA_SIG_TEMPLATE=y CONFIG_IMA_DEFAULT_TEMPLATE="ima-sig" CONFIG_IMA_DEFAULT_HASH_SHA256=y CONFIG_IMA_DEFAULT_HASH="sha256" CONFIG_IMA_READ_POLICY=y CONFIG_IMA_APPRAISE=y CONFIG_IMA_TRUSTED_KEYRING=y CONFIG_IMA_LOAD_X509=y CONFIG_IMA_X509_PATH="y" CONFIG_EVM=y CONFIG_EVM_ATTR_FSUUID=y CONFIG_EVM_LOAD_X509=y CONFIG_EVM_X509_PATH="y" To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1643652/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1646204] Re: Kernel Fixes to get TCMU File Backed Optical to work
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1646204 Title: Kernel Fixes to get TCMU File Backed Optical to work Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: In Progress Status in linux source package in Yakkety: In Progress Status in linux source package in Zesty: Fix Released Bug description: == Comment: #2 - BRYANT G. LY - 2016-11-30 12:16:05 == Need all of these patches in Xenial 4.4 kernel and 4.8 kernel. Under review: https://www.spinics.net/lists/target-devel/msg13628.html [PATCH] target/user: Fix use-after-free of tcmu_cmds if they are expired Already Released in Yaketty but need it in Xenial: Released in Ubuntu-4.8.0-7.8: UBUNTU: SAUCE: Return TCMU-generated sense data to fabric module Released under: linux (4.8.0-28.30) [PATCH 1/3] UBUNTU: SAUCE: (noup) target/user: Use sense_reason_t in tcmu_queue_cmd_ring [PATCH 2/3] UBUNTU: SAUCE: (noup) target/user: Return an error if cmd data size is too large [PATCH 3/3] UBUNTU: SAUCE: (noup) target/user: Fix comments to not refer to data ring To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1646204/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1645591] Re: Driver for Exar USB UART
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1645591 Title: Driver for Exar USB UART Status in HWE Next: Fix Committed Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: Fix Committed Status in linux source package in Yakkety: Fix Committed Bug description: Driver can be found at https://www.exar.com/design-tools/software-drivers To manage notifications about this bug go to: https://bugs.launchpad.net/hwe-next/+bug/1645591/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1642299] Re: Fix Kernel Crashing under IBM Virtual Scsi Driver
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1642299 Title: Fix Kernel Crashing under IBM Virtual Scsi Driver Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: Fix Committed Status in linux source package in Yakkety: Fix Committed Status in linux source package in Zesty: Fix Released Bug description: Kernel crashes running large amounts of deployment using Ibmvscsis driver. Contact Information = Bryant Ly/b...@us.ibm.com Stack trace output: [ 1780.861532] Faulting instruction address: 0xc0583de0 [ 1780.861542] Oops: Kernel access of bad area, sig: 11 [#1] [ 1780.861549] SMP NR_CPUS=2048 NUMA pSeries [ 1780.861557] Modules linked in: ip6table_filter ip6_tables xt_tcpudp iptable_mangle ebt_arp ebt_among ebtable_filter ebtables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_filter ip_tables x_tables bridge stp llc target_core_user uio target_core_pscsi target_core_file dccp_diag target_core_iblock iscsi_target_mod dccp tcp_diag udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc pseries_rng ibmvmc(OE) rtc_generic ib_iser rdma_cm iw_cm ib_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 mlx4_en vxlan ip6_udp_tunnel udp_tunnel ses enclosure ibmvscsis target_core_mod configfs ibmveth mlx4_core megaraid_sas ahci libahci [ 1780.861707] CPU: 22 PID: 35128 Comm: tcmu-runner Tainted: GW OE 4.4.13-customv7 #22 [ 1780.861718] task: c001e6f50080 ti: c001e6fd task.ti: c001e6fd [ 1780.861727] NIP: c0583de0 LR: d65c1b04 CTR: c0583da0 [ 1780.861736] REGS: c001e6fd3950 TRAP: 0300 Tainted: GW OE (4.4.13-customv7) [ 1780.861745] MSR: 80009033 CR: 48004484 XER: 2000 [ 1780.861770] CFAR: c0008468 DAR: 12a0 DSISR: 4000 SOFTE: 0 GPR00: d65c1974 c001e6fd3bd0 d65cba00 1298 GPR04: 12b8 c001fe664468 0018 646920726f662064 GPR08: 0007 0001 1298 d65c2870 GPR12: c0583da0 c7add100 GPR16: 3fffae67 0002 0001 GPR20: c001e99032e8 c001e9903300 f000 GPR24: c001e9903340 d660 d6600080 GPR28: c001e9902000 0080 f0019800 c001fe664458 [ 1780.861901] NIP [c0583de0] __bitmap_xor+0x40/0x60 [ 1780.861910] LR [d65c1b04] tcmu_handle_completions+0x394/0x510 [target_core_user] [ 1780.861919] Call Trace: [ 1780.861926] [c001e6fd3bd0] [d65c1974] tcmu_handle_completions+0x204/0x510 [target_core_user] (unreliable) [ 1780.861942] [c001e6fd3cd0] [d65c1cac] tcmu_irqcontrol+0x2c/0x50 [target_core_user] [ 1780.861956] [c001e6fd3d00] [d6561798] uio_write+0x98/0x140 [uio] [ 1780.861966] [c001e6fd3d50] [c02dda0c] __vfs_write+0x6c/0xe0 [ 1780.861977] [c001e6fd3d90] [c02de740] vfs_write+0xc0/0x230 [ 1780.861988] [c001e6fd3de0] [c02df77c] SyS_write+0x6c/0x110 [ 1780.861999] [c001e6fd3e30] [c0009204] system_call+0x38/0xb4 [ 1780.862007] Instruction dump: [ 1780.862013] 78c60020 3944fff8 38c6 38a5fff8 78c61f48 3863fff8 7c843214 4814 [ 1780.862033] 6000 6000 6000 6042 e9050009 7faa2040 7d294278 [ 1780.862056] ---[ end trace 212caf961ccdad3d ]--- A series of patches will fix this issue. ibmvscsis: Rearrange functions for future patches ibmvscsis: Synchronize cmds at tpg_enable_store time ibmvscsis: Synchronize cmds at remove time ibmvscsis: Clean up properly if target_submit_cmd/tmr fails ibmvscsis: Return correct partition name/# to client ibmvscsis: Issues from Dan Carpenter/Smatch http://www.spinics.net/lists/linux-scsi/msg100569.html The patch has been accepted and applied to 4.10/scsi-queue. scsi: ibmvscsis: Rearrange functions for future patches https://kernel.googlesource.com/pub/scm/linux/kernel/git/mkp/scsi/+/fbbcc033a20a6af94eeb8fa995668ed5051be111 scsi: ibmvscsis: Synchronize cmds at tpg_enable_store time
[Group.of.nepali.translators] [Bug 1642368] Re: linux: Staging modules should be unsigned
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: In Progress => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1642368 Title: linux: Staging modules should be unsigned Status in linux package in Ubuntu: Fix Released Status in linux source package in Trusty: In Progress Status in linux source package in Xenial: Fix Committed Status in linux source package in Yakkety: In Progress Status in linux source package in Zesty: Fix Released Bug description: Modules under the drivers/staging hierarchy get little attention when it comes to vulnerabilities. It is possible that memory mapping tricks that expose kernel internals would go unnoticed. Therefore, do not sign staging modules so that they cannot be loaded in a secure boot environment. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1642368/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1642228] Re: Move some kernel modules to the main kernel package
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1642228 Title: Move some kernel modules to the main kernel package Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: Fix Committed Status in linux source package in Yakkety: Fix Committed Status in linux source package in Zesty: Fix Released Bug description: == Comment: #0 - Breno Henrique Leitao - 2016-10-20 08:51:24 == Hello Canonical, There are important kernel modules that are required on POWER systems, and they are currently on the linux-image-extra packages. So, in this case, every Power system needs to install the -extra package, which makes the -extra package required. My suggestion is to add these important modules to the main archive, so, we do not require the installation of the -extra package. We are working on the full list of packages, but I would like to anticipate these modules: 01. lpfc 02. qla2xxx 03. be2net 04. bnx2x 05. i40e 06. igb 07. ixgbe 08. cxl 09. cxlflash 10. jsm 11. ohci-platform 12. xhci 13. aacraid 14. ipr 15. megaraid_sas 16. mpt3sas 17. powernv-rng 18. ipmi_powernv 19. leds-powernv 20. ibmpowernv 21. opal-prd 22. powernv_flash 23. nx-compress-powernv 24. vfio (all modules: vfio.ko, vfio-pci.ko, vfio_iommu_spapr_tce.ko, vfio_virqfd.ko, vfio_spapr_eeh.ko) *Notice* The driver "qlge" is presented in the preliminary list but it's not necessary. Thanks in advance, To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1642228/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1625222] Re: d-i is missing usb support for platforms that use the xhci-platform driver
This bug was fixed in the package linux - 4.9.0-11.12 --- linux (4.9.0-11.12) zesty; urgency=low * Miscellaneous Ubuntu changes - UBUNTU: SAUCE: Add '-fno-pie -no-pie' to cflags for x86 selftests - UBUNTU: SAUCE: (no-up) aufs: for v4.9-rc1, support setattr_prepare() [ Upstream Kernel Changes ] * rebase to v4.9 -- Tim Gardner Mon, 12 Dec 2016 06:40:40 -0700 ** Changed in: linux (Ubuntu Zesty) Status: In Progress => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1625222 Title: d-i is missing usb support for platforms that use the xhci-platform driver Status in linux package in Ubuntu: Fix Released Status in linux source package in Xenial: Fix Committed Status in linux source package in Yakkety: Fix Committed Status in linux source package in Zesty: Fix Released Bug description: [Impact] Any platform that gets usb support from the xhci-platform driver does not have usb enabled in d-i. [Test Case] Boot into d-i and attempt to use a usb device, i.e. keyboard. [Regression Risk] Extremely low as this is a driver that is already present in the kernel. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1625222/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1623418] Re: gcc-as-needed.diff patch broke mpx support in GCC
This bug was fixed in the package binutils - 2.27.51.20161212-1ubuntu1 --- binutils (2.27.51.20161212-1ubuntu1) zesty; urgency=medium * Merge with Debian; remaining changes: - Build from upstream sources. -- Matthias Klose Mon, 12 Dec 2016 14:07:30 +0100 ** Changed in: binutils (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1623418 Title: gcc-as-needed.diff patch broke mpx support in GCC Status in gcc: Unknown Status in binutils package in Ubuntu: Fix Released Status in gcc-5 package in Ubuntu: New Status in gcc-6 package in Ubuntu: Fix Released Status in binutils source package in Xenial: New Status in gcc-5 source package in Xenial: New Bug description: gcc-5 from Ubuntu is configured with MPX support, but it is broken due to always-added linker option "-as-needed". Here is the GCC upstream bug & fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77267 https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=240057 Would it be possible to backport this fix to Ubuntu gcc-5 build? To manage notifications about this bug go to: https://bugs.launchpad.net/gcc/+bug/1623418/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1623418] Re: gcc-as-needed.diff patch broke mpx support in GCC
This bug was fixed in the package gcc-6 - 6.2.1-7ubuntu1 --- gcc-6 (6.2.1-7ubuntu1) zesty; urgency=medium * Merge with Debian; remaining changes: - Build from upstream sources. gcc-6 (6.2.1-7) unstable; urgency=medium * GCC 6.3.0 release candidate. * Update to SVN 20161215 (r243686, 6.2.1) from the gcc-6-branch. - Fix PR libstdc++/78465, PR c++/78761, PR c++/78252, PR target/59874, PR target/78796, PR tree-optimization/77673, PR target/72717 (PPC), PR rtl-optimization/71496, PR c++/78701. * Drop build dependency on g++-5. * Fix PR c++/78774, proposed for the gcc-6-branch. * Apply patches for zlib security issues CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843. * Ignore dpkg's pie specs when pie is not enabled. Addresses: #848129. -- Matthias Klose Thu, 15 Dec 2016 22:50:24 +0100 ** Changed in: gcc-6 (Ubuntu) Status: New => Fix Released ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2016-9840 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2016-9841 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2016-9842 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2016-9843 -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1623418 Title: gcc-as-needed.diff patch broke mpx support in GCC Status in gcc: Unknown Status in binutils package in Ubuntu: Fix Released Status in gcc-5 package in Ubuntu: New Status in gcc-6 package in Ubuntu: Fix Released Status in binutils source package in Xenial: New Status in gcc-5 source package in Xenial: New Bug description: gcc-5 from Ubuntu is configured with MPX support, but it is broken due to always-added linker option "-as-needed". Here is the GCC upstream bug & fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77267 https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=240057 Would it be possible to backport this fix to Ubuntu gcc-5 build? To manage notifications about this bug go to: https://bugs.launchpad.net/gcc/+bug/1623418/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1647467] Re: InRelease file splitter treats getline() errors as EOF
This bug was fixed in the package apt - 1.4~beta2 --- apt (1.4~beta2) unstable; urgency=high [ John R. Lenton ] * bash-completion: Only complete understood file paths for install (LP: #1645815) [ Julian Andres Klode ] * SECURITY UPDATE: gpgv: Check for errors when splitting files (CVE-2016-1252) Thanks to Jann Horn, Google Project Zero for reporting the issue (LP: #1647467) * gpgv: Flush the files before checking for errors -- Julian Andres Klode Thu, 08 Dec 2016 15:21:16 +0100 ** Changed in: apt (Ubuntu Zesty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1647467 Title: InRelease file splitter treats getline() errors as EOF Status in apt package in Ubuntu: Fix Released Status in apt source package in Trusty: Fix Released Status in apt source package in Xenial: Fix Released Status in apt source package in Yakkety: Fix Released Status in apt source package in Zesty: Fix Released Bug description: We have just been made aware of a security bug upstream that affects the validation of signatures on InRelease file. This bug is to track progress for it. It allows for attacking a repository via MITM attacks, circumventing the signature of the InRelease file. It works by making a call to getline() fail with ENOMEM, which is not documented as an error for that but follows from the fact that getline() can allocate memory. In such a case, apt would treat the first part of the file as a valid release file. = Original bug report = From: Jann Horn To: secur...@debian.org Cc: Date: Mon, 5 Dec 2016 18:33:09 +0100 Subject: apt: repository signing bypass via memory allocation failure == Vulnerability == When apt-get updates a repository that uses an InRelease file (clearsigned Release files), this file is processed as follows: First, the InRelease file is downloaded to disk. In a subprocess running the gpgv helper, "apt-key verify" (with some more arguments) is executed through the following callchain: gpgv.cc:main -> pkgAcqMethod::Run -> GPGVMethod::URIAcquire -> GPGVMethod::VerifyGetSigners -> ExecGPGV ExecGPGV() splits the clearsigned file into payload and signature using SplitClearSignedFile(), calls apt-key on these two files to perform the cryptographic signature verification, then discards the split files and only retains the clearsigned original. SplitClearSignedFile() ignores leading and trailing garbage. Afterwards, in the parent process, the InRelease file has to be loaded again so that its payload can be processed. At this point, the code isn't aware anymore whether the Release file was clearsigned or split-signed, so the file is opened using OpenMaybeClearSignedFile(), which first attempts to parse the file as a clearsigned (InRelease) file and extract the payload, then falls back to treating the file as the file as a split-signed (Release) file if the file format couldn't be recognized. The weakness here is: If an attacker can create an InRelease file that is parsed as a proper split-signed file during signature validation, but then isn't recognized by OpenMaybeClearSignedFile(), the "leading garbage" that was ignored by the signature validation is interpreted as repository metadata, bypassing the signing scheme. It first looks as if it would be impossible to create a file that is recognized as split-signed by ExecGPGV(), but isn't recognized by OpenMaybeClearSignedFile(), because both use the same function, SplitClearSignedFile(), for parsing the file. However, multiple executions of SplitClearSignedFile() on the same data can actually have different non-error results because of a bug. SplitClearSignedFile() uses getline() to parse the input file. A return code of -1, which signals that either EOF or an error occured, is always treated as EOF. The Linux manpage only lists EINVAL (caused by bad arguments) as possible error code, but because the function allocates (nearly) unbounded amounts of memory, it can actually also fail with ENOMEM if it runs out of memory. Therefore, if an attacker can cause the address space in the main apt-get process to be sufficiently constrained to prevent allocation of a large line buffer while the address space of the gpgv helper process is less constrained and permits the allocation of a buffer with the same size, the attacker can use this to fake an end-of-file condition in SplitClearSignedFile() that causes the file to be parsed as a normal Release file. A very crude way to cause such a constraint on a 32-bit machine is based on abusing ASLR. Because ASLR randomizes the address space after each execve(), thereby altering how much contiguous virtual memory is available, an allocatio
