staging/chunkeey/package/system, branch master

ath79: add Cisco Meraki MR18

2022-05-19T14:39:11Z

Specifications: SOC: Atheros/Qualcomm QCA9557-AT4A @ 720MHz RAM: 2x Winbond W9751G6KB-25 (128 MiB) FLASH: Hynix H27U1G8F2BTR-BC TSOP48 ONFI NAND (128 MiB) WIFI1: Atheros AR9550 5.0GHz (SoC) WIFI2: Atheros AR9582-AR1A 2.4GHz WIFI2: Atheros AR9582-AR1A 2.4GHz + 5GHz PHYETH: Atheros AR8035-A, 802.3af PoE capable Atheros (1x Gigabit LAN) LED: 1x Power-LED, 1 x RGB Tricolor-LED INPUT: One Reset Button UART: JP1 on PCB (Labeled UART), 3.3v-Level, 115200n8 (VCC, RX, TX, GND - VCC is closest to the boot set jumper under the console pins.) Flashing instructions: Depending on the installed firmware, there fastly different methods to flash a MR18. These have been documented on: Note: upgrades from AR71XX are possible, but require the force sysupgrade option. The LEDs has changed since AR71XX. The white LED is now used during the boot and when upgrading instead of the green tricolor LED. Signed-off-by: Christian Lamparter

fstools: update to git HEAD

2022-05-03T01:11:17Z

9e11b37 fstools: remove SELinux restorecon hack Signed-off-by: Daniel Golle

procd: update to git HEAD

2022-05-03T01:11:12Z

652e6df init: restore SELinux labels after policy is loaded Signed-off-by: Daniel Golle

selinux-policy: update to version 1.1

2022-05-02T20:10:43Z

try to clean up some labeling inconsistencies iwinfo loose ends ucode loose ends Makefile: adjust mintesttgt (adds blockmount/blockd) nftables: reads inherited netifd pipe ucode: reads inherited netifd pipes mountroot: fowner sandbox: writes inherited dropbear pipes unbound related to /tmp/etc/ssl unbound loose ends adds a sslconftmpfile for /tmp/etc/ssl README: maintain a wish list in the README iwinfo: netifd forgot write gptfdisk loose ends iwinfo: netifd wpad reads/writes inherited netifd fifo files netifd (mac80211.sh) executes iwinfo luci: executes wireguard luci-cgi: audits xtables execute access rcuhttpd: lists ssl certfile dirs iwinfo, wifi,nftables usage of ttyd pty if available urandomseed: seedrng needs cap_sys_admin iwinfo iwinfo, nftables and some chronyd rules related to ntp nts server nftables, wifi and adds iwinfo skel nftables, rpcd, ucode nftables, ucode and seedrng ucode, fw3/nftables, luci adds ucode skel and some fw3/nftables related urandomseed: some seedrng rules fw3 adds some support for fw4 urandomseed: /etc/seedrng is for seed.credit hotplugcal: runs ucode which is interpreter like adds a nftables skeleton and makes xtables optional agent: allow all agents to write inherited dropbear pipes urandomseed: this seems to be replaced by seedrng kmodloader: label /etc/modules.conf kmodloader.conffile Revert "shelexecfile: remove auditallow rule" Makefile: sort the modules to process by secilc Moves back to git.defensec.nl unbound odhcpd (ip) reads net proc tcp dump shelexecfile: remove auditallow rule rrd.cil: fixes indent Target rddtool from cgi-io instead of runnit it without transition rrd.cil related rrd, rpcd, cgiio clean ups related to luci-app-statistics Rules for rrd files and luci-statistics unboundcontrol ordering Several missing permissions blockmount, dnsmasq, hotplugcall, rpcd, unbound adds mctp_socket (linux 5.15) ip: forgot tc-tiny type transition to go along with the fc spec ip: adds a fc spec for tc-tiny (called by sqm) adds ttyACM fc spec and various assorted loose ends .gitattributes: do not export the github workflows workflow use selinux 3.3 project moved back to https://git.defensec.nl/selinux-policy.git Signed-off-by: Dominick Grift

fstools: update to git HEAD

2022-05-01T16:02:39Z

f0fc66a libfstools: check for overlay mounting errors 128ecaf Update / fix extroot comments 8a0ba3b libfstools: get rid of "extroot_prefix" global variable 649cd3f libfstools: use variable for overlay mount-point 922f1b3 libfstools: avoid segfault in find_mount_point ce5eacb libfstools: mtd: improve error handling 898b328 blockd: restore device_move semantics 0917d22 block: don't probe mtdblock on NAND (with legacy exceptions) Signed-off-by: Daniel Golle

urandom-seed: go back to seeding with shell script temporarily

2022-04-14T08:12:34Z

This reverts commit 2edc017a6e0cb92b72b768aaa46c6d336ad84eff. We shouldn't be using a shell script here, but the SeedRNG integration into OpenWRT requires a bit more thought. Etienne raised some important points immediately after this was merged and planned to send some follow up commits, but became busy with other things. The points he raised are important enough that we should actually back this out until it's ready to go, and then merge it as a cohesive unit. So let's revert this for now, and come back to it later on. Cc: Etienne Champetier Cc: Petr Štetiar Signed-off-by: Jason A. Donenfeld

procd: update to git HEAD

2022-04-13T18:50:55Z

6343c3a procd: completely remove tmp-on-zram support 5c5e63f uxc: fix potential NULL-pointer dereference eb03f03 jail: include necessary files for per-netns netifd instance Signed-off-by: Daniel Golle

ubox: add example /etc/modules.conf + conffiles entry

2022-04-07T10:01:56Z

Signed-off-by: Felix Fietkau

ubox: update to the latest version

2022-04-05T19:28:32Z

b87a4fdca634 kmodloader: support loading module options and blacklist from /etc/modules.conf Signed-off-by: Felix Fietkau

urandom-seed: use seedrng for seeding the random number generator

2022-03-28T07:27:56Z

The RNG can't actually be seeded from a shell script, due to the reliance on ioctls. For this reason, the seedrng project provides a basic script meant to be copy and pasted into projects like OpenWRT and tweaked as needed: . This commit imports it into the urandom-seed package and wires up the init scripts to call it. This also is a significant improvement over the current init script, which does not robustly handle cleaning up of seeds and syncing to prevent reuse. Additionally, the existing script creates a new seed immediately after writing an old one, which means that the amount of entropy might actually regress, due to failing to credit the old seed. Closes: https://github.com/openwrt/openwrt/issues/9570 Signed-off-by: Jason A. Donenfeld Signed-off-by: Petr Štetiar [fixed missing INSTALL_DIR]