staging/stintel/package/system, branch master

ubus: update to Git HEAD (2026-10-28)

2026-10-28T13:03:26Z

db20eff5535f libubus: add a pre-invoke callback for resolved object methods Signed-off-by: Robert Marko

rpcd: update to Git HEAD (2026-10-28)

2026-10-28T13:03:26Z

469d7852316e session: enforce session ACLs for non-root ubus callers Signed-off-by: Robert Marko

ca-certificates: blacklist "emSign ECC Root CA - G3"

2026-10-20T23:42:36Z

This blacklists the "emSign ECC Root CA - G3" CA certificate which issued some intermediate CA certificates for eMudhra with 8 bit private keys between 0 and 255. "Comodo AAA Services root" is also blacklisted by Debian, but already removed in update 20260223. Link: https://github.com/openwrt/openwrt/pull/26066 Signed-off-by: Hauke Mehrtens

fstools: update to git HEAD of 2026-10-18

2026-10-20T09:28:12Z

907cf44 block: take down a share that left the configuration c681289 block: report a helper failure without a synthetic errno b46809f blockd: log an automount request at info level 8740de0 block: mount network filesystems from fstab d82a150 blockd: take a deregistered mount down without probing /dev 627d0eb block: allow an explicit filesystem type in fstab 519681d block: use the umount helper when one exists 86ad409 blockd: expire autofs mounts asynchronously 6f8e823 blockd: answer autofs misses asynchronously ee8de6e blockd: report a failed fork to the caller of block() 039d712 block: call the mount helper on any mount(2) failure 9f85f3c block: reject an unusable filesystem type 6e717b1 block: report the mount helper exit status c1e1260 block: exit the mount helper child properly ccf7160 block: fix mount option string overflow 207d8fe mount_root: honor fstools_overlay_name in done Signed-off-by: Daniel Golle

procd: update to git HEAD of 2026-10-18

2026-10-19T08:55:56Z

A large number of generic procd, ujail and container related fixes and improvements. See https://git.openwrt.org/project/procd/log/ for the detailed history since commit 6a22d39648. uxc keeps the per-run files of a container, the last exit record, the generated environment file and the resources override, in /tmp/run/uxc//. The pre-remove hook only stops a package container and deletes it from procd, so that directory stays behind until the next reboot. Remove it in the post-remove hook together with the state and settings of the container. When a container package is upgraded to a new image, the pre-install hook only signals the old container and leaves its instance in procd. The bring-up after the install then adds the container with once, which procd refuses for a container it already has, so the new image starts only after the next reboot. Delete the old container in the pre-install hook, as the pre-remove hook does. uxc kill without a signal returns once the container has stopped, procd forgets a deleted container, and the bring-up starts the new image. Signed-off-by: Daniel Golle

procd: assign conventional /dev/net/tun permissions

2026-10-11T07:57:57Z

Set /dev/net/tun to mode 0666, matching the TUN/TAP permissions documented by docs.kernel.org[1] and the default udev policy used by other Linux systems[2]. This avoids forcing otherwise unprivileged processes to retain elevated privileges solely to open the device node. Interface creation and attachment remain subject to the kernel's usual capability and ownership checks. [1] https://docs.kernel.org/networking/tuntap.html#configuration [2] https://github.com/systemd/systemd/blob/be1e78ec49f8c84c634d9e58dae834b27ea28436/rules.d/50-udev-default.rules.in#L111 Signed-off-by: Gary Dotzler Link: https://github.com/openwrt/openwrt/pull/25464 Signed-off-by: Nick Hainke

procd: update to Git HEAD (2026-10-07)

2026-10-08T07:19:35Z

457721d7544d jail: drop the deferred path's own mount-propagation remount 66a33c82f755 jail: keep locked flags on phase-2 read-only remounts 0925850d765b jail: keep locked flags when remounting a noafile mask ac855770e3b2 jail: apply root_map_uid to a joined user namespace 7f1b26ce3759 jail: join an external userns after build_jail_fs() 88fe395b2cd5 jail: fail on an unresolvable -j specification 638c2ecfaf8a jail: let a joined namespace replace the created one 56e1a2032e0d jail: factor out the MS_* to MOUNT_ATTR_* translation 8c9df2b8ae32 jail: mount sysfs in the parent when the jail lacks a netns 4021843627a4 jail: log a failing mask mount fa1f24c84ce7 jail: drop all capabilities for a bundle that names none 5670ff93498d uxc: report every failure with one exit status 6a22d3964822 service: add per-instance 'vrf' option Allow to set the new 'vrf' instance option with procd_set_param. It binds all sockets of a service to a VRF device, like 'ip vrf exec': procd_set_param vrf Assisted-by: Claude:claude-opus-5-5 Assisted-by: Claude:claude-fable-5-1 Link: https://github.com/openwrt/openwrt/pull/25568 Signed-off-by: Nick Hainke

video-support: put the V4L2 nodes in the video group

2026-10-05T19:09:55Z

The rule placed every video4linux and media node in video-capture, but most are not capture devices: on an rk3588 board five of the six V4L2 nodes are the RGA blitter and the Hantro and rkvdec stateless codecs, and only the HDMI receiver captures anything. A media player then had to join video-capture to reach a decoder, which also granted it every camera on the box. Put the DRM and media nodes in video, and add v4l-id, which runs VIDIOC_QUERYCAP and prefers device_caps over capabilities so that what it describes is the node. Given a device alone it prints one boolean per V4L2_CAP_ flag as JSON. Given a rule string as well, a list of CAP[,CAP...]:GROUP separated by semicolons in which * matches any node, it puts the node into the group of the first rule which matches it. The rule string is parsed in full before the device is opened, so a capability name the kernel does not define is reported whichever rule it appears in, and no node is touched. A V4L2 node is created with no group and v4l-id assigns one, since exec is queued by procd and may not run at all; holding the node at root until the driver answers keeps a camera out of video. Signed-off-by: Daniel Golle

rpcd: update to Git HEAD (2026-10-04)

2026-10-04T15:05:52Z

d99f703e4035 session: stop naming runtime files after the session id Link: https://github.com/openwrt/openwrt/pull/25587 Signed-off-by: Hauke Mehrtens

ubus: update to Git HEAD (2026-09-25)

2026-09-29T15:29:25Z

cd51fc0031ff libubus: refuse to send a message the peer must reject 9ba1ab795b2f libubus: drop the connection when a message cannot be read ce54d7a956a5 ubusd_main: free partially received message on client disconnect 6b5c6f166db4 ubusd_main: free queued lookup commands on client disconnect b012bc067515 ubusd_acl: use SO_PEERGROUPS instead of parsing /proc for peer gids 955ff3f7030c ubusd: fix use-after-free when resuming a queued object lookup fb1dd8e0d7c8 ubusd: document the bound on the pending-message body read 3a39a800f162 libubus-req: fix double close of the fd in ubus_complete_deferred_request 4d60031579d2 libubus: fix msgbuf leak on ubus_channel_connect error path 91b0dadfd1ed libubus-req: fix error check on the __ubus_notify_async result 82416940eae8 libubus-io: do not resend the fd on partial writes in writev_retry 618f3cf75ae3 libubus-obj: fix fd leaks on object message error paths 2f52ae367c93 ubusd_main: flush the tx queue after freeing the client's objects cdb648c3283a ubusd_obj: propagate subscription allocation failure to the client 7c5c06825daf ubusd_proto: fix double close of forwarded invoke fd d8fec00656a6 ubusd: keep the fd alive while a message waits in the tx queue bde609c2400e ubusd_acl: copy the filename used as the ACL file vlist key 008655958eb4 ubusd_acl: do not treat unresolvable ACL user/group names as id 0 5331c00f37f7 ubusd_event: document reserved event namespace forgery check ef37ed207183 ubusd_event: use an unsigned type for the event dedup sequence e12ad4bd667f ubusd: flag event messages as not expecting a reply 9d709c536cd6 ubusd_event: report allocation failure as out of memory 5170a5818b54 ubusd: use canonical SCM_RIGHTS extraction on the receive path 8dfee69c250c ubusd_main: do not abort startup when the default socket dir fails 17f78610d771 ubusd: disconnect the client when a partially sent message is dropped f5e5836704c8 cli: parse monitored payloads with the untrusted blob parser 11e411e36f08 libubus: close the passed fd when the request exceeds the size limit cbc27b66d813 ubusd: stop writing to a client already flagged for disconnect 2ec13d49ba37 libubus: do not restart the ACL query while one is in flight 297baef62eee libubus: free queued pending messages on shutdown 17525550a36b ubus/lua: fix Lua stack imbalance on policy allocation failure fdd9ff1fe0fc ubus/lua: copy the Lua strings stored in registered objects eb5a8284d176 ubusd: close the forwarded fd when the invoke reply cannot be built 3930745d8593 tests/fuzz: fix out-of-bounds read in header validation harness b27014cf7978 tests/fuzz: use size of blob_attr, not of a pointer, in length guard 414c60a2e29e ubus/lua: store event handler ref without polluting the callback table Signed-off-by: Felix Fietkau