diff --git a/chapter01/changelog.xml b/chapter01/changelog.xml index 87d542d8f..e401ee6e8 100644 --- a/chapter01/changelog.xml +++ b/chapter01/changelog.xml @@ -40,6 +40,26 @@ appropriate for the entry or if needed the entire day's listitem. --> + + 2023-09-13 + + + [xry111] - Fix CVE-2023-4806 for Glibc-2.38. Fixes + #5347. + + + + + + 2023-09-12 + + + [xry111] - Fix CVE-2023-4527 for Glibc-2.38. Fixes + #5346. + + + + 2023-09-07 diff --git a/chapter01/whatsnew.xml b/chapter01/whatsnew.xml index 6f1291ad6..e1fca225c 100644 --- a/chapter01/whatsnew.xml +++ b/chapter01/whatsnew.xml @@ -287,35 +287,20 @@ Added: - + + &glibc-upstream-fixes-patch; + - - - Removed: - diff --git a/chapter03/patches.xml b/chapter03/patches.xml index bbf09ae27..00628bda7 100644 --- a/chapter03/patches.xml +++ b/chapter03/patches.xml @@ -78,10 +78,10 @@ --> - Glibc Memalign Patch - &glibc-memalign-patch-size;: + Glibc Upstream Fixes Patch - &glibc-upstream-fixes-patch-size;: - Download: - MD5 sum: &glibc-memalign-patch-md5; + Download: + MD5 sum: &glibc-upstream-fixes-patch-md5; diff --git a/chapter08/glibc.xml b/chapter08/glibc.xml index b988b0479..e5dfedd5c 100644 --- a/chapter08/glibc.xml +++ b/chapter08/glibc.xml @@ -50,22 +50,10 @@ patch -Np1 -i ../&glibc-fhs-patch; - Now fix a regression causing the posix_memalign() function - to be very slow in some conditions: + Now fix two security vulnerabilities and a regression causing the + posix_memalign() function very slow in some conditions: -patch -Np1 -i ../&glibc-memalign-patch; - - - Then fix a security vulnerability exploitable when the - option is used in - /etc/resolv.conf: - -sed \ - -E "/__res_context_search/\ - {N;N;s/(search \(([^,]*,){6}[^,]*)NULL/\1\&alt_dns_packet_buffer/}" \ - -i resolv/nss_dns/dns-host.c +patch -Np1 -i ../&glibc-upstream-fixes-patch; The Glibc documentation recommends building Glibc in a dedicated build directory: @@ -339,7 +327,7 @@ localedef -i ja_JP -f SHIFT_JIS ja_JP.SJIS 2> /dev/null || trueCreate a new file /etc/nsswitch.conf by running the following: -cat > /etc/nsswitch.conf << "EOF" +cat > /etc/nsswitch.conf << "EOF" # Begin /etc/nsswitch.conf passwd: files @@ -354,6 +342,24 @@ services: files ethers: files rpc: files +# End /etc/nsswitch.conf +EOF + +cat > /etc/nsswitch.conf << "EOF" +# Begin /etc/nsswitch.conf + +passwd: files systemd +group: files systemd +shadow: files systemd + +hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns +networks: files + +protocols: files +services: files +ethers: files +rpc: files + # End /etc/nsswitch.conf EOF diff --git a/chapter09/network.xml b/chapter09/network.xml index c86edf56a..541ece699 100644 --- a/chapter09/network.xml +++ b/chapter09/network.xml @@ -178,9 +178,10 @@ EOF /etc/hosts - Decide on the IP address, fully-qualified domain name (FQDN), and - possible aliases for use in the /etc/hosts file. The - syntax is: + Decide on a fully-qualified domain name (FQDN), and possible aliases + for use in the /etc/hosts file. If using static IP + addresses, you'll also need to decide on an IP address. The syntax + for a hosts file entry is: IP_address myhost.example.org aliases @@ -197,11 +198,18 @@ EOF x can be any number in the range 16-31. y can be any number in the range 0-255. - A valid private IP address could be 192.168.1.1. A valid FQDN for - this IP could be lfs.example.org. + A valid private IP address could be 192.168.1.1. - Even if not using a network card, a valid FQDN is still required. - This is necessary for certain programs to operate correctly. + If the computer is to be visible to the Internet, a valid FQDN + can be the domain name itself, or a string resulted by concatenating a + prefix (often the hostname) and the domain name with a . + character. And, you need to contact the domain provider to resolve the + FQDN to your public IP address. + + Even if the computer is not visible to the Internet, a FQDN is + still needed for certain programs, such as MTAs, to operate properly. + A special FQDN, localhost.localdomain, can be used + for this purpose. Create the /etc/hosts file by running: diff --git a/chapter09/networkd.xml b/chapter09/networkd.xml index 43b7e7172..27f15e815 100644 --- a/chapter09/networkd.xml +++ b/chapter09/networkd.xml @@ -316,27 +316,18 @@ EOF x can be any number in the range 16-31. y can be any number in the range 0-255. - A valid private IP address could be 192.168.1.1. A valid FQDN for - this IP could be lfs.example.org. + A valid private IP address could be 192.168.1.1. - Even if not using a network card, a valid FQDN is still required. - This is necessary for certain programs, such as MTAs, to operate properly. + If the computer is to be visible to the Internet, a valid FQDN + can be the domain name itself, or a string resulted by concatenating a + prefix (often the hostname) and the domain name with a . + character. And, you need to contact the domain provider to resolve the + FQDN to your public IP address. - + Even if the computer is not visible to the Internet, a FQDN is + still needed for certain programs, such as MTAs, to operate properly. + A special FQDN, localhost.localdomain, can be used + for this purpose. Create the /etc/hosts file using the following command: @@ -344,28 +335,32 @@ EOF cat > /etc/hosts << "EOF" # Begin /etc/hosts -127.0.0.1 localhost.localdomain localhost -127.0.1.1 <FQDN> <HOSTNAME> -<192.168.0.2> <FQDN> <HOSTNAME> [alias1] [alias2] ... -::1 localhost ip6-localhost ip6-loopback +<192.168.0.2> <FQDN> [alias1] [alias2] ... +::1 ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters # End /etc/hosts EOF - The <192.168.0.2>, - <FQDN>, and - <HOSTNAME> values need to be + The <192.168.0.2> and + <FQDN> values need to be changed for specific uses or requirements (if assigned an IP address by a network/system administrator and the machine will be connected to an existing network). The optional alias name(s) can be omitted, and the <192.168.0.2> line can be omitted if you - are using a connection configured with DHCP or IPv6 Autoconfiguration. + are using a connection configured with DHCP or IPv6 Autoconfiguration, + or using localhost.localdomain as the FQDN. + + The /etc/hostname does not contain entries + for localhost, + localhost.localdomain, or the hostname (without a + domain) because they are handled by the + myhostname NSS module, read + the man page nss-myhostname(8) for details. The ::1 entry is the IPv6 counterpart of 127.0.0.1 and represents - the IPv6 loopback interface. 127.0.1.1 is a loopback entry reserved - specifically for the FQDN. + the IPv6 loopback interface. diff --git a/patches.ent b/patches.ent index 7bb34e656..6634d1f2f 100644 --- a/patches.ent +++ b/patches.ent @@ -14,9 +14,9 @@ - - - + + +