160 lines
3.7 KiB
Markdown
160 lines
3.7 KiB
Markdown
|
---
|
||
|
|
categories: ['Syspatch']
|
||
|
|
date: 2021-10-31T15:34:28+02:00
|
||
|
|
description: "Correctifs OpenBSD: nsd + bpf + uipc"
|
||
|
|
draft: false
|
||
|
|
tags: ['Syspatch','kernel','uipc','bpf','6.9','7.0']
|
||
|
|
title: "Syspatchs : nsd, bpf, uipc (2021/10/31)"
|
||
|
|
---
|
||
|
|
|
||
|
|
## Correctif de fiabilité : nsd
|
||
|
|
|
||
|
|
**Dans certaines configurations, nsd peut se couper à distance et tomber en rade. Ce correctif est uniquement valable sur OpenBSD 7.0.**
|
||
|
|
|
||
|
|
- Architecture ciblée : toutes les architectures supportées par le projet.
|
||
|
|
|
||
|
|
## Correctif de fiabilité : bpf
|
||
|
|
|
||
|
|
**Ouvrir /dev/bpf trop rapidement et/ou trop souvent peut conduire à un crash du noyau système.**
|
||
|
|
|
||
|
|
- Architecture ciblée : toutes les architectures supportées par le projet.
|
||
|
|
|
||
|
|
## Correctif de sécurité : uipc
|
||
|
|
|
||
|
|
**Le noyau système peut laisser échapper des informations mémoire lors de la fermeture de sockets Unix.**
|
||
|
|
|
||
|
|
- Architecture ciblée : toutes les architectures supportées par le projet.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
Pour toutes les architectures supportées :
|
||
|
|
- amd64, arm64, i386 par `syspatch`
|
||
|
|
- armv7, hppa, landisk, loongson, luna88k, macppc, sparc64 par [recompilation](#recompilation)
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Syspatch
|
||
|
|
|
||
|
|
Cette étape ne concerne que les architectures amd64, arm64, i386 !
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# syspatch
|
||
|
|
```
|
||
|
|
|
||
|
|
Ensuite [redémarrez](#restart) la machine !
|
||
|
|
|
||
|
|
## Recompilation
|
||
|
|
|
||
|
|
Pour toute autre architecture prise en charge par le projet OpenBSD, voici
|
||
|
|
les étapes de recompilation nécessaires :
|
||
|
|
|
||
|
|
Après avoir téléchargé le correctif, vérifiez-le, et appliquez-le :
|
||
|
|
|
||
|
|
### patch nsd
|
||
|
|
|
||
|
|
Ce correctif ne concerne que 7.0 !
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# wget https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/001_nsd.patch.sig
|
||
|
|
# signify -Vep /etc/signify/openbsd-70-base.pub -x 001_nsd.patch.sig \
|
||
|
|
-m - | (cd /usr/src && patch -p0)
|
||
|
|
```
|
||
|
|
|
||
|
|
- la phase de recompilation :
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
$ cd /usr/src/usr.sbin/nsd
|
||
|
|
# make -f Makefile.bsd-wrapper obj
|
||
|
|
# make -f Makefile.bsd-wrapper
|
||
|
|
# make -f Makefile.bsd-wrapper install
|
||
|
|
```
|
||
|
|
|
||
|
|
Ensuite [redémarrez](#restart) le service nsd, si utilisé
|
||
|
|
|
||
|
|
### patch bpf
|
||
|
|
|
||
|
|
- pour 7.0
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# wget https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/002_bpf.patch.sig
|
||
|
|
# signify -Vep /etc/signify/openbsd-70-base.pub -x 002_bpf.patch.sig \
|
||
|
|
-m - | (cd /usr/src && patch -p0)
|
||
|
|
```
|
||
|
|
|
||
|
|
- pour 6.9
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# wget https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/019_bpf.patch.sig
|
||
|
|
# signify -Vep /etc/signify/openbsd-69-base.pub -x 019_bpf.patch.sig \
|
||
|
|
-m - | (cd /usr/src && patch -p0)
|
||
|
|
```
|
||
|
|
|
||
|
|
- la phase de recompilation :
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
$ KK=`sysctl -n kern.osversion | cut -d# -f1`
|
||
|
|
$ cd /usr/src/sys/arch/`machine`/compile/$KK
|
||
|
|
# make obj
|
||
|
|
# make config
|
||
|
|
# make
|
||
|
|
# make install
|
||
|
|
```
|
||
|
|
|
||
|
|
Ensuite [redémarrez](#restart) la machine !
|
||
|
|
|
||
|
|
### patch uipc
|
||
|
|
|
||
|
|
- pour 7.0
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# wget https://ftp.openbsd.org/pub/OpenBSD/patches/7.0/common/003_uipc.patch.sig
|
||
|
|
# signify -Vep /etc/signify/openbsd-70-base.pub -x 003_uipc.patch.sig \
|
||
|
|
-m - | (cd /usr/src && patch -p0)
|
||
|
|
```
|
||
|
|
|
||
|
|
- pour 6.9
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# wget https://ftp.openbsd.org/pub/OpenBSD/patches/6.9/common/020_uipc.patch.sig
|
||
|
|
# signify -Vep /etc/signify/openbsd-69-base.pub -x 020_uipc.patch.sig \
|
||
|
|
-m - | (cd /usr/src && patch -p0)
|
||
|
|
```
|
||
|
|
|
||
|
|
- la phase de recompilation :
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
$ KK=`sysctl -n kern.osversion | cut -d# -f1`
|
||
|
|
$ cd /usr/src/sys/arch/`machine`/compile/$KK
|
||
|
|
# make obj
|
||
|
|
# make config
|
||
|
|
# make
|
||
|
|
# make install
|
||
|
|
```
|
||
|
|
|
||
|
|
Ensuite [redémarrez](#restart) la machine !
|
||
|
|
|
||
|
|
## Restart
|
||
|
|
|
||
|
|
* le service **nsd** est à redémarrer, si utilisé, sur 7.0
|
||
|
|
|
||
|
|
```ksh
|
||
|
|
# rcctl restart nsd
|
||
|
|
# reboot
|
||
|
|
```
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Documentations
|
||
|
|
|
||
|
|
Plus d'informations sur les pages d'Errata [7.0][1] et [6.9][2]… <br>
|
||
|
|
*et leurs versions FR respectives : [7.0 FR][3] et [6.9 FR][4].*
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
[1]: https://openbsd.org/errata70.html
|
||
|
|
[2]: https://openbsd.org/errata69.html
|
||
|
|
[3]: https://wiki.openbsd.fr.eu.org/doku.php/openbsd.org/errata70
|
||
|
|
[4]: https://wiki.openbsd.fr.eu.org/doku.php/openbsd.org/errata69
|
||
|
|
|
||
|
|
|