libre/linux-libre: add Arch Linux security patches and fix objtool issue

1 files changed, 37 insertions, 1 deletions

diff --git a/libre/linux-libre/PKGBUILD b/libre/linux-libre/PKGBUILD
index ddcb8831d..61d972543 100644
--- a/libre/linux-libre/PKGBUILD
+++ b/libre/linux-libre/PKGBUILD
@@ -56,6 +56,13 @@ source=(
   # other patches
   '0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch'
   '0002-fix-Atmel-maXTouch-touchscreen-support.patch'
+  '0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch'
+  '0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch'
+  '0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch'
+  '0004-Revert-xfrm-Fix-stack-out-of-bounds-read-in-xfrm_sta.patch'
+  '0005-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch'
+  '0006-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch'
+  '0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch'
   )
 sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e684147ebed91d1528d2685423dd784c5fca0f3650f874f2b93cfc6b7689b9a87f'
             'SKIP'
@@ -85,7 +92,14 @@ sha512sums=('0d4b0b8ec1ffc39c59295adf56f6a2cccf77cad56d8a8bf8072624bbb52ba3e6841
             '6c93bc1e8d580af288921e10c456bdbda1dcb6d6f08c111cddaf9a32b43c2df41b50136bc09aaac1da9c3cae667bba6e075d590dcc465107ae6e2c3dcf7da657'
             'f813d51834cedc23fabbb6060709a24f29969fea5aeb963fdeddb79723014ffc0c6d34be45eea8419d5087a5a9c561a42a113d667f03625283f2f2fc68196545'
             '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af'
-            'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168')
+            'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168'
+            '05f2c577450cfeae4b66a7d022a9dd0dab0dbf36e9738423efa8f45aaf0755b48a89f1f88b042946205e681458f76c5c5177c16869094839b7b234e0e2b27511'
+            'fd9bdc818326fa36c9f1813d0d1821de5e325b646e1c307c197ad38bada7f298d35b4bc1bbf1c2854689f3ba71144879e799a1123037caccd6e3f64edfc22d54'
+            '814517d08c35cc886fe3382619d41107d6139a703c27186d0ce58e187eaf4e84891572e58246750ac8602555794ed6f74d946565b98860787a0aa617fb946dda'
+            '7a5a6edf0879e59437b03166882e5afdc2dea9087819b1ada3aee22861a041896e305f136c61f0b8365cddff34852620fe2b3c51b5408d4c243a840b3dfe3059'
+            'e6605e923c967b5f8db619868b15ea5b0d4254c62cf12bb920f38659933d6ca25a643d3e044c4915a8309071461f5f14c55d0aa0329c113bce4780d4fa3afbb7'
+            '0dec1482efe6e5d762a3061f365e43191484f055b738112452b8ca39e162b935d99cf16b25c0b253d6b532fabc54bde2f5c09be91887156ed6ae06d1558f94b9'
+            'fda8b429d98b9017e0d72c91054c53afec6fab41abb06724bc1ce020863956215a3cdeb7692297d533d7426f8e2cc7f8d03c2570abf71e4b1d4f41fdb5fe63f0')
 validpgpkeys=(
   '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva
   '6DB9C4B4F0D8C0DC432CF6E4227CA7C556B2BA78' # David P.
@@ -108,6 +122,7 @@ prepare() {
   if [ "${_pkgbasever}" != "${_pkgver}" ]; then
     patch -p1 -i ../patch-${_pkgbasever}-${_pkgver}
   fi
+  chmod +x tools/objtool/sync-check.sh  # GNU patch doesn't support git-style file mode
 
   if [ "${CARCH}" = "armv7h" ]; then
     # RCN patch (CM3 firmware deblobbed and AUFS removed)
@@ -132,8 +147,29 @@ prepare() {
   install -m644 -t drivers/video/logo \
     "${srcdir}/logo_linux_"{clut224.ppm,vga16.ppm,mono.pbm}
 
+  # security patches
+    
   # add latest fixes from stable queue, if needed
   # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
+  
+  # disable USER_NS for non-root users by default
+  patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
+
+  # https://bugs.archlinux.org/task/56575
+  patch -Np1 -i ../0002-e1000e-Fix-e1000_check_for_copper_link_ich8lan-retur.patch
+
+  # https://nvd.nist.gov/vuln/detail/CVE-2017-8824
+  patch -Np1 -i ../0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch
+
+  # https://bugs.archlinux.org/task/56605
+  patch -Np1 -i ../0004-Revert-xfrm-Fix-stack-out-of-bounds-read-in-xfrm_sta.patch
+  patch -Np1 -i ../0005-xfrm-Fix-stack-out-of-bounds-read-on-socket-policy-l.patch
+
+  # https://bugs.archlinux.org/task/56846
+  patch -Np1 -i ../0006-cgroup-fix-css_task_iter-crash-on-CSS_TASK_ITER_PROC.patch
+
+  # For AMD processors, keep PTI off by default
+  #patch -Np1 -i ../0007-x86-cpu-x86-pti-Do-not-enable-PTI-on-AMD-processors.patch
 
   # maintain the TTY over USB disconnects
   # http://www.coreboot.org/EHCI_Gadget_Debug