kernel: Drop ld.so placeholder files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

spectre-meltdown-checker: New package

Handy to have this available to check how well a system is protected
against Spectre & Meltdown

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

.gitignore: Ignore any files edited by vim

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flashrom: New package

This tool can flash firmware on various chipsets and BIOSes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable /dev/mem

This is required to be able to flash any firmware.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: Update to 2019a

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lua: Update to 5.3

This drops the autotool patch which is unnecessary and hard
to carry around.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntp: Drop package

ntp is not really fit for purpose any more.

It fails to sync time on my systems all the time, is full
of (security) bugs and offers loads of features that we
potentially do not need.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rrdtool: Update to 1.7.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ca-certificates: Update to version from Jan 23, 2019

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

chrony: Update to 3.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iw: Update to 5.0.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.7

Enable to get randomness from getrandom() syscall instead
of opening /dev/random directly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

less: update to 530

Backporting package updates to IPFire 3.x, too...

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

guile: Update to 2.2.4

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libgcrypt: Make sure that we are building with libgpg-error >= 1.25

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gpgme: Update to 1.12.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libcap-ng: Update to 0.7.9

* Re-enabled testsuite

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Update to 8.3.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Update to 4.0.6

This is a major update to the latest 4.0 series which does not require rust.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libhtp: Update to 0.5.29

This is a minor release to the latest stable version of libhtp

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python: Update to 2.7.15

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nasm: Update to 2.14.02

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.6.6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libtasn1: Update to 4.13

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libunistring: Update to 0.9.10

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nettle: Update to 3.4.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xz: Update to 5.2.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grep: Update to 3.3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tcpdump: Update to 4.9.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

transifex-client: Drop package

We no longer use this

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mpfr: Update to 4.0.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mtr: Update to 0.92

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Update to 7.64.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flex: Update to 2.6.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Update to 2.29

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bison: Update to 3.3.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

coreutils: Update to 8.30

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.9.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcre: Enable JIT

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

htop: Update to 2.2.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Update to 5.7.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hide kernel addresses in /proc against privileged users

In order to make local privilege escalation more harder, hide
kernel addresses in various /proc files against users with
root (or similar) permissions, too.

Common system hardening tools such as lynis recommend this.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

readline: Update to 8.0

This also bumps the compat package to 7.0 so that other applications
continue to function.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dmidecode: update to 3.2

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: update to 2018i

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: enable IWLWIFI module.

IWLWIFI seems disabled by a mistake. Enable it.

fixes #11867

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tar: Update to 1.31

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ed: Update to 1.15

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

prevent kernel address space leak via dmesg or /proc files

Enable runtime sysctl hardening in order to avoid kernel
addresses being disclosed via dmesg (in case it was built
in without restrictions) or various /proc files.

See https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Recommended_Settings
for further information.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dracut: update to 048

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ccache: Update to version 3.5.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Fix compiled-in version number

When we have a .0 release of the kernel, the internal kernel
versioning is 4.20.0, but the tarball is called 4.20 only.

This causes the kernel to look for its modules in the wrong place.

This patch overwrites the compiled-in version number so that
it is in sync with the directory of the installed modules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kmod: update to 25

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Build in AT keyboard support

This is the default PS/2 keyboard on virtual machines, some laptops
and so on.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable MSR module

This is required for cpupower

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Configure cpufreq governor to performance

This patch also enabled all cpufreq drivers as modules

Fixes: #11373
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Change ASPM policy to default

Fixes: #11372
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable support for 6RD

Fixes: #11370
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: configure: Pass arch as an extra argument

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Align ARM configuration with remaining architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Use host's spinlocks when running in PV mode

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: configure: Allow passing --arch= to edit a certain configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Make all crypto acceleration a module

This will allow a slightly smaller kernel on many systems that
do not have any support for any crypto acceleration.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable some unused network protocols

This disables BATMAN (which has been dropped some time ago
from userspace), L2TP and ebtables.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Drop pcspkr patch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Update to 4.20

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Add README for guidance on how to use the configure script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable DFS support for ath*k drivers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Add support to run as a guest in Hyper-V

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable drivers for loads of proprietary devices

Those include pressure and chemical sensors and other hardware
that nobody will use for IPFire.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable drivers for obscure I/O devices

This also disables support for parallel ports.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable Bluetooth

We don't have any userspace tools for this and I think
that a firewall is unlikely to have any of those devices.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Compress modules with XZ

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Update power management settings

Build as many things as a module as possible and disable CONFIG_SUSPEND

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable CPU quirks for Intel/AMD processors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Allow running on Xen

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: configure: Allow running listnewconfig

This command lists all new unset options

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: configure: Correctly save changes

This patch fixes that sometimes changes were just ignored and
overwritten by the old settings.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: configure: Replace update command with olddefconfig

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Disable support for extended x86 platforms

We are running none of these

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Support menuconfig from configure script

It is more handy to call menuconfig directly from command line
instead of offering an interactive menu.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Automatically detect kernel source

This was a bit useless to make this a parameter because the script
can just automatically detect this...

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Update to 4.19.12

Fixes: #11914
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Don't overwrite CFLAGS and LDFLAGS in Makefile

It was intended that the CFLAGS and LDFLAGS are cleared from any (userspace)
hardening, but since 4.16, the kernel build results in a diffent kernel
that doesn't boot when these flags are cleared.

Fixes: #11817 - Update to Linux 4.18.x
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glibc: Compile with -O2

Instead of compiling with -O3, we now compile this with -O2
which is the default for the whole system. It looks like binaries
launch and perform a little bit slower than on some other
distributions, but there is no explanation to it.

This change will reduce the size of the libc and sibling libraries
which will hopefully allow to load them faster. Code might potentially
execute slower on some machines, but this impact might be less than
the startup time of the binaries.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sqlite: Update to 3.26.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

setup: Drop quagga user

Since we no longer have quagga, we don't need this any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop frr & quagga

These are replaced by bird. There is such chaos now with all these
routing daemons...

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

network: Depend on bird instead of frr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bird: Update to 2.0.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "bird: Drop package"

This reverts commit 09c3106fb13fde1c815c9513fd89b402e344c05b.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strongswan: Update to 5.7.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 3.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

systemd: Update to version 239

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

meson: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ninja: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python-lxml: Update to 4.2.5

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python-setuputils: Update to 40.4.3

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lldpd: Update to 1.0.1

This also disables sending the kernel release over
the wire and will only announce the release version
of the distribution.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>