Releases: MidnightBSD/src
2.1.0
MidnightBSD 2.1
I’m happy to announce the availability of MidnightBSD 2.1 for amd64 and i386. This is an incremental release focusing on bug fixes, improvements to the package manager and a new system compiler.
LLVM updated to 10.0.1
mport 2.1.4
Upgrade Process
Install git if you don’t have it already mport install git
Fetch MidnightBSD from git via github.com/midnightbsd/src.git (assumes you don’t have /usr/src populated) git clone https://github.com/MidnightBSD/src.git
Checkout the stable/2.1 branch git checkout stable/2.1 cd /usr/src; make clean buildworld buildkernel;
mergemaster -p
make installkernel
reboot
(if it works OK, login and go to /usr/src)
make installworld
mergemaster -iU
cd /usr/src/usr.bin/perl; make; make install;
Update installed mports/packages
cd /usr/src/; make check-old; make delete-old
Bug Fixes and new features
The majority of improvements come from the MidnightBSD package manager, mport. A number of longstanding bugs have been fixed. It now can update dependencies properly on install, update or upgrade scenarios. Previously, it would sometimes crash and force the user to do it manually. Several fixes have been made around PLIST processing.
mport now sets a character encoding so that extracting files with libarchive with special characters is more likely to work properly without a crash occurring. (lang/go port is a fun trigger of this bug)
libmport no long relies on libdispatch. This is slower in a few scenarios, but most invocations are now faster as it doesn't need to setup the thread pools or do the locking it once did. This makes sense as package installs have a lot of serial code paths. Also fixed many memory leaks as well as some use after free and invalid free calls against the wrong pointer. We're now using sha256 for hashing plist entries installed.
We now generate a os-release file on system startup in /var/run
Fixed issue where looking at some man pages would cause man to crash in MidnightBSD.
A bug in the firstboot script was corrected that referenced an invalid package name.
burncd was removed.
Fixed some temp file handling bugs
Fixed some problems with libcxxrt and rtld in MidnightBSD that would cause strange problems with 32bit binaries.
Fix the buggy mdnsd 'mdns' sed in the /etc/rc.d/mdnsd script that would often cause it to fail to modify /etc/nsswitch.conf on system startup as needed.
libcasper(3) creates service processes by forking the calling process, so they initially inherit the calling process' file descriptor table. Casper services expect the lowest 3 file descriptors, traditionally corresponding to standard input, output, and error, are redirected to /dev/null. libcasper(3) ensures this is the case. However, it did not handle the possibility that one of them is closed, and this scenario would trigger an assertion failure during service creation, resulting in a crash.
Security Fixes
Apache Portable Runtime CVE workaround. CVE-2021-35940
A programming error in the Linux compatibility layer futex(2) system call might allow attackers to cause a denial of service.
Certain VirtIO-based device models failed to handle errors when fetching I/O descriptors. Such errors could be triggered by a malicious guest. As a result, the device model code could be tricked into operating on uninitialized I/O vectors, leading to memory corruption.
The ggatec(8) daemon does not validate the size of a response before writing it to a fixed-sized buffer. This allows to overwrite the stack of ggatec(8).
The passive mode in FTP communication allows an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for *p == '\0' one byte too late because p++ was already performed.
A programming error in the Linux compatibility layer futex(2) system call might allow attackers to cause a denial of service.
libcasper(3) creates service processes by forking the calling process, so they initially inherit the calling process' file descriptor table. Casper services expect the lowest 3 file descriptors, traditionally corresponding to standard input, output, and error, are redirected to /dev/null. libcasper(3) ensures this is the case. However, it did not handle the possibility that one of them is closed, and this scenario would trigger an assertion failure during service creation, resulting in a crash.
A particular case of memory sharing is mishandled in the virtual memory system. It is possible and legal to establish a relationship where multiple descendant processes share a mapping which shadows memory of an ancestor process. In this scenario, when one process modifies memory through such a mapping, the copy-on-write logic fails to invalidate other mappings of the source page. These stale mappings may remain even after the mapped pages have been reused for another purpose.
Due to a race condition between lookup of ".." and remounting a filesystem, a process running inside a jail might access filesystem hierarchy outside of jail.
Fix a security issue with pam. The rules would not be applied correctly.
xen fix to unmap correctly when errors occur
Fix a extattr corruption bug with ufs
Uninitialized kernel stack leaks in several file systems
Xen guests can triger backend Out Of Memory
The root certificates of the Mozilla CA Certificate Store have been updated.
Fixed a security problem with zlib:
Handle case where inflateSync used when header never processed. If zlib and/or gzip header processing was requested, but a header was never provided and inflateSync was used successfully, then the inflate state would be inconsistent, trying to compute a check value but with no flags set. This commit sets the inflate mode to raw in this case, since there is no other assumption that can be made if a header was requested but never seen.
3rd Party Software
mandoc
LLVM 10.0.1
APR-util 1.6.1/li>
APR 1.7.0
Subversion 1.14.0
file 5.39
sendmail 8.16.1
sqlite3 3.35.5
tzdata 2021a
libarchive 3.5.0
unbound 1.13.0
xz 5.2.5
openmp
Hardware
Added sume(4) - NetFPGA SUME 4x10Gb Ethernet driver
JMicron JMB582/JMB585 AHCI
Add deprecation notices to ctau and cx drivers
Update e1000 driver for Intel gigabit NICs
evdev - fix a panic when removing a usb mouse
ichwd - Add Atom C3000 watchdog ID
ismt - fix a left shift bug
Fix intrhook release in MFI
Add support for BCM54618SE PHY
mlx5 - Account out of buffer as dropped packets in mlx5en(4)
netmap: ixl: add CRC to outbound frames
nvme bug fixes
Sync nxge driver with FreeBSD
Don't consider PCIe hot-plug command timeout fatal
add Bitron Video AV2010/10 ZigBee USB Stick
Various bug fixes to usb, vxge
Known Issues
We're in the process of building new i386 packages as many important ones for desktop use are missing at the moment.
2.0.8
2.0.7
2.0.6
2.0.5 - Happy 15th Anniversary
Fixes a security issue with PAM.
Switches to sysrc for firstboot script rc.conf configuration
mport 2.0.5
tzdata 2021a
2.0.4 Add xinitrc to user directory
add initial xinitrc
MidnightBSD 2.0.3 RELEASE
Provides a security patch for OpenSSL and a /dev/devstat change for defaults to allow libgtop to work out of the box.
MidnightBSD 2.0.2 RELEASE
Fix a security issue in ICMPv6.
Update tzdata to 2020d to fix issues with systems telling the incorrect time in some time zones.
Remove burncd
Update and improve the built in certificate handling in 2.0 and refresh certs.
Fix a typo with the firstboot script
MidnightBSD 2.0.1 RELEASE
Fixes issues with UEFI not booting on amd64.
MidnightBSD 2.0 RELEASE
MidnightBSD 2.0
11/9/2020
I’m happy to announce the availability of MidnightBSD 2.0 for amd64 and i386. This is a massive release focusing on base system improvements.
We’ve imported many features from FreeBSD 11.x as part of the release.
LLVM updated to 8.0.1
ELF ToolChain updated
OpenSSL updated
ZFS now supports parallel mounting
Kernel logs jail IDs when a process exits
Network firmware updates
Updated DRM code is now in mports for 2.0 and later. This allows us to update it outside of a release.
Upgrade Process
Due to the nature of the release, there are a few minor build issues when upgrading from MidnightBSD 1.2.x by source. Please follow this awkward procedure:
(you can also do this with svnlite using github)
Install git if you don’t have it already
mport install git
Fetch MidnightBSD from git via github.com/midnightbsd/src.git (assumes you don’t have /usr/src populated)
git clone https://github.com/MidnightBSD/src.git
Checkout the stable/2.0 branch
git checkout stable/2.0
Using your favorite editor (ee, vi, nano, gedit, … ) open the src/usr.bin/Makefile
Comment out with #
.if defined(LINKER_FEATURES) && ${LINKER_FEATURES:Mfilter}
SUBDIR= perl
.WAIT
.endif
cd /usr/src; make clean buildworld buildkernel;
mergemaster -p
make installkernel
reboot
(if it works OK, login and go to /usr/src)
make installworld
mergemaster -iU
cd /usr/src/usr.bin/perl; make; make install;
Open src/usr.bin/Makefile again and uncomment the previous lines (in case you do a rebuild later)
Update installed mports/packages
cd /usr/src/; make check-old; then run make delete-old
When you are done, verify that perl is updated by running perl -v
You should have perl 5.32.0. If it says perl 5.28, be sure to upgrade perl!
Bug Fixes and new features
The default devd.conf(5) has been updated to prevent duplicated hostapd(8) and wpa_supplicant(8) startup via devd(8).
The cpuset(1), sockstat(1), ipfw(8), and ugidfw(8) utilities have been updated to support jail(8) names.
The newfs_msdos(8) utility has been updated to include a new flag, -T, which is used to specify the timestamp for build reproducibility.
The dd(1) utility has been updated to add a new statusoperand, progress, which reports the current status on a single line every second.
The last(1) utility has been updated to include libxo(3) support.
The lastlogin(8) utility has been updated to include libxo(3) support.
The traceroute(8) utility has been updated to include libcasper(3) support.
The trim(8) utility has been added, which deletes content for blocks on flash-based storage devices that use wear-leveling algorithms.
The newfs(8) and tunefs(8) utilities have been updated to allow underscores in label names.
The newfs(8) and tunefs(8) utilities have been updated to allow dashes in label names.
The fdisk(8) utility has been updated to support sectors larger than 2048 bytes.
The sh(1) utility has been updated to add the pipefail option which simplifies checking the exit status of all commands in a pipeline.
The spi(8) utility has been added, which is used to communicate with devices on an SPI bus through the userland.
An issue that could result in a system hang during ZFS vnode reclamation has been fixed.
The functionality provided by zfsloader has been added to loader(8). Once the system boot blocks have been updated, zfsloader is not needed.
The ipfw(8) firewall has been updated to include new rule options, record-state, set-limit, and defer-action.
Support for NAT64 CLAT has been added, as defined in RFC6877.
The ln(1) utility has been updated to correct the behavior of the -F flag by unlinking an existing directory before creating a symbolic link.
The crontab(1) utility has been updated to include a new flag, -f, which forces crontab(5) removal when -r is used non-interactively.
The newsyslog(8) utility has been updated to support RFC5424-compliant messages when rotating system logs.
The sesutil(8) utility has been updated to include libxo(3) support in output.
The diskinfo(8) utility has been updated to include two new flags, -s which displays the disk identity (usually the serial number), and -p which displays the physical path to the disk in a storage controller. The -s and -p flags are mutually exclusive, and cannot be used with any other flags.
The diskinfo(8) utility has also been updated to include the device model when the -s flag is used.
The top(1) utility has been updated to allow filtering on multiple user names when the -U flag is used.
The bsdgrep(1) utility has been updated to include a rgrep hard link to grep(1), which when used is equivalent to grep -r.
The bsdgrep(1) utility has been updated to address various issues with pattern matching behavior.
The umount(8) utility has been updated to include a new flag, -N, which is used to forcefully unmount an NFS mounted filesystem.
The pw(8) utility has been updated to properly handle empty secondary group lists as an argument to the -G flag when using the usermod subcommand.
The getconf(1) utility has been updated to include a new flag, -a, which prints the name and value of all system or path configuration values to stdout(4) or optionally a file as an argument to -a.
The ps(1) utility has been updated to reflect realtime and idle priorities in state flags.
The ps(1) utility has been updated to display if a process is running with capsicum(4) capability mode, indicated by C.
The cpucontrol(8) utility has been updated to include a new flag, -n, that disables the default microcode update search path when used.
The fsck_ffs(8) utility has been updated to prevent a filesystem from being reported as modified when only the timestamp in the superblock is updated.
The diskinfo(8) utility has been updated to display disk rotation rate and if TRIM/UNMAP is supported by the disk.
The rsh(1) utility has been updated to include a new flag, -N, which disables shutdown of a socket sending path when used.
The pfctl(8) utility has been updated to allow route-to to properly handle network interfaces with multiple IP addresses.
The camcontrol(8) utility has been updated to include ZAC (Zoned-device ATA command set) information when the identify subcommand is used.
The pw(8) utility has been updated to correct handling of account expiration periods.
The mdmfs(8) utility has been updated to support tmpfs(5).
The lint(1) utility is no longer built by default. The WITH_LINT src.conf(5) option has been added to enable building and installing the utility.
The cpucontrol(8) utility has been updated to include a new flag, -e, which is used to re-evaluate reported CPU features after applying firmware updates.
The indent(1) utility has been updated to respect the SIMPLE_BACKUP_SUFFIX environment variable if set.
The du(1) utility has been updated to include the --si long option, which is used to display output in "human-readable" output in powers of 1000.
The df(1) utility has been updated to include the --si long option, which is an alias to -H.
The service(8) utility has been updated to include a new flag, -j, which is used to interact with services running within a jail(8). The argument to -j can be either the name or numeric jail ID.
The fsck_ffs(8) utility has been updated to exit with a non-zero status when the filesystem is not repaired.
The nvmecontrol(8) utility has been updated to print the full 128 bit value for SMART data, instead of the hexadecimal value.
The nvmecontrol(8) utility has been updated to include control options for Western Digital® HGST drives. The new options are cap-diag, get-crash-dump, drive-log, purge, and purge-monitor.
The dhclient(8) utility has been updated to be more compliant with RFC2131 by setting the source address field in the IP header to 0 when sending a DHCPREQUEST message to attempt to obtain a previously-assigned IP address.
The pw(8) utility has been updated to allow the @ and ! characters in the GECOS field.
The zfsd(8) utility has been updated to work with any type of GEOM provider, including md(4), geli(8), glabel(8), and gstripe(8).
The ps(1) utility has been updated to include a jail keyword, which when used will list the name of a jail(8) instead of the numeric ID.
The mlx5tool(8) utility has been added, which is used to manage Connect-X 4 and Connect-X 5 devices supported by mlx5io(4).
The sysctl(8) utility has been updated to support setting an array of values to nodes. Prior to this change, sysctl(8) could only set one value to a node that may return multiple values when queried.
The ifconfig(8) utility has been updated to include a random option, which when used with the ether option, generates a random MAC address for an interface
The efibootmgr(8) utility has been added, which is used to manipulate the EFI boot manager.
The etdump(1) utility has been added, which is used to view El Torito boot catalog information.
The mount(8) utility has been updated to allow fallback to mount media read-only if an attempt to mount write-protected media read-write fails. This behavior is disabled by default, and can be requested with the new autoro option
The makefs(8) utility has been updated to default the block and fragment sizes to match that of newfs(8), 32K and 4K, respectively.
The pwd_mkdb(8) utility has been updated to emit a notice that legacy database support will be removed when the -l flag is used.
The dhclient(8) utility has been updated to allow the interface-mtu option to be overridden with a supersede entry in dhclient.conf(5)
The linux(4) ABI compatibility layer has been updated to include support for musl consumers.
The fdescfs(5) filesystem has been updated to support Linux®-specific fd(4) /dev/fd and /proc/self/fd behavior.
The ng_iface(4) driver has been updated to prevent a possible system crash.
The ipfw(4) packet filter has been updated to i...