staging/xback/package/system, branch master

procd: update to git HEAD of 2026-10-18

2026-10-19T08:55:56Z

A large number of generic procd, ujail and container related fixes and improvements. See https://git.openwrt.org/project/procd/log/ for the detailed history since commit 6a22d39648. uxc keeps the per-run files of a container, the last exit record, the generated environment file and the resources override, in /tmp/run/uxc//. The pre-remove hook only stops a package container and deletes it from procd, so that directory stays behind until the next reboot. Remove it in the post-remove hook together with the state and settings of the container. When a container package is upgraded to a new image, the pre-install hook only signals the old container and leaves its instance in procd. The bring-up after the install then adds the container with once, which procd refuses for a container it already has, so the new image starts only after the next reboot. Delete the old container in the pre-install hook, as the pre-remove hook does. uxc kill without a signal returns once the container has stopped, procd forgets a deleted container, and the bring-up starts the new image. Signed-off-by: Daniel Golle

procd: assign conventional /dev/net/tun permissions

2026-10-11T07:57:57Z

Set /dev/net/tun to mode 0666, matching the TUN/TAP permissions documented by docs.kernel.org[1] and the default udev policy used by other Linux systems[2]. This avoids forcing otherwise unprivileged processes to retain elevated privileges solely to open the device node. Interface creation and attachment remain subject to the kernel's usual capability and ownership checks. [1] https://docs.kernel.org/networking/tuntap.html#configuration [2] https://github.com/systemd/systemd/blob/be1e78ec49f8c84c634d9e58dae834b27ea28436/rules.d/50-udev-default.rules.in#L111 Signed-off-by: Gary Dotzler Link: https://github.com/openwrt/openwrt/pull/25464 Signed-off-by: Nick Hainke

procd: update to Git HEAD (2026-10-07)

2026-10-08T07:19:35Z

457721d7544d jail: drop the deferred path's own mount-propagation remount 66a33c82f755 jail: keep locked flags on phase-2 read-only remounts 0925850d765b jail: keep locked flags when remounting a noafile mask ac855770e3b2 jail: apply root_map_uid to a joined user namespace 7f1b26ce3759 jail: join an external userns after build_jail_fs() 88fe395b2cd5 jail: fail on an unresolvable -j specification 638c2ecfaf8a jail: let a joined namespace replace the created one 56e1a2032e0d jail: factor out the MS_* to MOUNT_ATTR_* translation 8c9df2b8ae32 jail: mount sysfs in the parent when the jail lacks a netns 4021843627a4 jail: log a failing mask mount fa1f24c84ce7 jail: drop all capabilities for a bundle that names none 5670ff93498d uxc: report every failure with one exit status 6a22d3964822 service: add per-instance 'vrf' option Allow to set the new 'vrf' instance option with procd_set_param. It binds all sockets of a service to a VRF device, like 'ip vrf exec': procd_set_param vrf Assisted-by: Claude:claude-opus-5-5 Assisted-by: Claude:claude-fable-5-1 Link: https://github.com/openwrt/openwrt/pull/25568 Signed-off-by: Nick Hainke

video-support: put the V4L2 nodes in the video group

2026-10-05T19:09:55Z

The rule placed every video4linux and media node in video-capture, but most are not capture devices: on an rk3588 board five of the six V4L2 nodes are the RGA blitter and the Hantro and rkvdec stateless codecs, and only the HDMI receiver captures anything. A media player then had to join video-capture to reach a decoder, which also granted it every camera on the box. Put the DRM and media nodes in video, and add v4l-id, which runs VIDIOC_QUERYCAP and prefers device_caps over capabilities so that what it describes is the node. Given a device alone it prints one boolean per V4L2_CAP_ flag as JSON. Given a rule string as well, a list of CAP[,CAP...]:GROUP separated by semicolons in which * matches any node, it puts the node into the group of the first rule which matches it. The rule string is parsed in full before the device is opened, so a capability name the kernel does not define is reported whichever rule it appears in, and no node is touched. A V4L2 node is created with no group and v4l-id assigns one, since exec is queued by procd and may not run at all; holding the node at root until the driver answers keeps a camera out of video. Signed-off-by: Daniel Golle

rpcd: update to Git HEAD (2026-10-04)

2026-10-04T15:05:52Z

d99f703e4035 session: stop naming runtime files after the session id Link: https://github.com/openwrt/openwrt/pull/25587 Signed-off-by: Hauke Mehrtens

ubus: update to Git HEAD (2026-09-25)

2026-09-29T15:29:25Z

cd51fc0031ff libubus: refuse to send a message the peer must reject 9ba1ab795b2f libubus: drop the connection when a message cannot be read ce54d7a956a5 ubusd_main: free partially received message on client disconnect 6b5c6f166db4 ubusd_main: free queued lookup commands on client disconnect b012bc067515 ubusd_acl: use SO_PEERGROUPS instead of parsing /proc for peer gids 955ff3f7030c ubusd: fix use-after-free when resuming a queued object lookup fb1dd8e0d7c8 ubusd: document the bound on the pending-message body read 3a39a800f162 libubus-req: fix double close of the fd in ubus_complete_deferred_request 4d60031579d2 libubus: fix msgbuf leak on ubus_channel_connect error path 91b0dadfd1ed libubus-req: fix error check on the __ubus_notify_async result 82416940eae8 libubus-io: do not resend the fd on partial writes in writev_retry 618f3cf75ae3 libubus-obj: fix fd leaks on object message error paths 2f52ae367c93 ubusd_main: flush the tx queue after freeing the client's objects cdb648c3283a ubusd_obj: propagate subscription allocation failure to the client 7c5c06825daf ubusd_proto: fix double close of forwarded invoke fd d8fec00656a6 ubusd: keep the fd alive while a message waits in the tx queue bde609c2400e ubusd_acl: copy the filename used as the ACL file vlist key 008655958eb4 ubusd_acl: do not treat unresolvable ACL user/group names as id 0 5331c00f37f7 ubusd_event: document reserved event namespace forgery check ef37ed207183 ubusd_event: use an unsigned type for the event dedup sequence e12ad4bd667f ubusd: flag event messages as not expecting a reply 9d709c536cd6 ubusd_event: report allocation failure as out of memory 5170a5818b54 ubusd: use canonical SCM_RIGHTS extraction on the receive path 8dfee69c250c ubusd_main: do not abort startup when the default socket dir fails 17f78610d771 ubusd: disconnect the client when a partially sent message is dropped f5e5836704c8 cli: parse monitored payloads with the untrusted blob parser 11e411e36f08 libubus: close the passed fd when the request exceeds the size limit cbc27b66d813 ubusd: stop writing to a client already flagged for disconnect 2ec13d49ba37 libubus: do not restart the ACL query while one is in flight 297baef62eee libubus: free queued pending messages on shutdown 17525550a36b ubus/lua: fix Lua stack imbalance on policy allocation failure fdd9ff1fe0fc ubus/lua: copy the Lua strings stored in registered objects eb5a8284d176 ubusd: close the forwarded fd when the invoke reply cannot be built 3930745d8593 tests/fuzz: fix out-of-bounds read in header validation harness b27014cf7978 tests/fuzz: use size of blob_attr, not of a pointer, in length guard 414c60a2e29e ubus/lua: store event handler ref without polluting the callback table Signed-off-by: Felix Fietkau

rpcd: update to Git HEAD (2026-09-25)

2026-09-29T15:29:25Z

4062f666ecd1 file: reply with empty data instead of error for empty files a6c6b63b47bd ucode: add compatibility to newer ucode version Signed-off-by: Felix Fietkau

hidraw-support: add a package for raw HID device handling

2026-09-29T14:29:43Z

A HID device a driver hands to userspace whole, a UPS, a relay board or a programmable keypad, appears as a hidraw node and is opened directly by the program driving it. Everything of that kind runs as root today, because the generic rule leaves the node 0600 root:root and there is no group for it. Allocate the hidraw group and install the rule which puts the hidraw nodes into it. This is a separate class from the evdev nodes that input-support covers: hidapi and the packages using it open hidraw, and a keyboard or a mouse is read through evdev. Signed-off-by: Daniel Golle

scanner-support: add a package for the scanner group

2026-09-29T14:29:43Z

Scanner access is granted per device: a USB scanner is matched by vendor and product id against a database of supported devices, which only the driver package has. There is no device class to write a generic hotplug rule against, and putting every USB device node into a group would grant far more than scanner access. Allocate the scanner group and nothing else, so the id is the same on every image, one package owns it, and scanner userspace has something to depend on. The rule granting access to a particular device stays with the driver package. Signed-off-by: Daniel Golle

printer-support: add a package for printer device handling

2026-09-29T14:29:43Z

The USB and parallel port printer nodes come out 0600 root:root, so a print spooler runs as root. The lp group is already allocated by p910nd in the packages feed with gid 7, without anything creating it. Add a printer-support package which allocates that group and puts the usblp, lp and ppdev nodes into it, and make kmod-usb-printer and kmod-lp depend on it. Signed-off-by: Daniel Golle