packages/rpm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

backport some patches from upstream

Browse Source
This commit is contained in:
renxichen 2023-04-14 10:45:39 +08:00
parent 9a339e820f
commit ba9423348e
5 changed files with 269 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
backport-Add-a-test-for-special-device-node-installation.patch Normal file
View File

@ -0,0 +1,79 @@
From 5dcc399cd21f607f13eb092a3abfc8b8daa59d4c Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Fri, 13 Jan 2023 10:44:28 +0200
Subject: [PATCH] Add a test for special device node installation
This is a bit theoretical as it does not work for regular users or in
containers which are the typical scenarios for running the test-suite.
---
tests/atlocal.in | 6 ++++++
tests/data/SPECS/dev.spec | 14 ++++++++++++++
tests/rpmi.at | 17 +++++++++++++++++
3 files changed, 37 insertions(+)
create mode 100644 tests/data/SPECS/dev.spec
diff --git a/tests/atlocal.in b/tests/atlocal.in
index 0974693..83a56cd 100644
--- a/tests/atlocal.in
+++ b/tests/atlocal.in
@@ -42,6 +42,12 @@ if grep -q '#define WITH_CAP 1' "${abs_top_builddir}/config.h"; then
else
CAP_DISABLED=true;
fi
+if mknod foodev c 123 123; then
+ MKNOD_DISABLED=false
+ rm -f foodev
+else
+ MKNOD_DISABLED=true
+fi
function run()
{
diff --git a/tests/data/SPECS/dev.spec b/tests/data/SPECS/dev.spec
new file mode 100644
index 000000000..d784fe114
--- /dev/null
+++ b/tests/data/SPECS/dev.spec
@@ -0,0 +1,14 @@
+Name: dev
+Version: 1.0
+Release: 1
+Group: Testing
+License: GPL
+Summary: Testing dev behavior
+BuildArch: noarch
+
+%description
+%{summary}
+
+%files
+%dev(c 11 22) /test-char
+%dev(b 33 44) /test-block
diff --git a/tests/rpmi.at b/tests/rpmi.at
index 8d7fcba..9f4912b 100644
--- a/tests/rpmi.at
+++ b/tests/rpmi.at
@@ -726,3 +726,20 @@ runroot rpm -Vv --nouser --nogroup fifo
[])
AT_CLEANUP
+AT_SETUP([rpm -U dev])
+AT_KEYWORDS([install])
+AT_SKIP_IF([$MKNOD_DISABLED])
+AT_CHECK([
+RPMDB_INIT
+
+runroot rpmbuild -bb --quiet /data/SPECS/dev.spec
+runroot rpm -U --ignoreos /build/RPMS/noarch/dev-1.0-1.noarch.rpm
+runroot rpm -Vv --nouser --nogroup dev
+],
+[0],
+[......... /test-block
+......... /test-char
+],
+[])
+AT_CLEANUP
+
--
2.27.0

110
backport-Fix-install-of-block-and-character-special-files-219.patch Normal file
View File

@ -0,0 +1,110 @@
From 28c92fd54c93371c3062664d8a938438a2be88d6 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Fri, 13 Jan 2023 08:57:27 +0200
Subject: [PATCH] Fix install of block and character special files (#2195,
#2275)
While it's possible to open special files, they are, well, special and
have "side-effects" also known as, ahem, semantics. Opening a device
file in Unix means accessing that *device*, and FIFOs have their own
semantics. In other words, for rpm's purposes, we should never EVER
open these files as a part of the install / permission setting etc.
Fix this major brainfart in 25a435e90844ea98fe5eb7bef22c1aecf3a9c033.
OTOH this forces us back to the less secure path based operations for
these files, which is what we were trying to avoid in the first place.
There always was a tiny race between create + open for these (because
there's no atomic way to create + open anything but regular files) but
this opens up the window quite a bit.
Nobody should be placing device nodes in user-owned directories but
FIFO's may be a different story.
We haven't had tests for device nodes because it requires privileges the
test-suite usually doesn't have, not testing FIFOs I have no excuse for.
Add that test now.
Fixes: #2195, #2275
---
lib/fsm.c | 4 +++-
tests/data/SPECS/fifo.spec | 16 ++++++++++++++++
tests/Makefile.am | 2 +-
tests/rpmi.at | 15 +++++++++++++++
4 files changed, 35 insertions(+), 2 deletions(-)
create mode 100644 tests/data/SPECS/fifo.spec
diff --git a/lib/fsm.c b/lib/fsm.c
index ae8b23b..ad1d7ce 100644
--- a/lib/fsm.c
+++ b/lib/fsm.c
@@ -1159,7 +1159,9 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
rc = RPMERR_UNKNOWN_FILETYPE;
}
- if (!rc && fd == -1 && !S_ISLNK(fp->sb.st_mode)) {
+ /* Special files require path-based ops */
+ int mayopen = S_ISREG(fp->sb.st_mode) || S_ISDIR(fp->sb.st_mode);
+ if (!rc && fd == -1 && mayopen) {
/* Only follow safe symlinks, and never on temporary files */
fd = fsmOpenat(di.dirfd, fp->fpath,
fp->suffix ? AT_SYMLINK_NOFOLLOW : 0);
diff --git a/tests/data/SPECS/fifo.spec b/tests/data/SPECS/fifo.spec
new file mode 100644
index 000000000..20b30b243
--- /dev/null
+++ b/tests/data/SPECS/fifo.spec
@@ -0,0 +1,16 @@
+Name: fifo
+Version: 1.0
+Release: 1
+Group: Testing
+License: GPL
+Summary: Testing fifo behavior
+BuildArch: noarch
+
+%description
+%{summary}
+
+%install
+mkdir -p ${RPM_BUILD_ROOT} && mknod ${RPM_BUILD_ROOT}/test-fifo p
+
+%files
+/test-fifo
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 585e7a2..8e126ce 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -167,7 +167,7 @@ populate_testing:
for d in dev etc magic tmp var; do if [ ! -d testing/$${d} ]; then mkdir testing/$${d}; fi; done
for node in urandom stdin stderr stdout null full; do ln -s /dev/$${node} testing/dev/$${node}; done
for cf in hosts resolv.conf passwd shadow group gshadow mtab ; do [ -f /etc/$${cf} ] && ln -s /etc/$${cf} testing/etc/$${cf}; done
- for prog in gzip cat patch tar sh ln chmod rm mkdir uname grep sed find file ionice mktemp nice cut sort diff touch install wc coreutils xargs; do p=`which $${prog}`; if [ "$${p}" != "" ]; then ln -s $${p} testing/$(bindir)/; fi; done
+ for prog in gzip cat patch tar sh ln chmod rm mkdir uname grep sed find file ionice mktemp nice cut sort diff touch install wc coreutils xargs mknod; do p=`which $${prog}`; if [ "$${p}" != "" ]; then ln -s $${p} testing/$(bindir)/; fi; done
for d in /proc /sys /selinux /etc/selinux; do if [ -d $${d} ]; then ln -s $${d} testing/$${d}; fi; done
(cd testing/magic && file -C)
HOME=$(abs_builddir)/testing gpg2 --import --batch ${abs_srcdir}/data/keys/*.secret
diff --git a/tests/rpmi.at b/tests/rpmi.at
index e8d6e9b..8d7fcba 100644
--- a/tests/rpmi.at
+++ b/tests/rpmi.at
@@ -711,3 +711,18 @@ runroot rpm -e testdoc
[])
AT_CLEANUP
+AT_SETUP([rpm -U fifo])
+AT_KEYWORDS([install])
+AT_CHECK([
+RPMDB_INIT
+
+runroot rpmbuild -bb --quiet /data/SPECS/fifo.spec
+runroot rpm -U --ignoreos /build/RPMS/noarch/fifo-1.0-1.noarch.rpm
+runroot rpm -Vv --nouser --nogroup fifo
+],
+[0],
+[......... /test-fifo
+],
+[])
+AT_CLEANUP
+
--
2.27.0

45
backport-Use-fd-based-ops-for-metadata-in-FA_TOUCH-mode-too-w.patch Normal file
View File

@ -0,0 +1,45 @@
From 932013698149d43720cc321c8df2f99f51866e18 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Fri, 13 Jan 2023 10:00:37 +0200
Subject: [PATCH] Use fd-based ops for metadata in FA_TOUCH mode too, when
possible
Fixes another brainfart in commit 25a435e90844ea98fe5eb7bef22c1aecf3a9c033.
---
lib/fsm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/fsm.c b/lib/fsm.c
index ad1d7ce..c75597e 100644
--- a/lib/fsm.c
+++ b/lib/fsm.c
@@ -1022,6 +1022,7 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
int nodigest = (rpmtsFlags(ts) & RPMTRANS_FLAG_NOFILEDIGEST) ? 1 : 0;
int nofcaps = (rpmtsFlags(ts) & RPMTRANS_FLAG_NOCAPS) ? 1 : 0;
int firstlinkfile = -1;
+ int mayopen = 0;
char *tid = NULL;
struct filedata_s *fdata = xcalloc(fc, sizeof(*fdata));
struct filedata_s *firstlink = NULL;
@@ -1159,8 +1160,9 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
rc = RPMERR_UNKNOWN_FILETYPE;
}
+setmeta:
/* Special files require path-based ops */
- int mayopen = S_ISREG(fp->sb.st_mode) || S_ISDIR(fp->sb.st_mode);
+ mayopen = S_ISREG(fp->sb.st_mode) || S_ISDIR(fp->sb.st_mode);
if (!rc && fd == -1 && mayopen) {
/* Only follow safe symlinks, and never on temporary files */
fd = fsmOpenat(di.dirfd, fp->fpath,
@@ -1169,7 +1171,6 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
rc = RPMERR_OPEN_FAILED;
}
-setmeta:
if (!rc && fp->setmeta) {
rc = fsmSetmeta(fp->fpath, fi, plugins, fp->action,
&fp->sb, nofcaps);
--
2.27.0

27
backport-Use-proper-type-for-copyTagsFromMainDebug.patch Normal file
View File

@ -0,0 +1,27 @@
From 42694806bf73b07514554233d0d58d17a58cd863 Mon Sep 17 00:00:00 2001
From: Panu Matilainen <pmatilai@redhat.com>
Date: Thu, 9 Feb 2023 13:05:24 +0200
Subject: [PATCH] Use proper type for copyTagsFromMainDebug
The array contains a non-enum value (0), this is why headerCopyTags()
uses rpmTagVal pointer, not rpmTag.
---
build/files.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/build/files.c b/build/files.c
index 666c66651..24b4d80bf 100644
--- a/build/files.c
+++ b/build/files.c
@@ -2858,7 +2858,7 @@ exit:
return rc;
}
-static rpmTag copyTagsFromMainDebug[] = {
+static rpmTagVal copyTagsFromMainDebug[] = {
RPMTAG_ARCH,
RPMTAG_SUMMARY,
RPMTAG_DESCRIPTION,
--
2.27.0

9
rpm.spec
View File

@ -1,6 +1,6 @@
Name: rpm Name: rpm
Version: 4.15.1 Version: 4.15.1
Release: 48 Release: 49
Summary: RPM Package Manager Summary: RPM Package Manager
License: GPLv2+ License: GPLv2+
URL: http://www.rpm.org/ URL: http://www.rpm.org/
@ -198,6 +198,10 @@ Patch177: backport-Fix-prog-leak-in-parseScript.patch
Patch178: backport-Fix-elf-leak-in-getElfColor.patch Patch178: backport-Fix-elf-leak-in-getElfColor.patch
Patch179: backport-Fix-sbp-leak-when-running-rpmbuild-with-quiet.patch Patch179: backport-Fix-sbp-leak-when-running-rpmbuild-with-quiet.patch
Patch180: backport-Fix-memleak-when-running-generate_buildrequires.patch Patch180: backport-Fix-memleak-when-running-generate_buildrequires.patch
Patch181: backport-Fix-install-of-block-and-character-special-files-219.patch
Patch182: backport-Use-fd-based-ops-for-metadata-in-FA_TOUCH-mode-too-w.patch
Patch183: backport-Add-a-test-for-special-device-node-installation.patch
Patch184: backport-Use-proper-type-for-copyTagsFromMainDebug.patch
BuildRequires: gcc autoconf automake libtool make gawk popt-devel openssl-devel readline-devel libdb-devel BuildRequires: gcc autoconf automake libtool make gawk popt-devel openssl-devel readline-devel libdb-devel
BuildRequires: zlib-devel libzstd-devel xz-devel bzip2-devel libarchive-devel ima-evm-utils-devel BuildRequires: zlib-devel libzstd-devel xz-devel bzip2-devel libarchive-devel ima-evm-utils-devel
@ -481,6 +485,9 @@ make check || (cat tests/rpmtests.log; exit 0)
%{_mandir}/man1/gendiff.1* %{_mandir}/man1/gendiff.1*
%changelog %changelog
* Fri Apr 14 2023 renhongxun<renhongxun@h-partners.com> - 4.15.1-49
- backport some patches from upstream
* Wed Mar 08 2023 renhongxun<renhongxun@h-partners.com> - 4.15.1-48 * Wed Mar 08 2023 renhongxun<renhongxun@h-partners.com> - 4.15.1-48
- backport some patches from upstream - backport some patches from upstream