| Message ID | 20210920213957.1064-2-richard@nod.at (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/2] kconfig: Refactor sym_escape_string_value | expand |
Richard Weinberger <richard@nod.at> writes: > The post processed .config file will get included in shell > and makefiles. That depends on who you ask: a number of projects other than the Linux kernel use kconfig for configuration and some of them do neither of those. I also don't believe the Linux kernel sources .config in shell (but I may be wrong). > So make sure that a string does not contain > symbols that allow command substitution. > If such a malformed string is found, return empty string > and report it. So effectively it's now impossible to include ` or $ in kconfig string values. Seems like a major, backwards-incompatible restriction. I think if this is really desired, then it should be re-done with escaping (similar to ") rather than outright banning inconvenient characters.
Boris, ----- Ursprüngliche Mail ----- > Von: "Boris Kolpackov" <boris@codesynthesis.com> > An: "richard" <richard@nod.at> > CC: masahiroy@kernel.org, "linux-kernel" <linux-kernel@vger.kernel.org>, linux-kbuild@vger.kernel.org > Gesendet: Mittwoch, 22. September 2021 09:17:44 > Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values > Richard Weinberger <richard@nod.at> writes: > >> The post processed .config file will get included in shell >> and makefiles. > > That depends on who you ask: a number of projects other than the > Linux kernel use kconfig for configuration and some of them do > neither of those. I also don't believe the Linux kernel sources > .config in shell (but I may be wrong). See below. > >> So make sure that a string does not contain >> symbols that allow command substitution. >> If such a malformed string is found, return empty string >> and report it. > > So effectively it's now impossible to include ` or $ in kconfig > string values. Seems like a major, backwards-incompatible > restriction. Do you have a working example? Since the config is sourced in the scripts/setlocalversion it will not work correctly anyway. > I think if this is really desired, then it should be re-done with > escaping (similar to ") rather than outright banning inconvenient > characters. Escaping is not so easy since the very same content is included in shell scripts (sertlocalversion), in Makefiles and in C files. At least I didn't find find a good way to escape these characters such that all three programming environments will accept it. Thanks, //richard
Richard Weinberger <richard@nod.at> writes: > > So effectively it's now impossible to include ` or $ in kconfig > > string values. Seems like a major, backwards-incompatible > > restriction. > > Do you have a working example? You mean of a project that uses kconfig and that is capable of handling string values with these characters? If so, then yes, see for example, libbuild2-kconfig[1] which is a build system module that implements kconfig-based configuration support for build2. In particular, it exposes values from .config as buildfile variables but it doesn't do this by sourcing .config. Instead it loads .config using the kconfig API and then sets the corresponding buildfile variables programmatically. > Since the config is sourced in the scripts/setlocalversion it will > not work correctly anyway. The actual file being sources is include/config/auto.conf, not .config, right? > > I think if this is really desired, then it should be re-done with > > escaping (similar to ") rather than outright banning inconvenient > > characters. > > Escaping is not so easy since the very same content is included > in shell scripts (sertlocalversion), in Makefiles and in C files. Again, I don't think it's .config that gets included in C files but rather include/generated/autoconf.h, right? > At least I didn't find find a good way to escape these characters > such that all three programming environments will accept it. If my understanding is correct, then you are concerned with the autoconf functionality: the auto.conf makefile and autoconf.h header, and not the .config file itself. Perhaps it will be less disruptive to do the escaping (or banning) at that level? Specifically: 1. If you do escaping at that level, then you can do it differently for auto.conf and autoconf.h. Though auto.conf still seems to be read by both make and shell. 2. Alternatively, you can detect and ban the inconvenient characters when generating these files (I personally don't care for autoconf and have it disabled). [1] https://github.com/build2/libbuild2-kconfig
Boris, ----- Ursprüngliche Mail ----- > Von: "Boris Kolpackov" <boris@codesynthesis.com> > An: "richard" <richard@nod.at> > CC: "masahiroy" <masahiroy@kernel.org>, "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-kbuild" > <linux-kbuild@vger.kernel.org> > Gesendet: Mittwoch, 22. September 2021 17:18:43 > Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values > Richard Weinberger <richard@nod.at> writes: > >> > So effectively it's now impossible to include ` or $ in kconfig >> > string values. Seems like a major, backwards-incompatible >> > restriction. >> >> Do you have a working example? > > You mean of a project that uses kconfig and that is capable of > handling string values with these characters? If so, then yes, > see for example, libbuild2-kconfig[1] which is a build system > module that implements kconfig-based configuration support for > build2. In particular, it exposes values from .config as > buildfile variables but it doesn't do this by sourcing .config. > Instead it loads .config using the kconfig API and then sets > the corresponding buildfile variables programmatically. I had a config setting of Linux in mind. :-) > >> Since the config is sourced in the scripts/setlocalversion it will >> not work correctly anyway. > > The actual file being sources is include/config/auto.conf, not > .config, right? > Yes. auto.conf is .config post processed. This is exactly where my mitigation takes place. >> > I think if this is really desired, then it should be re-done with >> > escaping (similar to ") rather than outright banning inconvenient >> > characters. >> >> Escaping is not so easy since the very same content is included >> in shell scripts (sertlocalversion), in Makefiles and in C files. > > Again, I don't think it's .config that gets included in C files but > rather include/generated/autoconf.h, right? > Yes. But the key/values are taken as-is. Just add some odd characters to your .config, build the kernel and observe the breakage at different levels. Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-) >> At least I didn't find find a good way to escape these characters >> such that all three programming environments will accept it. > > If my understanding is correct, then you are concerned with the > autoconf functionality: the auto.conf makefile and autoconf.h > header, and not the .config file itself. Perhaps it will be less > disruptive to do the escaping (or banning) at that level? My concern is that currently a .config file can contain hostile content that will get executed at build time. .config files are often blindly shared across untrusted developers. So I thought that mitigating this whole is worth it. > Specifically: > > 1. If you do escaping at that level, then you can do it differently > for auto.conf and autoconf.h. Though auto.conf still seems to be > read by both make and shell. I need to think about that. Thanks for the pointer. Thanks, //richard
On Thu, Sep 23, 2021 at 1:17 AM Richard Weinberger <richard@nod.at> wrote: > > Boris, > > ----- Ursprüngliche Mail ----- > > Von: "Boris Kolpackov" <boris@codesynthesis.com> > > An: "richard" <richard@nod.at> > > CC: "masahiroy" <masahiroy@kernel.org>, "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-kbuild" > > <linux-kbuild@vger.kernel.org> > > Gesendet: Mittwoch, 22. September 2021 17:18:43 > > Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values > > > Richard Weinberger <richard@nod.at> writes: > > > >> > So effectively it's now impossible to include ` or $ in kconfig > >> > string values. Seems like a major, backwards-incompatible > >> > restriction. > >> > >> Do you have a working example? > > > > You mean of a project that uses kconfig and that is capable of > > handling string values with these characters? If so, then yes, > > see for example, libbuild2-kconfig[1] which is a build system > > module that implements kconfig-based configuration support for > > build2. In particular, it exposes values from .config as > > buildfile variables but it doesn't do this by sourcing .config. > > Instead it loads .config using the kconfig API and then sets > > the corresponding buildfile variables programmatically. > > I had a config setting of Linux in mind. :-) > > > > >> Since the config is sourced in the scripts/setlocalversion it will > >> not work correctly anyway. > > > > The actual file being sources is include/config/auto.conf, not > > .config, right? > > > > Yes. auto.conf is .config post processed. > This is exactly where my mitigation takes place. > > >> > I think if this is really desired, then it should be re-done with > >> > escaping (similar to ") rather than outright banning inconvenient > >> > characters. > >> > >> Escaping is not so easy since the very same content is included > >> in shell scripts (sertlocalversion), in Makefiles and in C files. > > > > Again, I don't think it's .config that gets included in C files but > > rather include/generated/autoconf.h, right? > > > > Yes. But the key/values are taken as-is. > > Just add some odd characters to your .config, build the kernel and observe > the breakage at different levels. > Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-) > > >> At least I didn't find find a good way to escape these characters > >> such that all three programming environments will accept it. > > > > If my understanding is correct, then you are concerned with the > > autoconf functionality: the auto.conf makefile and autoconf.h > > header, and not the .config file itself. Perhaps it will be less > > disruptive to do the escaping (or banning) at that level? > > My concern is that currently a .config file can contain hostile content > that will get executed at build time. > .config files are often blindly shared across untrusted developers. > So I thought that mitigating this whole is worth it. > > > Specifically: > > > > 1. If you do escaping at that level, then you can do it differently > > for auto.conf and autoconf.h. Though auto.conf still seems to be > > read by both make and shell. > > I need to think about that. Thanks for the pointer. > > Thanks, > //richard I recalled that we discussed this a few years ago. https://lore.kernel.org/all/20180217203945.2515-1-richard@nod.at/ include/config/auto.conf is just a sub-set of .config with "# CONFIG... is not set" dropped. If we do some escapings in it is not feasible as you mentioned, due to the difference of escaping between makefile and shell-scripts. $$ for makefiles \$ for shell scripts If we go this way, perhaps, we need to generate two files include/config/autoconf.mk and include/config/autoconf.sh BTW, xtensa relies on having $ in the .config file. masahiro@grover:~/workspace/linux-kbuild$ find . -name '*_defconfig' | xargs grep '\$' ./arch/xtensa/configs/cadence_csp_defconfig:CONFIG_INITRAMFS_SOURCE="$$KERNEL_INITRAMFS_SOURCE" If we make this decision, we need to persuade xtensa folks to not do this...
Richard Weinberger <richard@nod.at> writes: > Yes. auto.conf is .config post processed. > This is exactly where my mitigation takes place. No, sym_escape_string_value() is called by conf_write_symbol() which in turn is called from conf_write() and conf_write_defconfig() (used to write .config files) besides conf_write_autoconf() (used to write auto.conf).
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c index 4a31bb943f79..1035ecdddc99 100644 --- a/scripts/kconfig/symbol.c +++ b/scripts/kconfig/symbol.c @@ -880,6 +880,11 @@ const char *sym_escape_string(struct symbol *sym) in = sym_get_string_value(sym); + if (strspn(in, "`$")) { + fprintf(stderr, "%s: invalid characters in string found\n", sym->name); + return xstrdup("\"\""); + } + reslen = strlen(in) + strlen("\"\"") + 1; p = in;
The post processed .config file will get included in shell and makefiles. So make sure that a string does not contain symbols that allow command substitution. If such a malformed string is found, return empty string and report it. Signed-off-by: Richard Weinberger <richard@nod.at> --- scripts/kconfig/symbol.c | 5 +++++ 1 file changed, 5 insertions(+)