<feed xmlns='http://www.w3.org/2005/Atom'>
<title>coreutils/src/chroot.c, branch v8.26</title>
<subtitle>Mirror of https://https.git.savannah.gnu.org/git/coreutils.git/
</subtitle>
<id>https://git.shady.money/coreutils/atom?h=v8.26</id>
<link rel='self' href='https://git.shady.money/coreutils/atom?h=v8.26'/>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/'/>
<updated>2016-10-16T11:23:55Z</updated>
<entry>
<title>all: use die() rather than error(EXIT_FAILURE)</title>
<updated>2016-10-16T11:23:55Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2016-10-15T22:10:35Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=492dcb2eb191b844a2fd5e51db3eed85289bea1f'/>
<id>urn:sha1:492dcb2eb191b844a2fd5e51db3eed85289bea1f</id>
<content type='text'>
die() has the advantage of being apparent to the compiler
that it doesn't return, which will avoid warnings in some cases,
and possibly generate better code.
* cfg.mk (sc_die_EXIT_FAILURE): A new syntax check rule to
catch any new uses of error (CONSTANT, ...);
</content>
</entry>
<entry>
<title>maint: update all copyright year number ranges</title>
<updated>2016-01-01T14:10:41Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2016-01-01T14:10:41Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=b16e999f553b682e74e0a56750f649da05130c4f'/>
<id>urn:sha1:b16e999f553b682e74e0a56750f649da05130c4f</id>
<content type='text'>
Run "make update-copyright" and then...

* gnulib: Update to latest with copyright year adjusted.
* tests/init.sh: Sync with gnulib to pick up copyright year.
* bootstrap: Likewise.
* tests/sample-test: Adjust to use the single most recent year.
</content>
</entry>
<entry>
<title>all: avoid quoting file names when possible</title>
<updated>2015-11-04T23:30:14Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2015-11-01T18:53:26Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=08e8fd7e38f2dae7c69c54eb22d508b6517e66e5'/>
<id>urn:sha1:08e8fd7e38f2dae7c69c54eb22d508b6517e66e5</id>
<content type='text'>
Quote file names using the "shell-escape" or "shell-escape-always"
methods, which quote as appropriate for most shells,
and better support copy and paste of presented names.
The "always" variant is used when the file name is
embedded in an error message with surrounding spaces.

* cfg.mk (sc_error_shell_quotes): A new syntax check rule
to suggest quotef() where appropriate.
(sc_error_shell_always_quotes): Likewise for quoteaf().
* src/system.h (quotef): A new define to apply shell quoting
when needed.  I.E. when shell character or ':' is present.
(quoteaf): Likewise, but always quote.
* src/*.c: Use quotef() and quoteaf() rather than quote()
where appropriate.
* tests/: Adjust accordingly.
</content>
</entry>
<entry>
<title>all: quote string arguments in error messages</title>
<updated>2015-10-27T17:24:54Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2015-10-27T13:13:59Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=6796698c9945d87236ffcc939137d0919ef04931'/>
<id>urn:sha1:6796698c9945d87236ffcc939137d0919ef04931</id>
<content type='text'>
These strings are often file names or other user specified
parameters, which can give confusing errors in
the presence of unexpected characters for example.

* cfg.mk (sc_error_quotes): A new syntax check rule.
* src/*.c: Wrap error() string arguments with quote().
* tests/: Adjust accordingly.
* NEWS: Mention the improvement.
</content>
</entry>
<entry>
<title>chroot: quote argument in error diagnostic</title>
<updated>2015-06-26T18:35:46Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2015-06-26T18:31:00Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=e0c5ca485c9a5f016650f2c78e4d2edb6e44b2bb'/>
<id>urn:sha1:e0c5ca485c9a5f016650f2c78e4d2edb6e44b2bb</id>
<content type='text'>
* src/chroot.c (main): Quote the passed argument,
to avoid confusing error messages.
</content>
</entry>
<entry>
<title>maint: update all copyright year number ranges</title>
<updated>2015-01-01T04:52:17Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2015-01-01T04:49:02Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=e0afeb0099c899c2caa7453072e2d223d8f0ceb9'/>
<id>urn:sha1:e0afeb0099c899c2caa7453072e2d223d8f0ceb9</id>
<content type='text'>
Run "make update-copyright" and then...

* tests/sample-test: Adjust to use the single most recent year.
* tests/du/bind-mount-dir-cycle-v2.sh: Fix case in copyright message,
so that year is updated automatically in future.
</content>
</entry>
<entry>
<title>chroot: call chroot() unconditionally to handle bind mounted "/"</title>
<updated>2014-10-15T23:45:32Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2014-10-15T17:08:42Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=d520929586ee2063d48359aaaef8f28807604cae'/>
<id>urn:sha1:d520929586ee2063d48359aaaef8f28807604cae</id>
<content type='text'>
* src/chroot.c (is_root): Adjust to compare canonicalized paths
rather than inodes, to handle (return false in) the case where
we have a tree that is constructed by first bind mounting "/"
(thus having the same inode).
(main): Unconditionally call chroot() because it's safer
and of minimal performance benefit to avoid in this case.
This will cause inconsistency with some platforms
not allowing `chroot / true` for non root users.
* tests/misc/chroot-fail.sh: Adjust appropriately.
* NEWS: Mention the bug fixes.
Fixes http://bugs.gnu.org/18736
</content>
</entry>
<entry>
<title>doc: output correct --help references with --program-prefix</title>
<updated>2014-09-19T10:24:05Z</updated>
<author>
<name>Pádraig Brady</name>
<email>P@draigBrady.com</email>
</author>
<published>2014-09-18T13:50:47Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=8e93dc629727140e950a709008f9a17ca461af63'/>
<id>urn:sha1:8e93dc629727140e950a709008f9a17ca461af63</id>
<content type='text'>
* src/system.h (emit_ancillary_info): Take the invariant PROGRAM_NAME
as a parameter, so that consistent references are made to online docs
and texinfo nodes, when a --program-prefix is in place.  Note the
man pages don't need this fix as they're generated before the program
prefix is used.
* NEWS: Mention the improvements in references to online documentation.
</content>
</entry>
<entry>
<title>maint: prefer 'return status;' to 'exit (status);' in 'main'</title>
<updated>2014-09-09T03:48:44Z</updated>
<author>
<name>Paul Eggert</name>
<email>eggert@cs.ucla.edu</email>
</author>
<published>2014-09-08T23:31:14Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=8defcee49be881f8c7b8327f07b988fbe5c7171d'/>
<id>urn:sha1:8defcee49be881f8c7b8327f07b988fbe5c7171d</id>
<content type='text'>
* build-aux/gen-single-binary.sh: Don't use ATTRIBUTE_NORETURN
for main functions.
* src/base64.c, src/basename.c, src/cat.c, src/chcon.c, src/chgrp.c:
* src/chmod.c, src/chown.c, src/chroot.c, src/cksum.c, src/comm.c:
* src/cp.c, src/csplit.c, src/cut.c, src/date.c, src/dd.c, src/df.c:
* src/dircolors.c, src/dirname.c, src/du.c, src/echo.c, src/env.c:
* src/expand.c, src/expr.c, src/factor.c, src/fmt.c, src/fold.c:
* src/getlimits.c, src/groups.c, src/head.c, src/hostid.c:
* src/hostname.c, src/id.c, src/install.c, src/join.c, src/kill.c:
* src/link.c, src/ln.c, src/logname.c, src/ls.c, src/make-prime-list.c:
* src/md5sum.c, src/mkdir.c, src/mkfifo.c, src/mknod.c, src/mktemp.c:
* src/mv.c, src/nice.c, src/nl.c, src/nohup.c, src/nproc.c:
* src/numfmt.c, src/od.c, src/paste.c, src/pathchk.c, src/pinky.c:
* src/pr.c, src/printenv.c, src/printf.c, src/ptx.c, src/pwd.c:
* src/readlink.c, src/realpath.c, src/rm.c, src/rmdir.c, src/runcon.c:
* src/seq.c, src/shred.c, src/shuf.c, src/sleep.c, src/sort.c:
* src/split.c, src/stat.c, src/stdbuf.c, src/stty.c, src/sum.c:
* src/sync.c, src/tac.c, src/tail.c, src/tee.c, src/timeout.c:
* src/touch.c, src/tr.c, src/true.c, src/truncate.c, src/tsort.c:
* src/tty.c, src/uname.c, src/unexpand.c, src/uniq.c, src/unlink.c:
* src/uptime.c, src/users.c, src/wc.c, src/who.c, src/whoami.c:
In 'main' functions, Prefer 'return status;' to 'exit (status);'.
* src/coreutils-arch.c (_single_binary_main_uname)
(_single_binary_main_arch):
* src/coreutils-dir.c, src/coreutils-vdir.c (_single_binary_main_ls)
(_single_binary_main_dir, _single_binary_main_vdir):
Omit ATTRIBUTE_NORETURN.  Return a value.
* src/coreutils.c (SINGLE_BINARY_PROGRAM): Omit ATTRIBUTE_NORETURN.
(launch_program): Now static.
* src/dd.c (finish_up): New function.
(quit, main): Use it.
* src/getlimits.c (main): Return a proper exit status.
* src/test.c (test_main_return): New macro.
(main): Use it.
* src/logname.c, src/nohup.c, src/whoami.c:
Use 'error' to simplify exit status in 'main' function.
* src/yes.c (main): Use 'return' rather than 'error' to exit,
so that GCC doesn't suggest ATTRIBUTE_NORETURN.
</content>
</entry>
<entry>
<title>chroot: perform chdir("/") again unless new --skip-chdir is specified</title>
<updated>2014-08-01T10:35:05Z</updated>
<author>
<name>Bernhard Voelker</name>
<email>mail@bernhard-voelker.de</email>
</author>
<published>2014-08-01T00:07:33Z</published>
<link rel='alternate' type='text/html' href='https://git.shady.money/coreutils/commit/?id=0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379'/>
<id>urn:sha1:0cf7b1d928acaaddd4eaa28c6a22f7bd6457b379</id>
<content type='text'>
Since commit v8.22-94-g99960ee, chroot(1) skips the chroot(2) syscall
for "/" arguments (and synonyms).  The problem is that it also skips
the following chdir("/") call in that case.  The latter breaks existing
scripts which expect "/" to be the working directory inside the chroot.
While the first part of the change - i.e., skipping chroot("/") - is
okay for consistency with systems where it might succeed for a non-root
user, the second part might be malicious, e.g.

  cd /home/user &amp;&amp; chroot '/' bin/foo

In the "best" case, chroot(1) could not execute 'bin/foo' with ENOENT,
but in the worst case, chroot(1) would execute '/home/user/bin/foo' in
the case that exists - instead of '/bin/foo'.

Revert that second part of the patch, i.e., perform the chdir("/)
in the common case again - unless the new --skip-chdir option is
specified.  Restrict this new option to the case of "/" arguments.

* src/chroot.c (SKIP_CHDIR): Add enum.
(long_opts): Add entry for the new --skip-chdir option.
(usage): Add --skip-chdir option, and while at it, move the other
to options into alphabetical order.
(main): Accept the above new option, allowing it only in the case
when NEWROOT is the old "/".
Move down the chdir() call after the if-clause to ensure it is
run in any case - unless --skip-chdir is specified.
Add a 'newroot' variable for the new root directory as it is used
in a couple of places now.
* tests/misc/chroot-fail.sh: Invert the last tests which check the
working directory of the execvp()ed program when a "/"-like
argument was passed: now expect it to be "/" - unless --skip-chdir
is given.
* doc/coreutils.texi (chroot invocation): Document the new option.
Document that chroot(1) usually calls chdir("/") unless the new
--skip-chdir option is specified.  Sort options.
* NEWS (Changes in behavior): Mention the fix.
(New features): Mention the new option.
* init.cfg (nonroot_has_perm_): Add chroot's new --skip-chdir option.
* tests/cp/preserve-gid.sh (t1): Likewise.
* tests/cp/special-bits.sh: Likewise.
* tests/id/setgid.sh: Likewise.
* tests/misc/truncate-owned-by-other.sh: Likewise.
* tests/mv/sticky-to-xpart.sh: Likewise.
* tests/rm/fail-2eperm.sh: Likewise.
* tests/rm/no-give-up.sh: Likewise.
* tests/touch/now-owned-by-other.sh: Likewise.

Reported by Andreas Schwab in http://bugs.gnu.org/18062
</content>
</entry>
</feed>
