sym_escape_string_value() can take a struct symbol directly
and use sym_get_string_value() itself to obtain the string value.
We will need struct symbol later for error reporting.
Signed-off-by: Richard Weinberger <[email protected]>
---
scripts/kconfig/conf.c | 3 +--
scripts/kconfig/confdata.c | 3 +--
scripts/kconfig/lkc_proto.h | 2 +-
scripts/kconfig/symbol.c | 6 ++++--
4 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 5d84b44a2a2a..a6dad4a2e7a2 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -650,8 +650,7 @@ static void check_conf(struct menu *menu)
const char *str;
if (sym->type == S_STRING) {
- str = sym_get_string_value(sym);
- str = sym_escape_string_value(str);
+ str = sym_escape_string(sym);
printf("%s%s=%s\n", CONFIG_, sym->name, str);
free((void *)str);
} else {
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index cf72680cd769..4e053f2477f9 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -734,8 +734,7 @@ static void conf_write_symbol(FILE *fp, struct symbol *sym,
case S_UNKNOWN:
break;
case S_STRING:
- str = sym_get_string_value(sym);
- str = sym_escape_string_value(str);
+ str = sym_escape_string(sym);
printer->print_symbol(fp, sym, str, printer_arg);
free((void *)str);
break;
diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
index a11626bdc421..035cc522808b 100644
--- a/scripts/kconfig/lkc_proto.h
+++ b/scripts/kconfig/lkc_proto.h
@@ -18,7 +18,7 @@ extern struct symbol * symbol_hash[SYMBOL_HASHSIZE];
struct symbol * sym_lookup(const char *name, int flags);
struct symbol * sym_find(const char *name);
-const char * sym_escape_string_value(const char *in);
+const char * sym_escape_string(struct symbol *sym);
struct symbol ** sym_re_search(const char *pattern);
const char * sym_type_name(enum symbol_type type);
void sym_calc_value(struct symbol *sym);
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 5844d636d38f..4a31bb943f79 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -871,13 +871,15 @@ struct symbol *sym_find(const char *name)
return symbol;
}
-const char *sym_escape_string_value(const char *in)
+const char *sym_escape_string(struct symbol *sym)
{
- const char *p;
+ const char *in, *p;
size_t reslen;
char *res;
size_t l;
+ in = sym_get_string_value(sym);
+
reslen = strlen(in) + strlen("\"\"") + 1;
p = in;
--
2.26.2
The post processed .config file will get included in shell
and makefiles. So make sure that a string does not contain
symbols that allow command substitution.
If such a malformed string is found, return empty string
and report it.
Signed-off-by: Richard Weinberger <[email protected]>
---
scripts/kconfig/symbol.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 4a31bb943f79..1035ecdddc99 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -880,6 +880,11 @@ const char *sym_escape_string(struct symbol *sym)
in = sym_get_string_value(sym);
+ if (strspn(in, "`$")) {
+ fprintf(stderr, "%s: invalid characters in string found\n", sym->name);
+ return xstrdup("\"\"");
+ }
+
reslen = strlen(in) + strlen("\"\"") + 1;
p = in;
--
2.26.2
Richard Weinberger <[email protected]> writes:
> The post processed .config file will get included in shell
> and makefiles.
That depends on who you ask: a number of projects other than the
Linux kernel use kconfig for configuration and some of them do
neither of those. I also don't believe the Linux kernel sources
.config in shell (but I may be wrong).
> So make sure that a string does not contain
> symbols that allow command substitution.
> If such a malformed string is found, return empty string
> and report it.
So effectively it's now impossible to include ` or $ in kconfig
string values. Seems like a major, backwards-incompatible
restriction.
I think if this is really desired, then it should be re-done with
escaping (similar to ") rather than outright banning inconvenient
characters.
Boris,
----- Ursprüngliche Mail -----
> Von: "Boris Kolpackov" <[email protected]>
> An: "richard" <[email protected]>
> CC: [email protected], "linux-kernel" <[email protected]>, [email protected]
> Gesendet: Mittwoch, 22. September 2021 09:17:44
> Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values
> Richard Weinberger <[email protected]> writes:
>
>> The post processed .config file will get included in shell
>> and makefiles.
>
> That depends on who you ask: a number of projects other than the
> Linux kernel use kconfig for configuration and some of them do
> neither of those. I also don't believe the Linux kernel sources
> .config in shell (but I may be wrong).
See below.
>
>> So make sure that a string does not contain
>> symbols that allow command substitution.
>> If such a malformed string is found, return empty string
>> and report it.
>
> So effectively it's now impossible to include ` or $ in kconfig
> string values. Seems like a major, backwards-incompatible
> restriction.
Do you have a working example?
Since the config is sourced in the scripts/setlocalversion it will
not work correctly anyway.
> I think if this is really desired, then it should be re-done with
> escaping (similar to ") rather than outright banning inconvenient
> characters.
Escaping is not so easy since the very same content is included
in shell scripts (sertlocalversion), in Makefiles and in C files.
At least I didn't find find a good way to escape these characters
such that all three programming environments will accept it.
Thanks,
//richard
Richard Weinberger <[email protected]> writes:
> > So effectively it's now impossible to include ` or $ in kconfig
> > string values. Seems like a major, backwards-incompatible
> > restriction.
>
> Do you have a working example?
You mean of a project that uses kconfig and that is capable of
handling string values with these characters? If so, then yes,
see for example, libbuild2-kconfig[1] which is a build system
module that implements kconfig-based configuration support for
build2. In particular, it exposes values from .config as
buildfile variables but it doesn't do this by sourcing .config.
Instead it loads .config using the kconfig API and then sets
the corresponding buildfile variables programmatically.
> Since the config is sourced in the scripts/setlocalversion it will
> not work correctly anyway.
The actual file being sources is include/config/auto.conf, not
.config, right?
> > I think if this is really desired, then it should be re-done with
> > escaping (similar to ") rather than outright banning inconvenient
> > characters.
>
> Escaping is not so easy since the very same content is included
> in shell scripts (sertlocalversion), in Makefiles and in C files.
Again, I don't think it's .config that gets included in C files but
rather include/generated/autoconf.h, right?
> At least I didn't find find a good way to escape these characters
> such that all three programming environments will accept it.
If my understanding is correct, then you are concerned with the
autoconf functionality: the auto.conf makefile and autoconf.h
header, and not the .config file itself. Perhaps it will be less
disruptive to do the escaping (or banning) at that level?
Specifically:
1. If you do escaping at that level, then you can do it differently
for auto.conf and autoconf.h. Though auto.conf still seems to be
read by both make and shell.
2. Alternatively, you can detect and ban the inconvenient characters
when generating these files (I personally don't care for autoconf
and have it disabled).
[1] https://github.com/build2/libbuild2-kconfig
Boris,
----- Ursprüngliche Mail -----
> Von: "Boris Kolpackov" <[email protected]>
> An: "richard" <[email protected]>
> CC: "masahiroy" <[email protected]>, "linux-kernel" <[email protected]>, "linux-kbuild"
> <[email protected]>
> Gesendet: Mittwoch, 22. September 2021 17:18:43
> Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values
> Richard Weinberger <[email protected]> writes:
>
>> > So effectively it's now impossible to include ` or $ in kconfig
>> > string values. Seems like a major, backwards-incompatible
>> > restriction.
>>
>> Do you have a working example?
>
> You mean of a project that uses kconfig and that is capable of
> handling string values with these characters? If so, then yes,
> see for example, libbuild2-kconfig[1] which is a build system
> module that implements kconfig-based configuration support for
> build2. In particular, it exposes values from .config as
> buildfile variables but it doesn't do this by sourcing .config.
> Instead it loads .config using the kconfig API and then sets
> the corresponding buildfile variables programmatically.
I had a config setting of Linux in mind. :-)
>
>> Since the config is sourced in the scripts/setlocalversion it will
>> not work correctly anyway.
>
> The actual file being sources is include/config/auto.conf, not
> .config, right?
>
Yes. auto.conf is .config post processed.
This is exactly where my mitigation takes place.
>> > I think if this is really desired, then it should be re-done with
>> > escaping (similar to ") rather than outright banning inconvenient
>> > characters.
>>
>> Escaping is not so easy since the very same content is included
>> in shell scripts (sertlocalversion), in Makefiles and in C files.
>
> Again, I don't think it's .config that gets included in C files but
> rather include/generated/autoconf.h, right?
>
Yes. But the key/values are taken as-is.
Just add some odd characters to your .config, build the kernel and observe
the breakage at different levels.
Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-)
>> At least I didn't find find a good way to escape these characters
>> such that all three programming environments will accept it.
>
> If my understanding is correct, then you are concerned with the
> autoconf functionality: the auto.conf makefile and autoconf.h
> header, and not the .config file itself. Perhaps it will be less
> disruptive to do the escaping (or banning) at that level?
My concern is that currently a .config file can contain hostile content
that will get executed at build time.
.config files are often blindly shared across untrusted developers.
So I thought that mitigating this whole is worth it.
> Specifically:
>
> 1. If you do escaping at that level, then you can do it differently
> for auto.conf and autoconf.h. Though auto.conf still seems to be
> read by both make and shell.
I need to think about that. Thanks for the pointer.
Thanks,
//richard
On Thu, Sep 23, 2021 at 1:17 AM Richard Weinberger <[email protected]> wrote:
>
> Boris,
>
> ----- Ursprüngliche Mail -----
> > Von: "Boris Kolpackov" <[email protected]>
> > An: "richard" <[email protected]>
> > CC: "masahiroy" <[email protected]>, "linux-kernel" <[email protected]>, "linux-kbuild"
> > <[email protected]>
> > Gesendet: Mittwoch, 22. September 2021 17:18:43
> > Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values
>
> > Richard Weinberger <[email protected]> writes:
> >
> >> > So effectively it's now impossible to include ` or $ in kconfig
> >> > string values. Seems like a major, backwards-incompatible
> >> > restriction.
> >>
> >> Do you have a working example?
> >
> > You mean of a project that uses kconfig and that is capable of
> > handling string values with these characters? If so, then yes,
> > see for example, libbuild2-kconfig[1] which is a build system
> > module that implements kconfig-based configuration support for
> > build2. In particular, it exposes values from .config as
> > buildfile variables but it doesn't do this by sourcing .config.
> > Instead it loads .config using the kconfig API and then sets
> > the corresponding buildfile variables programmatically.
>
> I had a config setting of Linux in mind. :-)
>
> >
> >> Since the config is sourced in the scripts/setlocalversion it will
> >> not work correctly anyway.
> >
> > The actual file being sources is include/config/auto.conf, not
> > .config, right?
> >
>
> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.
>
> >> > I think if this is really desired, then it should be re-done with
> >> > escaping (similar to ") rather than outright banning inconvenient
> >> > characters.
> >>
> >> Escaping is not so easy since the very same content is included
> >> in shell scripts (sertlocalversion), in Makefiles and in C files.
> >
> > Again, I don't think it's .config that gets included in C files but
> > rather include/generated/autoconf.h, right?
> >
>
> Yes. But the key/values are taken as-is.
>
> Just add some odd characters to your .config, build the kernel and observe
> the breakage at different levels.
> Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-)
>
> >> At least I didn't find find a good way to escape these characters
> >> such that all three programming environments will accept it.
> >
> > If my understanding is correct, then you are concerned with the
> > autoconf functionality: the auto.conf makefile and autoconf.h
> > header, and not the .config file itself. Perhaps it will be less
> > disruptive to do the escaping (or banning) at that level?
>
> My concern is that currently a .config file can contain hostile content
> that will get executed at build time.
> .config files are often blindly shared across untrusted developers.
> So I thought that mitigating this whole is worth it.
>
> > Specifically:
> >
> > 1. If you do escaping at that level, then you can do it differently
> > for auto.conf and autoconf.h. Though auto.conf still seems to be
> > read by both make and shell.
>
> I need to think about that. Thanks for the pointer.
>
> Thanks,
> //richard
I recalled that we discussed this a few years ago.
https://lore.kernel.org/all/[email protected]/
include/config/auto.conf is just a sub-set of .config
with "# CONFIG... is not set" dropped.
If we do some escapings in it is not feasible
as you mentioned, due to the difference of escaping
between makefile and shell-scripts.
$$ for makefiles
\$ for shell scripts
If we go this way, perhaps, we need to generate two files
include/config/autoconf.mk and include/config/autoconf.sh
BTW, xtensa relies on having $ in the .config file.
masahiro@grover:~/workspace/linux-kbuild$ find . -name '*_defconfig' |
xargs grep '\$'
./arch/xtensa/configs/cadence_csp_defconfig:CONFIG_INITRAMFS_SOURCE="$$KERNEL_INITRAMFS_SOURCE"
If we make this decision, we need to persuade xtensa folks
to not do this...
--
Best Regards
Masahiro Yamada
On Tue, Sep 21, 2021 at 6:42 AM Richard Weinberger <[email protected]> wrote:
>
> sym_escape_string_value() can take a struct symbol directly
> and use sym_get_string_value() itself to obtain the string value.
> We will need struct symbol later for error reporting.
>
> Signed-off-by: Richard Weinberger <[email protected]>
> ---
I think this is a nice clean-up regardless of 2/2.
Applied to linux-kbuild. Thanks.
> scripts/kconfig/conf.c | 3 +--
> scripts/kconfig/confdata.c | 3 +--
> scripts/kconfig/lkc_proto.h | 2 +-
> scripts/kconfig/symbol.c | 6 ++++--
> 4 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
> index 5d84b44a2a2a..a6dad4a2e7a2 100644
> --- a/scripts/kconfig/conf.c
> +++ b/scripts/kconfig/conf.c
> @@ -650,8 +650,7 @@ static void check_conf(struct menu *menu)
> const char *str;
>
> if (sym->type == S_STRING) {
> - str = sym_get_string_value(sym);
> - str = sym_escape_string_value(str);
> + str = sym_escape_string(sym);
> printf("%s%s=%s\n", CONFIG_, sym->name, str);
> free((void *)str);
> } else {
> diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
> index cf72680cd769..4e053f2477f9 100644
> --- a/scripts/kconfig/confdata.c
> +++ b/scripts/kconfig/confdata.c
> @@ -734,8 +734,7 @@ static void conf_write_symbol(FILE *fp, struct symbol *sym,
> case S_UNKNOWN:
> break;
> case S_STRING:
> - str = sym_get_string_value(sym);
> - str = sym_escape_string_value(str);
> + str = sym_escape_string(sym);
> printer->print_symbol(fp, sym, str, printer_arg);
> free((void *)str);
> break;
> diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
> index a11626bdc421..035cc522808b 100644
> --- a/scripts/kconfig/lkc_proto.h
> +++ b/scripts/kconfig/lkc_proto.h
> @@ -18,7 +18,7 @@ extern struct symbol * symbol_hash[SYMBOL_HASHSIZE];
>
> struct symbol * sym_lookup(const char *name, int flags);
> struct symbol * sym_find(const char *name);
> -const char * sym_escape_string_value(const char *in);
> +const char * sym_escape_string(struct symbol *sym);
> struct symbol ** sym_re_search(const char *pattern);
> const char * sym_type_name(enum symbol_type type);
> void sym_calc_value(struct symbol *sym);
> diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
> index 5844d636d38f..4a31bb943f79 100644
> --- a/scripts/kconfig/symbol.c
> +++ b/scripts/kconfig/symbol.c
> @@ -871,13 +871,15 @@ struct symbol *sym_find(const char *name)
> return symbol;
> }
>
> -const char *sym_escape_string_value(const char *in)
> +const char *sym_escape_string(struct symbol *sym)
> {
> - const char *p;
> + const char *in, *p;
> size_t reslen;
> char *res;
> size_t l;
>
> + in = sym_get_string_value(sym);
> +
> reslen = strlen(in) + strlen("\"\"") + 1;
>
> p = in;
> --
> 2.26.2
>
--
Best Regards
Masahiro Yamada
Richard Weinberger <[email protected]> writes:
> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.
No, sym_escape_string_value() is called by conf_write_symbol()
which in turn is called from conf_write() and conf_write_defconfig()
(used to write .config files) besides conf_write_autoconf() (used to
write auto.conf).
On Mon, Sep 27, 2021 at 9:36 PM Masahiro Yamada <[email protected]> wrote:
>
> On Tue, Sep 21, 2021 at 6:42 AM Richard Weinberger <[email protected]> wrote:
> >
> > sym_escape_string_value() can take a struct symbol directly
> > and use sym_get_string_value() itself to obtain the string value.
> > We will need struct symbol later for error reporting.
> >
> > Signed-off-by: Richard Weinberger <[email protected]>
> > ---
>
> I think this is a nice clean-up regardless of 2/2.
> Applied to linux-kbuild. Thanks.
>
I changed my mind after all.
I dropped this patch to clean up the code in a different way.
--
Best Regards
Masahiro Yamada
----- Ursprüngliche Mail -----
> Von: "masahiroy" <[email protected]>
> An: "richard" <[email protected]>
> CC: "linux-kernel" <[email protected]>, "linux-kbuild" <[email protected]>
> Gesendet: Dienstag, 5. Oktober 2021 17:42:54
> Betreff: Re: [PATCH 1/2] kconfig: Refactor sym_escape_string_value
> On Mon, Sep 27, 2021 at 9:36 PM Masahiro Yamada <[email protected]> wrote:
>>
>> On Tue, Sep 21, 2021 at 6:42 AM Richard Weinberger <[email protected]> wrote:
>> >
>> > sym_escape_string_value() can take a struct symbol directly
>> > and use sym_get_string_value() itself to obtain the string value.
>> > We will need struct symbol later for error reporting.
>> >
>> > Signed-off-by: Richard Weinberger <[email protected]>
>> > ---
>>
>> I think this is a nice clean-up regardless of 2/2.
>> Applied to linux-kbuild. Thanks.
>>
>
> I changed my mind after all.
> I dropped this patch to clean up the code in a different way.
Thanks for letting me know!
I noticed already via linux-next.
Thanks,
//richard