Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210920213957.1064-1-richard@nod.at> <20210920213957.1064-2-richard@nod.at>
 <boris.20210922090732@codesynthesis.com> <1402570794.96583.1632295660867.JavaMail.zimbra@nod.at>
 <boris.20210922165140@codesynthesis.com> <1942256037.97524.1632327460626.JavaMail.zimbra@nod.at>
In-Reply-To: <1942256037.97524.1632327460626.JavaMail.zimbra@nod.at>
From:   Masahiro Yamada <masahiroy@kernel.org>
Date:   Sat, 25 Sep 2021 17:58:37 +0900
Message-ID: <CAK7LNAQjqLznMfk1u7FmpjZuwSfWnSinoHJxzGfCLcTSm19pog@mail.gmail.com>
Subject: Re: [PATCH 2/2] kconfig: Deny command substitution in string values
To:     Richard Weinberger <richard@nod.at>
Cc:     Boris Kolpackov <boris@codesynthesis.com>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        linux-kbuild <linux-kbuild@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Thu, Sep 23, 2021 at 1:17 AM Richard Weinberger <richard@nod.at> wrote:
>
> Boris,
>
> ----- Urspr=C3=BCngliche Mail -----
> > Von: "Boris Kolpackov" <boris@codesynthesis.com>
> > An: "richard" <richard@nod.at>
> > CC: "masahiroy" <masahiroy@kernel.org>, "linux-kernel" <linux-kernel@vg=
er.kernel.org>, "linux-kbuild"
> > <linux-kbuild@vger.kernel.org>
> > Gesendet: Mittwoch, 22. September 2021 17:18:43
> > Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string v=
alues
>
> > Richard Weinberger <richard@nod.at> writes:
> >
> >> > So effectively it's now impossible to include ` or $ in kconfig
> >> > string values. Seems like a major, backwards-incompatible
> >> > restriction.
> >>
> >> Do you have a working example?
> >
> > You mean of a project that uses kconfig and that is capable of
> > handling string values with these characters? If so, then yes,
> > see for example, libbuild2-kconfig[1] which is a build system
> > module that implements kconfig-based configuration support for
> > build2. In particular, it exposes values from .config  as
> > buildfile variables but it doesn't do this by sourcing .config.
> > Instead it loads .config using the kconfig API and then sets
> > the corresponding buildfile variables programmatically.
>
> I had a config setting of Linux in mind. :-)
>
> >
> >> Since the config is sourced in the scripts/setlocalversion it will
> >> not work correctly anyway.
> >
> > The actual file being sources is include/config/auto.conf, not
> > .config, right?
> >
>
> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.
>
> >> > I think if this is really desired, then it should be re-done with
> >> > escaping (similar to ") rather than outright banning inconvenient
> >> > characters.
> >>
> >> Escaping is not so easy since the very same content is included
> >> in shell scripts (sertlocalversion), in Makefiles and in C files.
> >
> > Again, I don't think it's .config that gets included in C files but
> > rather include/generated/autoconf.h, right?
> >
>
> Yes. But the key/values are taken as-is.
>
> Just add some odd characters to your .config, build the kernel and observ=
e
> the breakage at different levels.
> Or something like CONFIG_DEFAULT_HOSTNAME=3D"`touch owned`". ;-)
>
> >> At least I didn't find find a good way to escape these characters
> >> such that all three programming environments will accept it.
> >
> > If my understanding is correct, then you are concerned with the
> > autoconf functionality: the auto.conf makefile and autoconf.h
> > header, and not the .config file itself. Perhaps it will be less
> > disruptive to do the escaping (or banning) at that level?
>
> My concern is that currently a .config file can contain hostile content
> that will get executed at build time.
> .config files are often blindly shared across untrusted developers.
> So I thought that mitigating this whole is worth it.
>
> > Specifically:
> >
> > 1. If you do escaping at that level, then you can do it differently
> >   for auto.conf and autoconf.h. Though auto.conf still seems to be
> >   read by both make and shell.
>
> I need to think about that. Thanks for the pointer.
>
> Thanks,
> //richard


I recalled that we discussed this a few years ago.

https://lore.kernel.org/all/20180217203945.2515-1-richard@nod.at/


include/config/auto.conf is just a sub-set of .config
with "# CONFIG... is not set" dropped.

If we do some escapings in it is not feasible
as you mentioned, due to the difference of escaping
between makefile and shell-scripts.

$$ for makefiles
\$  for shell scripts


If we go this way, perhaps, we need to generate two files
include/config/autoconf.mk and include/config/autoconf.sh


BTW, xtensa relies on having $ in the .config file.

masahiro@grover:~/workspace/linux-kbuild$ find . -name '*_defconfig' |
xargs grep '\$'
./arch/xtensa/configs/cadence_csp_defconfig:CONFIG_INITRAMFS_SOURCE=3D"$$KE=
RNEL_INITRAMFS_SOURCE"


If we make this decision, we need to persuade xtensa folks
to not do this...


--=20
Best Regards
Masahiro Yamada