Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 27 Sep 2021 16:34:22 +0200
From:   Boris Kolpackov <boris@codesynthesis.com>
To:     Richard Weinberger <richard@nod.at>
Cc:     masahiroy <masahiroy@kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        linux-kbuild <linux-kbuild@vger.kernel.org>
Subject: Re: [PATCH 2/2] kconfig: Deny command substitution in string values
Message-ID: <boris.20210927162833@codesynthesis.com>
References: <20210920213957.1064-1-richard@nod.at>
 <20210920213957.1064-2-richard@nod.at>
 <boris.20210922090732@codesynthesis.com>
 <1402570794.96583.1632295660867.JavaMail.zimbra@nod.at>
 <boris.20210922165140@codesynthesis.com>
 <1942256037.97524.1632327460626.JavaMail.zimbra@nod.at>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1942256037.97524.1632327460626.JavaMail.zimbra@nod.at>
Organization: Code Synthesis
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk

Richard Weinberger <richard@nod.at> writes:

> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.

No, sym_escape_string_value() is called by conf_write_symbol()
which in turn is called from conf_write() and conf_write_defconfig()
(used to write .config files) besides conf_write_autoconf() (used to
write auto.conf).