Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   cgel.zte@gmail.com
To:     linux-kernel@vger.kernel.org
Cc:     xu.panda@zte.com.cn, ray.huang@amd.com, dsmythies@telus.net,
        rafael.j.wysocki@intel.com, Jinzhou.Su@amd.com,
        Zeal Robot <zealci@zte.com.cn>,
        zhanglin <zhang.lin16@zte.com.cn>
Subject: [PATCH linux-next] tools: power: x86: intel_pstate_tracer: intel_pstate_tracer: Replace the relative path of the called grep with an absolute path
Date:   Mon, 29 Aug 2022 12:54:48 +0000
Message-Id: <20220829125447.268741-1-xu.panda@zte.com.cn>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: xupanda <xu.panda@zte.com.cn>

Using absolute paths when invoking grep can lead to serious security
issues. A malicious operator may create a new file named grep in the
PATH before the real grep file. When the program executes and calls
grep, the fake grep file will be executed, so that the malicious
operator can execute arbitrary code or even obtain root privileges.
Using absolute paths when calling grep avoids this problem.

Reported-by: Zeal Robot <zealci@zte.com.cn>
Signed-off-by: xupanda <xu.panda@zte.com.cn>
Reviewed-by: zhanglin <zhang.lin16@zte.com.cn>

---
 tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
index b46e9eb8f5aa..d6fae6e51d30 100755
--- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
+++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
@@ -348,8 +348,8 @@ def split_csv(current_max_cpu, cpu_mask):
     if os.path.exists('cpu.csv'):
         for index in range(0, current_max_cpu + 1):
             if cpu_mask[int(index)] != 0:
-                os.system('grep -m 1 common_cpu cpu.csv > cpu{:0>3}.csv'.format(index))
-                os.system('grep CPU_{:0>3} cpu.csv >> cpu{:0>3}.csv'.format(index, index))
+                os.system('/usr/bin/grep -m 1 common_cpu cpu.csv > cpu{:0>3}.csv'.format(index))
+                os.system('/usr/bin/grep CPU_{:0>3} cpu.csv >> cpu{:0>3}.csv'.format(index, index))
 
 def fix_ownership(path):
     """Change the owner of the file to SUDO_UID, if required"""
-- 
2.25.1