Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <030ca8bc8258a4edc1aef23b077f9b4463b24639.camel@linux.intel.com>
Subject: Re: [PATCH linux-next] tools: power: x86: intel_pstate_tracer:
 intel_pstate_tracer: Replace the relative path of the called grep with an
 absolute path
From:   srinivas pandruvada <srinivas.pandruvada@linux.intel.com>
To:     Doug Smythies <dsmythies@telus.net>, cgel.zte@gmail.com
Cc:     linux-kernel@vger.kernel.org, xu.panda@zte.com.cn,
        ray.huang@amd.com, rafael.j.wysocki@intel.com, Jinzhou.Su@amd.com,
        Zeal Robot <zealci@zte.com.cn>,
        zhanglin <zhang.lin16@zte.com.cn>,
        Linux PM list <linux-pm@vger.kernel.org>
Date:   Tue, 06 Sep 2022 05:21:42 -0700
In-Reply-To: <CAAYoRsUFF=ebThB3gKUw2G1G2HO_HmBXvd-+XiwYtiKpJ41zqw@mail.gmail.com>
References: <20220829125447.268741-1-xu.panda@zte.com.cn>
         <CAAYoRsUFF=ebThB3gKUw2G1G2HO_HmBXvd-+XiwYtiKpJ41zqw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.38.4 (3.38.4-1.fc33) 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Sun, 2022-09-04 at 15:23 -0700, Doug Smythies wrote:
> Note: Modifying the address list a little with this reply.
> 

Subject can be "Use absolute path for grep"

> On Mon, Aug 29, 2022 at 5:55 AM <cgel.zte@gmail.com> wrote:
> > 
> > From: xupanda <xu.panda@zte.com.cn>
> > 
> > Using absolute paths when invoking grep can lead to serious
> > security
> > issues. 
I think you mean 
"Not using absolute path when invoking grep can lead to serious
security issues"

Thanks,
Srinivas

> > A malicious operator may create a new file named grep in the
> > PATH before the real grep file. When the program executes and calls
> > grep, the fake grep file will be executed, so that the malicious
> > operator can execute arbitrary code or even obtain root privileges.
> > Using absolute paths when calling grep avoids this problem.
> > 
> > Reported-by: Zeal Robot <zealci@zte.com.cn>
> > Signed-off-by: xupanda <xu.panda@zte.com.cn>
> > Reviewed-by: zhanglin <zhang.lin16@zte.com.cn>
> 
> Acked-by: Doug Smythies <dsmythies@telus.net>
> 
> > 
> > ---
> >  tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 4 ++-
> > -
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git
> > a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
> > b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
> > index b46e9eb8f5aa..d6fae6e51d30 100755
> > --- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
> > +++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py
> > @@ -348,8 +348,8 @@ def split_csv(current_max_cpu, cpu_mask):
> >      if os.path.exists('cpu.csv'):
> >          for index in range(0, current_max_cpu + 1):
> >              if cpu_mask[int(index)] != 0:
> > -                os.system('grep -m 1 common_cpu cpu.csv >
> > cpu{:0>3}.csv'.format(index))
> > -                os.system('grep CPU_{:0>3} cpu.csv >>
> > cpu{:0>3}.csv'.format(index, index))
> > +                os.system('/usr/bin/grep -m 1 common_cpu cpu.csv >
> > cpu{:0>3}.csv'.format(index))
> > +                os.system('/usr/bin/grep CPU_{:0>3} cpu.csv >>
> > cpu{:0>3}.csv'.format(index, index))
> > 
> >  def fix_ownership(path):
> >      """Change the owner of the file to SUDO_UID, if required"""
> > --
> > 2.25.1
> >