uboot: (firmwareOdroidC2/C4) don't invoke patch tool, use patches = [] instead
https://github.com/NixOS/nixpkgs/blob/master/pkgs/stdenv/generic/setup.sh#L948 this can do it nicely. Signed-off-by: Anton Arapov <anton@deadbeef.mx>
This commit is contained in:
Anton Arapov
Alan Daniels
commit
56de2bcd43
30691 changed files with 3076956 additions and 0 deletions
181
pkgs/applications/virtualization/virtualbox/hardened.patch
Normal file
181
pkgs/applications/virtualization/virtualbox/hardened.patch
Normal file
|
|
@ -0,0 +1,181 @@
|
|||
diff --git a/include/iprt/mangling.h b/include/iprt/mangling.h
|
||||
index 25b918d1..1420ff1d 100644
|
||||
--- a/include/iprt/mangling.h
|
||||
+++ b/include/iprt/mangling.h
|
||||
@@ -1695,6 +1695,7 @@
|
||||
# define RTPathStripSuffix RT_MANGLER(RTPathStripSuffix)
|
||||
# define RTPathStripFilename RT_MANGLER(RTPathStripFilename)
|
||||
# define RTPathStripTrailingSlash RT_MANGLER(RTPathStripTrailingSlash)
|
||||
+# define RTPathSuidDir RT_MANGLER(RTPathSuidDir)
|
||||
# define RTPathTemp RT_MANGLER(RTPathTemp)
|
||||
# define RTPathTraverseList RT_MANGLER(RTPathTraverseList)
|
||||
# define RTPathUnlink RT_MANGLER(RTPathUnlink)
|
||||
@@ -1734,6 +1735,7 @@
|
||||
# define RTProcGetAffinityMask RT_MANGLER(RTProcGetAffinityMask)
|
||||
# define RTProcGetExecutablePath RT_MANGLER(RTProcGetExecutablePath)
|
||||
# define RTProcGetPriority RT_MANGLER(RTProcGetPriority)
|
||||
+# define RTProcGetSuidPath RT_MANGLER(RTProcGetSuidPath)
|
||||
# define RTProcIsRunningByName RT_MANGLER(RTProcIsRunningByName)
|
||||
# define RTProcQueryParent RT_MANGLER(RTProcQueryParent)
|
||||
# define RTProcQueryUsername RT_MANGLER(RTProcQueryUsername)
|
||||
diff --git a/include/iprt/path.h b/include/iprt/path.h
|
||||
index 99060e35..ccfbeb76 100644
|
||||
--- a/include/iprt/path.h
|
||||
+++ b/include/iprt/path.h
|
||||
@@ -1221,6 +1221,15 @@ RTDECL(int) RTPathCalcRelative(char *pszPathDst, size_t cbPathDst, const char *p
|
||||
*/
|
||||
RTDECL(int) RTPathExecDir(char *pszPath, size_t cchPath);
|
||||
|
||||
+/**
|
||||
+ * Gets the path to the NixOS setuid wrappers directory.
|
||||
+ *
|
||||
+ * @returns iprt status code.
|
||||
+ * @param pszPath Buffer where to store the path.
|
||||
+ * @param cchPath Buffer size in bytes.
|
||||
+ */
|
||||
+RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath);
|
||||
+
|
||||
/**
|
||||
* Gets the user home directory.
|
||||
*
|
||||
diff --git a/include/iprt/process.h b/include/iprt/process.h
|
||||
index f4f67dd4..ab882a19 100644
|
||||
--- a/include/iprt/process.h
|
||||
+++ b/include/iprt/process.h
|
||||
@@ -352,6 +352,16 @@ RTR3DECL(const char *) RTProcExecutablePath(void);
|
||||
*/
|
||||
RTR3DECL(char *) RTProcGetExecutablePath(char *pszExecPath, size_t cbExecPath);
|
||||
|
||||
+/**
|
||||
+ * Gets the path to the NixOS setuid wrappers directory.
|
||||
+ *
|
||||
+ * @returns pszExecPath on success. NULL on buffer overflow or other errors.
|
||||
+ *
|
||||
+ * @param pszExecPath Where to store the path.
|
||||
+ * @param cbExecPath The size of the buffer.
|
||||
+ */
|
||||
+RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath);
|
||||
+
|
||||
/**
|
||||
* Daemonize the current process, making it a background process.
|
||||
*
|
||||
diff --git a/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp b/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp
|
||||
index 75ff8572..18a077b7 100644
|
||||
--- a/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp
|
||||
+++ b/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp
|
||||
@@ -1531,9 +1531,9 @@ static int supR3HardenedVerifyFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState, bo
|
||||
bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 2 /*bin*/ || suplibHardenedStrCmp(pszPath, "/usr/lib/iconv");
|
||||
# else
|
||||
NOREF(fRelaxed);
|
||||
- bool fBad = true;
|
||||
+ bool fBad = !(fDir && pFsObjState->Stat.st_mode & S_ISVTX && !suplibHardenedStrCmp(pszPath, "/nix/store"));
|
||||
# endif
|
||||
- if (fBad)
|
||||
+ if (fBad && suplibHardenedStrCmp(pszPath, "/nix/store"))
|
||||
return supR3HardenedSetError3(VERR_SUPLIB_WRITE_NON_SYS_GROUP, pErrInfo,
|
||||
"An unknown (and thus untrusted) group has write access to '", pszPath,
|
||||
"' and we therefore cannot trust the directory content or that of any subdirectory");
|
||||
diff --git a/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp b/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp
|
||||
index 2991d3a7..d042a08b 100644
|
||||
--- a/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp
|
||||
+++ b/src/VBox/Main/src-all/MachineLaunchVMCommonWorker.cpp
|
||||
@@ -90,7 +90,7 @@ int MachineLaunchVMCommonWorker(const Utf8Str &aNameOrId,
|
||||
|
||||
/* Get the path to the executable directory w/ trailing slash: */
|
||||
char szPath[RTPATH_MAX];
|
||||
- int vrc = RTPathAppPrivateArch(szPath, sizeof(szPath));
|
||||
+ int vrc = RTStrCopy(szPath, sizeof(szPath) - 1, "/run/wrappers/bin");
|
||||
AssertRCReturn(vrc, vrc);
|
||||
size_t cbBufLeft = RTPathEnsureTrailingSeparator(szPath, sizeof(szPath));
|
||||
AssertReturn(cbBufLeft > 0, VERR_FILENAME_TOO_LONG);
|
||||
diff --git a/src/VBox/Main/src-server/NetworkServiceRunner.cpp b/src/VBox/Main/src-server/NetworkServiceRunner.cpp
|
||||
index 2e57690a..3272c840 100644
|
||||
--- a/src/VBox/Main/src-server/NetworkServiceRunner.cpp
|
||||
+++ b/src/VBox/Main/src-server/NetworkServiceRunner.cpp
|
||||
@@ -188,7 +188,7 @@ int NetworkServiceRunner::start(bool aKillProcessOnStop)
|
||||
* ASSUME it is relative to the directory that holds VBoxSVC.
|
||||
*/
|
||||
char szExePath[RTPATH_MAX];
|
||||
- AssertReturn(RTProcGetExecutablePath(szExePath, RTPATH_MAX), VERR_FILENAME_TOO_LONG);
|
||||
+ AssertReturn(RTProcGetSuidPath(szExePath, RTPATH_MAX), VERR_FILENAME_TOO_LONG);
|
||||
RTPathStripFilename(szExePath);
|
||||
int vrc = RTPathAppend(szExePath, sizeof(szExePath), m->pszProcName);
|
||||
AssertLogRelRCReturn(vrc, vrc);
|
||||
diff --git a/src/VBox/Main/src-server/generic/NetIf-generic.cpp b/src/VBox/Main/src-server/generic/NetIf-generic.cpp
|
||||
index af155966..3b8e793d 100644
|
||||
--- a/src/VBox/Main/src-server/generic/NetIf-generic.cpp
|
||||
+++ b/src/VBox/Main/src-server/generic/NetIf-generic.cpp
|
||||
@@ -48,7 +48,7 @@ static int NetIfAdpCtl(const char * pcszIfName, const char *pszAddr, const char
|
||||
const char *args[] = { NULL, pcszIfName, pszAddr, pszOption, pszMask, NULL };
|
||||
|
||||
char szAdpCtl[RTPATH_MAX];
|
||||
- int rc = RTPathExecDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME));
|
||||
+ int rc = RTPathSuidDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME));
|
||||
if (RT_FAILURE(rc))
|
||||
{
|
||||
LogRel(("NetIfAdpCtl: failed to get program path, rc=%Rrc.\n", rc));
|
||||
@@ -95,7 +95,7 @@ static int NetIfAdpCtl(HostNetworkInterface * pIf, const char *pszAddr, const ch
|
||||
int NetIfAdpCtlOut(const char * pcszName, const char * pcszCmd, char *pszBuffer, size_t cBufSize)
|
||||
{
|
||||
char szAdpCtl[RTPATH_MAX];
|
||||
- int rc = RTPathExecDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " ") - strlen(pcszCmd));
|
||||
+ int rc = RTPathSuidDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " ") - strlen(pcszCmd));
|
||||
if (RT_FAILURE(rc))
|
||||
{
|
||||
LogRel(("NetIfAdpCtlOut: Failed to get program path, rc=%Rrc\n", rc));
|
||||
@@ -210,7 +210,7 @@ int NetIfCreateHostOnlyNetworkInterface(VirtualBox *pVirtualBox,
|
||||
progress.queryInterfaceTo(aProgress);
|
||||
|
||||
char szAdpCtl[RTPATH_MAX];
|
||||
- vrc = RTPathExecDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " add"));
|
||||
+ vrc = RTPathSuidDir(szAdpCtl, sizeof(szAdpCtl) - sizeof("/" VBOXNETADPCTL_NAME " add"));
|
||||
if (RT_FAILURE(vrc))
|
||||
{
|
||||
progress->i_notifyComplete(E_FAIL,
|
||||
diff --git a/src/VBox/Runtime/r3/path.cpp b/src/VBox/Runtime/r3/path.cpp
|
||||
index 4b1a0ada..7f6dd707 100644
|
||||
--- a/src/VBox/Runtime/r3/path.cpp
|
||||
+++ b/src/VBox/Runtime/r3/path.cpp
|
||||
@@ -81,6 +81,12 @@ RTDECL(int) RTPathExecDir(char *pszPath, size_t cchPath)
|
||||
}
|
||||
|
||||
|
||||
+RTDECL(int) RTPathSuidDir(char *pszPath, size_t cchPath)
|
||||
+{
|
||||
+ return RTStrCopy(pszPath, cchPath, "/run/wrappers/bin");
|
||||
+}
|
||||
+
|
||||
+
|
||||
RTDECL(int) RTPathAppPrivateNoArch(char *pszPath, size_t cchPath)
|
||||
{
|
||||
#if !defined(RT_OS_WINDOWS) && defined(RTPATH_APP_PRIVATE)
|
||||
diff --git a/src/VBox/Runtime/r3/process.cpp b/src/VBox/Runtime/r3/process.cpp
|
||||
index 5f7c7a87..59461cfa 100644
|
||||
--- a/src/VBox/Runtime/r3/process.cpp
|
||||
+++ b/src/VBox/Runtime/r3/process.cpp
|
||||
@@ -117,6 +117,25 @@ RTR3DECL(const char *) RTProcExecutablePath(void)
|
||||
return g_szrtProcExePath;
|
||||
}
|
||||
|
||||
+/*
|
||||
+ * Note the / at the end! This is important, because the functions using this
|
||||
+ * will cut off everything after the rightmost / as this function is analogous
|
||||
+ * to RTProcGetExecutablePath().
|
||||
+ */
|
||||
+#define SUIDDIR "/run/wrappers/bin/"
|
||||
+
|
||||
+RTR3DECL(char *) RTProcGetSuidPath(char *pszExecPath, size_t cbExecPath)
|
||||
+{
|
||||
+ if (cbExecPath >= sizeof(SUIDDIR))
|
||||
+ {
|
||||
+ memcpy(pszExecPath, SUIDDIR, sizeof(SUIDDIR));
|
||||
+ pszExecPath[sizeof(SUIDDIR)] = '\0';
|
||||
+ return pszExecPath;
|
||||
+ }
|
||||
+
|
||||
+ AssertMsgFailed(("Buffer too small (%zu <= %zu)\n", cbExecPath, sizeof(SUIDDIR)));
|
||||
+ return NULL;
|
||||
+}
|
||||
|
||||
RTR3DECL(const char *) RTProcShortName(void)
|
||||
{
|
||||
Loading…
Add table
Add a link
Reference in a new issue