Commit Graph

1474 Commits

Author SHA1 Message Date
Denys Vlasenko
fdb92359e4 pivot_root: make it NOFORK
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-05 01:51:12 +02:00
Denys Vlasenko
9f59849daa blockdev, fsfreeze, fstrim, mountpoint: make NOEXEC
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-05 01:29:12 +02:00
Denys Vlasenko
5c527dc57e make 17 state-changing execing applets (ex: "nice PROG ARGS") noexec
The applets with "<applet> [opts] PROG ARGS" API very quickly exec
another program, noexec is okay for them:

 chpst/envdir/envuidgid/softlimit/setuidgid
 chroot
 chrt
 ionice
 nice
 nohup
 setarch/linux32/linux64
 taskset
 cttyhack

"reset" and "sulogin" applets don't have this form, but also exec
another program at once, thus made noexec too.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-04 19:55:01 +02:00
Denys Vlasenko
6514785f95 mesg: make in NOFORK
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-04 19:16:01 +02:00
Denys Vlasenko
74c05f5b2c chat: trim help text
Noticed while auditing nofork/noexec status

function                                             old     new   delta
packed_usage                                       31777   31747     -30

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-04 17:36:16 +02:00
Denys Vlasenko
72d725d7cc getopt: make it NOEXEC
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-03 19:30:21 +02:00
Denys Vlasenko
84ea60ed65 line editing: make read_line_input() not take timeout param
It's almost always -1.

function                                             old     new   delta
read_line_input                                     3902    3912     +10
new_line_input_t                                      24      31      +7
pgetc                                                583     585      +2
save_command_ps_at_cur_history                        80      78      -2
read_line                                             76      74      -2
fgetc_interactive                                    246     244      -2
addLines                                              84      82      -2
doCommands                                          2226    2222      -4
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/5 up/down: 19/-12)              Total: 7 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-02 17:27:28 +02:00
Denys Vlasenko
95f7953f2c do not use `a' quoting style in comments
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-02 14:26:33 +02:00
Denys Vlasenko
5b3cbe3a53 config: more tweaking of help texts
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-27 14:45:25 +02:00
Denys Vlasenko
e9a5a6985c rdate: tweak comments, no code changes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-27 14:31:59 +02:00
Denys Vlasenko
8cae43c5d7 swapon: do not use FEATURE_MOUNT_LABEL, have your own FEATURE_SWAPONOFF_LABEL
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-27 10:58:08 +02:00
Denys Vlasenko
68b653b66b config: trim/improve item names and help texts, take 2
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-27 10:53:09 +02:00
Denys Vlasenko
73c47f6c41 volume_id: enable minix detection
function                                             old     new   delta
volume_id_probe_minix                                  -      87     +87
fs2                                                   64      68      +4
------------------------------------------------------------------------------
(add/remove: 2/0 grow/shrink: 1/0 up/down: 91/0)               Total: 91 bytes

Patch by wdlkmpx <wdlkmpx@gmail.com>

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-25 14:22:08 +02:00
Denys Vlasenko
72089cf6b4 config: deindent all help texts
Those two spaces after tab have no effect, and always a nuisance when editing.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-21 09:50:55 +02:00
Denys Vlasenko
61f9d76ec5 swapon/swapoff: trim config help text
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-19 14:39:30 +02:00
Denys Vlasenko
ae178cee3d Update remaining menuconfig items with approximate applet sizes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-19 14:32:54 +02:00
Denys Vlasenko
4eed2c6c50 Update menuconfig items with approximate applet sizes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-18 22:01:24 +02:00
Denys Vlasenko
08dfafc437 fix more instances of ": $((a++))" in shell scripts
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-15 19:20:45 +02:00
Denys Vlasenko
8ea061eac3 blkdiscard: provide our own BLK[SEC]DISCARD if necessary
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-15 13:53:41 +02:00
Denys Vlasenko
ce55284ed6 inetd,mount: do not die if uclibc without RPC is detected
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-10 14:43:22 +02:00
Denys Vlasenko
b0c0b6d5ba setpriv: remove dependency on libcap headers
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-07 17:59:40 +02:00
Denys Vlasenko
2bfe7838ab setpriv: factor out capability name printing
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-07 16:09:45 +02:00
Denys Vlasenko
cf5748cc89 setpriv: code shrink, and grouping capability code together
function                                             old     new   delta
static.versions                                        -       3      +3
getcaps                                              174     149     -25

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-07 16:00:07 +02:00
Patrick Steinhardt
6842d00ceb setpriv: allow modifying ambient capabilities
With Linux 4.3, a new set of capabilities has been introduced with the
ambient capabilities. These aim to solve the problem that it was
impossible to grant run programs with elevated privileges across
non-root users. Quoting from capabilities(7):

    This is a set of capabilities that are preserved across an execve(2)
    of a program that is not privileged.  The ambient capability set
    obeys the invariant that no capability can ever be ambient if it is
    not both permitted and inheritable.

With this new set of capabilities it is now possible to run an
executable with elevated privileges as a different user, making it much
easier to do proper privilege separation.

Note though that the `--ambient-caps` switch is not part of any released
version of util-linux, yet. It has been applied in 0c92194ee (setpriv:
support modifying the set of ambient capabilities, 2017-06-24) and will
probably be part of v2.31.

function                                             old     new   delta
parse_cap                                              -     174    +174
setpriv_main                                        1246    1301     +55
.rodata                                           146307  146347     +40
static.setpriv_longopts                               40      55     +15
packed_usage                                       32092   32079     -13

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-07 02:14:23 +02:00
Patrick Steinhardt
0f49f6f926 setpriv: allow modifying inheritable caps
The main use case of setpriv is to modify the current state of
privileges available to the calling process and spawn a new executable
with the modified, new state. Next to the already supported case of
modifying the no-new-privs flag, util-linux also supports to modify
capability sets.

This commit introduces to add or drop capabilities from the set of
inheritable capabilities. Quoting from capabilities(7):

    This is a set of capabilities preserved across an execve(2).
    Inheritable capabilities remain inheritable when executing any
    program, and inheritable capabilities are added to the permitted set
    when executing a program that has the corresponding bits set in the
    file inheritable set.

As such, inheritable capabilities enable executing files with certain
privileges if the file itself has these privileges set. Note though that
inheritable capabilities are dropped across execve when running as a
non-root user.

function                                             old     new   delta
getcaps                                                -     237    +237
setpriv_main                                        1129    1246    +117
.rodata                                           146198  146307    +109
static.setpriv_longopts                               29      40     +11
packed_usage                                       32107   32092     -15

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-07 01:59:45 +02:00
Patrick Steinhardt
5e0987405c setpriv: dump ambient capabilities
As with the previous commit, this commit introduces the ability to dump
the set of ambient capabilities.

function                                             old     new   delta
setpriv_main                                         982    1129    +147
.rodata                                           146148  146198     +50

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-06 23:02:33 +02:00
Patrick Steinhardt
f34c701fa8 setpriv: dump capability bounding set
As with the previous commit, this one implements the ability to dump the
capability bounding set.

function                                             old     new   delta
setpriv_main                                         838     982    +144
.rodata                                           146101  146148     +47

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-06 22:59:23 +02:00
Patrick Steinhardt
ad63102943 setpriv: dump inheritable capability set
The setpriv executable from util-linux also dumps out information on the
different capability sets known by the kernel. By default, these are the
inheritable capabilities, bounding capabilities and (not yet released)
the ambient capabilities, which have been introduced with Linux 4.3.
This patch introduces the ability to dump the set of inheritable
capabilities.

By default, setpriv(1) identifies capabilities by their human-readable
name, for example 'net_admin'. For unknown capabilities, though, it does
instead use the capability's value, for example 'cap_12', which is
equivalent to 'net_admin'. As there is no kernel interface to retrieve
capability names by their index, we have to declare these ourselves,
which adds to setpriv's size.

To counteract, using the human-readble name has been made configurable.
The following sizes are with the 'FEATURE_SETPRIV_CAPABILITY_NAMES'
enabled:

function                                             old     new   delta
.rodata                                           145969  146405    +436
setpriv_main                                         467     842    +375
capabilities                                           -     304    +304

And with 'FEATURE_SETPRIV_CAPABILITY_NAMES' disabled:

function                                             old     new   delta
setpriv_main                                         467     838    +371
.rodata                                           145969  146101    +132

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-06 22:47:16 +02:00
Patrick Steinhardt
10c53b85c9 setpriv: dump no-new-privs info
Introduce the ability to dump the state of the no-new-privs flag, which
states whethere it is allowed to grant new privileges.

function                                             old     new   delta
setpriv_main                                         419     467     +48
.rodata                                           145926  145969     +43

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-06 22:27:22 +02:00
Denys Vlasenko
6798486141 setpriv: dump user and group info
setpriv from util-linux has an option to dump the current state
regarding privilege settings via '--dump'. It prints out information on
the real and effective user and group IDs, supplementary groups, the
no-new-privs flag, the capability sets as well as secure bits.

This patch is the start of supporting this mode. To make introduction of
the '--dump' easier to reason about, its introduction has been split
into multiple patches. This particular one introduces the ability to
print out user and group information of the current process.

function                                             old     new   delta
setpriv_main                                          89     322    +233
getresuid                                              -      41     +41
getresgid                                              -      41     +41
static.setpriv_longopts                               22      29      +7
packed_usage                                       31675   31669      -6
------------------------------------------------------------------------------
(add/remove: 4/0 grow/shrink: 2/1 up/down: 322/-6)            Total: 316 bytes

Patch by Patrick Steinhardt <ps@pks.im>

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-04 18:59:11 +02:00
Patrick Steinhardt
6a3bcf340a setpriv: prepare option parsing logic for additional opts
The current option parsing logic of setpriv only supports the case where
we want to execute a sub-program and have at most one argument. Refactor
handling of options to solve these shortcomings to make it easy to
support 'setpriv --dump', which does not accept any additional
arguments, as well as the case where additional options are passed to
setpriv. This is done by handling 'argc' ourselves, throwing an error
when no program is specified, as well as introducing an enum for the
different option bitmasks.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-04 17:15:32 +02:00
Patrick Steinhardt
d253b557a3 setpriv: do not process remaining args
By default, the 'getopt32' call will continue parsing the command line
even after hitting a non-option string. But in setpriv, this should be
avoided, as all parameters following the initial non-option argument are
in fact arguments to the binary that is to be executed by setpriv.
Otherwise, calling e.g. 'busybox setpriv ls -l' would result in an error
due to the unknown parameter "-l".

Fix the issue by passing "+" as the first character in the options
string. This will cause 'getopt32' to stop processing after hitting the
first non-option.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-04 17:10:31 +02:00
Denys Vlasenko
d4e4fdb5ce fixes for bugs found by make_single_applets.sh
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-07-03 21:31:16 +02:00
Denys Vlasenko
45100b8d07 unshare: fix help text; select LONG_OPTS instead depending on them
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-06-14 16:20:02 +02:00
Assaf Gordon
62d1e98fbd setpriv: new applet
Add a minimal 'setpriv' implementation supporting the NO_NEW_PRIVS bit.
Typical usage:

    $ busybox setpriv sudo uname
    Linux
    $ busybox setpriv --nnp sudo uname
    sudo: effective uid is not 0, is /usr/bin/sudo on a file system with
    the 'nosuid' option set or an NFS file system without root privileges?

function                                             old     new   delta
packed_usage                                       31580   31685    +105
setpriv_main                                           -      87     +87
prctl                                                  -      53     +53
static.setpriv_longopts                                -      22     +22
applet_names                                        2620    2628      +8
applet_main                                         1516    1520      +4
------------------------------------------------------------------------------
(add/remove: 5/0 grow/shrink: 3/0 up/down: 279/0)             Total: 279 bytes

Signed-off-by: Assaf Gordon <assafgordon@gmail.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-06-14 11:46:52 +02:00
Denys Vlasenko
10ad622dc2 Spelling fixes in comments, documentation, tests and examples
By klemens <ka7@github.com>

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-04-17 16:13:32 +02:00
Kaarle Ritvanen
835ad3a984 libbb: GETOPT_RESET macro
Signed-off-by: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-04-12 20:11:34 +02:00
Denys Vlasenko
0cecbe7d5d Sort more misplaced applets into coreutils or util-linux
No code changes

Surprisingly, nice and renice are coming from different packages :)

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-04-12 14:16:29 +02:00
Denys Vlasenko
783d57af7b Sort some miscutils/ applets into coreutils or util-linux
No code changes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-04-12 13:58:40 +02:00
Denys Vlasenko
67918b32ab fallocate: new applet
NAME
       fallocate - preallocate or deallocate space to a file
SYNOPSIS
       fallocate [-c|-p|-z] [-o offset] -l length [-n] filename
       fallocate -d [-o offset] [-l length] filename
DESCRIPTION
       fallocate  is  used  to manipulate the allocated disk space for a file,
       either to deallocate or preallocate it.  For filesystems which  support
       the  fallocate system call, preallocation is done quickly by allocating
       blocks and marking them as uninitialized, requiring no IO to  the  data
       blocks.   This  is  much faster than creating a file by filling it with
       zeroes.

function                                             old     new   delta
fallocate_main                                         -     179    +179
applet_names                                        2597    2606      +9
applet_main                                         1504    1508      +4
applet_suid                                           94      95      +1
applet_install_loc                                   188     189      +1

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-04-11 13:33:54 +02:00
Denys Vlasenko
b9512fa6b3 fsfreeze: new applet
NAME
       fsfreeze - suspend access to a filesystem (Ext3/4, ReiserFS, JFS, XFS)
SYNOPSIS
       fsfreeze --freeze|--unfreeze mountpoint
DESCRIPTION
       fsfreeze suspends or resumes access to a filesystem.
       fsfreeze halts any new access to the filesystem and creates a stable
       image on disk.
AVAILABILITY
       The fsfreeze command is part of the util-linux 2.28

function                                             old     new   delta
fsfreeze_main                                          -      81     +81
applet_names                                        2597    2606      +9
applet_main                                         1504    1508      +4
applet_suid                                           94      95      +1
applet_install_loc                                   188     189      +1

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-04-11 11:53:05 +02:00
Andrei Gherzan
e3b65ab43d switch_root: don't bail out when console doesn't exist
Busybox is very often used in initramfs at the end of which usually
there is a switch_root to the actual rootfs. There are many cases where
the console kernel argument is either just a placeholder (for example
RaspberryPi uses serial0 and serial1) or configured as null to avoid any
console messages - usually you would see such of a setup in production
environments.

Currently busybox bails out if can't open the console argument. If this
happenes in initramfs and if the console=null for example, you get in a
blind kernel panic. Avoid this by only warning instead of dying.

function                                             old     new   delta
switch_root_main                                     371     368      -3

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-03-24 16:39:08 +01:00
Denys Vlasenko
a98db793cf Revert "umount: make -d always active, add -D to suppress it"
This reverts commit 86a03bee1d.

Since now our "mount -oloop" creates AUTOCLEARed loopdevs, we no longer
need our umount to destroy loopdevs to match the usual util-linux behaviour.

Now this revert fixes another, opposite bug: "explicit" mount /dev/loopN
and then umount must not drop loopdevs!

User complaint is as follows:

It seems LOOP_CLR_FD called on a loop-*partition* removes the mapping of
the whole *device* - which results in the following:

root@LEDE:/# loop=$(losetup -f)
root@LEDE:/# echo ${loop}
/dev/loop2
root@LEDE:/# losetup ${loop} /IMAGE
root@LEDE:/# ls -l ${loop}*
brw-------  1 root root     7,   2 Mar  6 20:09 /dev/loop2
root@LEDE:/# partprobe ${loop}
root@LEDE:/# ls -l ${loop}*
brw-------  1 root  root    7,   2 Mar  6 20:09 /dev/loop2
brw-------  1 root  root  259,   8 Mar  6 21:59 /dev/loop2p1
brw-------  1 root  root  259,   9 Mar  6 21:59 /dev/loop2p2
brw-------  1 root  root  259,  10 Mar  6 21:59 /dev/loop2p3
brw-------  1 root  root  259,  11 Mar  6 21:59 /dev/loop2p4
brw-------  1 root  root  259,  12 Mar  6 21:59 /dev/loop2p5
brw-------  1 root  root  259,  13 Mar  6 21:59 /dev/loop2p6
brw-------  1 root  root  259,  14 Mar  6 21:59 /dev/loop2p7
brw-------  1 root  root  259,  15 Mar  6 21:59 /dev/loop2p8
root@LEDE:/# mount ${loop}p8 /MOUNT       # mount loop partition
root@LEDE:/# losetup -a | grep $loop      # loop dev mapping still there
/dev/loop2: 0 /mnt/IMAGE
root@LEDE:/# strace umount /MOUNT 2> /log # unmount loop partition
root@LEDE:/# losetup -a | grep ${loop}    # loop device mapping is gone
root@LEDE:/# grep -i loop /log
open("/dev/loop2p7", O_RDONLY|O_LARGEFILE) = 3
ioctl(3, LOOP_CLR_FD)                   = 0
root@LEDE:/#

The strace was done to figure out, if maybe umount wrongly ioctl()'s the
parent device instead of the partition - it doesn't.

I already wasn't a fan of umount implicitly removing the mapping in the
first place (as I usually setup and release loop devices with `losetup`
and scripts needed to call umount differently in order to work and
outside busybox).

However taking above (kernel-)behaviour into account - umount calling
ioctl(LOOP_CLR_FD) unconditionally potentially causes some nasty side
effects

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-03-16 17:51:06 +01:00
Denys Vlasenko
ab518eea9c mount: create loop devices with LO_FLAGS_AUTOCLEAR flag
The "autolooped" mount (mount [-oloop] IMAGE /DIR/DIR)
always creates AUTOCLEARed loopdevs, so that umounting
drops them (and this does not require any code in the
umount userspace).
This happens since circa linux-2.6.25:
	commit 96c5865559cee0f9cbc5173f3c949f6ce3525581
	Date:    Wed Feb 6 01:36:27 2008 -0800
	Subject: Allow auto-destruction of loop devices
IOW: in this case, umount does not have to use -d
to drop the loopdev.

The explicit loop mount (mount /dev/loopN /DIR/DIR)
does not do this. In this case, umount without -d
should not drop loopdev.
Unfortunately, bbox umount currently always implies -d,
this probably needs fixing.

function                                             old     new   delta
set_loop                                             537     597     +60
singlemount                                         1101    1138     +37
losetup_main                                         419     432     +13
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 3/0 up/down: 110/0)             Total: 110 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-03-16 16:55:47 +01:00
Denys Vlasenko
35b54a3c24 libbb: match_fstype() is unreadable in the extreme, fixing it
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-30 00:45:05 +01:00
Denys Vlasenko
205d48e948 *: add comment about APPLET_ODDNAME format
It confused me more than once

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-29 14:57:33 +01:00
Denys Vlasenko
7dd906a388 xxd: make -p output lines actually end with a newline
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-25 17:00:38 +01:00
Denys Vlasenko
62a9b18547 xxd: implement -p
While at it, tweaked hexdump --help

function                                             old     new   delta
xxd_main                                             364     414     +50
packed_usage                                       31097   31114     +17

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-25 16:50:30 +01:00
Denys Vlasenko
8a2657cbf5 hexdump/xxd: a bit more condensed formats
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-25 03:07:39 +01:00
Denys Vlasenko
0f4364775f xxd: new applet
Yet Another Hexdumper

function                                             old     new   delta
xxd_main                                               -     364    +364
packed_usage                                       31046   31116     +70
applet_names                                        2560    2564      +4
applet_main                                         1476    1480      +4
rewrite                                             1022    1013      -9
------------------------------------------------------------------------------
(add/remove: 2/0 grow/shrink: 3/1 up/down: 442/-9)            Total: 433 bytes

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-01-25 01:58:00 +01:00