From fc0f570d200547d7604b3fa4b1e1a86e53b4ac37 Mon Sep 17 00:00:00 2001 From: Icarus Sparry Date: Wed, 2 Nov 2016 20:44:24 +0000 Subject: [PATCH] Add options to handle xattr at compile time. Swupd used to use a sorted blob of extended file attributes as part of the data that was used to verify the contents. This caused problems if extra attributes were added. In particular if a clearlinux system was being run in a container that had selinux enabled in the base OS. Add a configure option to allow the attributes to be considered or not. Based on advice, the default is to ignore them, as this is what everyone expects. Tidied up passing a --selinux flag to tar, this is also handled by a new config option. Signed-off-by: Icarus Sparry --- configure.ac | 30 +++++++++++++++++++++++++++--- include/swupd-build-variant.h | 11 ++++++++--- include/xattrs.h | 6 ++++-- src/xattrs.c | 8 ++++++++ 4 files changed, 47 insertions(+), 8 deletions(-) diff --git a/configure.ac b/configure.ac index d1448713..f3d8755c 100644 --- a/configure.ac +++ b/configure.ac @@ -126,8 +126,31 @@ AC_ARG_ENABLE( AS_HELP_STRING([--enable-bsdtar], [Use alternative bsdtar command (uses tar by default)]) ) AS_IF([test "x$enable_bsdtar" = "xyes" ], - [AC_DEFINE(SWUPD_WITH_BSDTAR, 1, [Use bsdtar])], - [AC_DEFINE(SWUPD_WITHOUT_BSDTAR, 1, [Use default tar])] + [AC_DEFINE(SWUPD_WITH_BSDTAR, 1, [Use bsdtar])] +) +dnl Enable extended attribute support +XATTR="yes" +AC_ARG_ENABLE( + [xattr], + AS_HELP_STRING([--enable-xattr],[Use extended file attributes (unused by default)]) +) +AS_IF([test "x$enable_xattr" = "xyes"], + [AC_DEFINE(SWUPD_WITH_XATTRS,1,[Use extended file attributes]) + AS_IF(test "x$enable_bsdtar" = "xyes", + echo "Options --enable-bsdtar and --enable-xattr are incompatible" >&2 + AS_EXIT(1))], + [XATTR=no] +) +TARSELINUX="yes" +AC_ARG_ENABLE([tar-selinux], + AS_HELP_STRING([--enable-tar-selinux],[give --selinux option to tar]) +) +AS_IF([test "x$enable_tar_selinux" = "xyes"], + [AC_DEFINE(SWUPD_TAR_SELINUX,1,[give --selinux option to tar]) + AS_IF(test "x$enable_xattr" = "xyes",, + echo "Must have --enable-xattr to have --enable-tar-selinux" >&2 + AS_EXIT(1))], + [TARSELINUX=no] ) AC_ARG_WITH([systemdsystemunitdir], AS_HELP_STRING([--with-systemdsystemunitdir=DIR], @@ -165,7 +188,6 @@ certs_path="/usr/share/clear/update-ca" AH_TEMPLATE([SWUPD_LINUX_ROOTFS],[Enable Linux rootfs build variant]) ## (2) variant features AH_TEMPLATE([SWUPD_WITH_BINDMNTS],[cope with bind mounts over rootfs]) -AH_TEMPLATE([SWUPD_WITH_SELINUX],[handle selinux attributes]) ## (3) variant extra options AH_TEMPLATE([MOUNT_POINT],[The mount point]) AH_TEMPLATE([STATE_DIR],[The state directory for swupd content]) @@ -209,4 +231,6 @@ Configuration to build swupd-client: SSL Certificate file: ${SWUPDCERT} Use bzip compression: ${BZIP} Run Tests: ${TESTS} + Use extended file attributes ${XATTR} + Use --selinux option for tar ${TARSELINUX} ]) diff --git a/include/swupd-build-variant.h b/include/swupd-build-variant.h index c915730c..0e6a9031 100644 --- a/include/swupd-build-variant.h +++ b/include/swupd-build-variant.h @@ -13,13 +13,18 @@ #define TAR_XATTR_ARGS "" #else #define TAR_COMMAND "tar" +/* configure.ac ensures a sensible configuration of bsdtar/selinux/xattr */ +#ifdef SWUPD_TAR_SELINUX +#define TAR_XATTR_ARGS "--xattrs --xattrs-include='*' --selinux" +#else #define TAR_XATTR_ARGS "--xattrs --xattrs-include='*'" #endif +#endif -#ifdef SWUPD_WITH_SELINUX -#define TAR_PERM_ATTR_ARGS "--preserve-permissions --selinux " TAR_XATTR_ARGS -#else /* SWUPD_WITHOUT_SELINUX */ +#ifdef SWUPD_WITH_XATTRS #define TAR_PERM_ATTR_ARGS "--preserve-permissions " TAR_XATTR_ARGS +#else /* SWUPD_WITHOUT_XATTRS */ +#define TAR_PERM_ATTR_ARGS "--preserve-permissions " #endif #endif diff --git a/include/xattrs.h b/include/xattrs.h index 6402a28e..502ab221 100644 --- a/include/xattrs.h +++ b/include/xattrs.h @@ -16,8 +16,10 @@ void xattrs_copy(const char *src_filename, const char *dst_filename); /* * Attempt to pack into a data blob the extended attributes of the given file. - * The data blob will be allocated and possibly filled with first the list - * of all the extended attributes names, and then their values. + * The data blob will be allocated and possibly filled with first the sorted + * list of all the extended attributes names, and then their values. + * The values will be NUL terminated, but the encoding is not reversable so + * is only suitable to use as input to a hashing function. * @param filename - The file from which the extended attributes will be * read and packed into the data blob. * @param blob - The data blob pointer into which the extended attributes will diff --git a/src/xattrs.c b/src/xattrs.c index d1968781..6e9f8e32 100644 --- a/src/xattrs.c +++ b/src/xattrs.c @@ -37,6 +37,14 @@ enum xattrs_action_type_t_ { typedef enum xattrs_action_type_t_ xattrs_action_type_t; +/* If SWUPD_WITH_XATTRS is not defined, create functions to override + * glibc's interface to the system calls + */ +#ifndef SWUPD_WITH_XATTRS +#define lgetxattr(p,n,b,l) (-1) +#define llistxattr(p,b,l) (0) +#endif + static int xattr_get_value(const char *path, const char *name, char **blob, size_t *blob_len, xattrs_action_type_t action) {