diff options
| author | Mathieu Arnold <mat@FreeBSD.org> | 2018-06-30 08:37:33 +0000 |
|---|---|---|
| committer | Mathieu Arnold <mat@FreeBSD.org> | 2018-06-30 08:37:33 +0000 |
| commit | 1ac9d4e91f8fba7fd6b29b6251583da0c6187e2d (patch) | |
| tree | be77b9dd3a234b46d65aeb6acca209b76593c1b6 | |
| parent | f16a2407d031adb3a3165f0234a6268ce6ca18a7 (diff) | |
| download | ports-1ac9d4e91f8fba7fd6b29b6251583da0c6187e2d.tar.gz ports-1ac9d4e91f8fba7fd6b29b6251583da0c6187e2d.zip | |
Notes
| -rw-r--r-- | Mk/Scripts/security-check.awk | 14 | ||||
| -rw-r--r-- | Mk/bsd.port.mk | 10 |
2 files changed, 14 insertions, 10 deletions
diff --git a/Mk/Scripts/security-check.awk b/Mk/Scripts/security-check.awk index 60c6ce791019..4a661bbc7f99 100644 --- a/Mk/Scripts/security-check.awk +++ b/Mk/Scripts/security-check.awk @@ -11,17 +11,17 @@ FILENAME ~ /\.flattened$/ { if ($0 ~ /(^|\/)etc\/rc\.d\//) startup_scripts[$0] = 1; } -FILENAME ~ /\.objdump$/ { - if (match($0, /: +file format [^ ]+$/)) { - file = substr($0, 1, RSTART - 1); +FILENAME ~ /\.readelf$/ { + if (match($0, /^File:/)) { + file = substr($0, 7); next; } if (file == "") next; - if ($3 ~ /^(gets|mktemp|tempnam|tmpnam)$/ || - ($3 ~ /^(strcpy|strcat|sprintf)$/ && audit != "")) - stupid_binaries[file] = stupid_binaries[file] " " $3; - if ($3 ~ /^(accept|recvfrom)$/) + if ($5 ~ /^(gets|mktemp|tempnam|tmpnam)$/ || + ($5 ~ /^(strcpy|strcat|sprintf)$/ && audit != "")) + stupid_binaries[file] = stupid_binaries[file] " " $5; + if ($5 ~ /^(accept|recvfrom)$/) network_binaries[file] = 1; } FILENAME ~ /\.setuid$/ { setuid_binaries[$0] = 1; } diff --git a/Mk/bsd.port.mk b/Mk/bsd.port.mk index 31f7edb160e3..cc2553c688e8 100644 --- a/Mk/bsd.port.mk +++ b/Mk/bsd.port.mk @@ -3589,7 +3589,11 @@ security-check: ${TMPPLIST} # 4. startup scripts, in conjunction with 2. # 5. world-writable files/dirs # - -@${RM} ${WRKDIR}/.PLIST.setuid ${WRKDIR}/.PLIST.writable ${WRKDIR}/.PLIST.objdump; \ +# The ${NONEXISTENT} argument of ${READELF} is there so that there are always +# at least two file arguments, and forces it to always output the "File: foo" +# header lines. +# + -@${RM} ${WRKDIR}/.PLIST.setuid ${WRKDIR}/.PLIST.writable ${WRKDIR}/.PLIST.readelf; \ ${AWK} -v prefix='${PREFIX}' ' \ match($$0, /^@cwd /) { prefix = substr($$0, RSTART + RLENGTH); if (prefix == "/") prefix=""; next; } \ /^@/ { next; } \ @@ -3602,10 +3606,10 @@ security-check: ${TMPPLIST} | ${XARGS} -0 -J % ${FIND} % -prune -perm -0002 \! -type l 2> /dev/null > ${WRKDIR}/.PLIST.writable; \ ${TR} '\n' '\0' < ${WRKDIR}/.PLIST.flattened \ | ${XARGS} -0 -J % ${FIND} % -prune ! -type l -type f -print0 2> /dev/null \ - | ${XARGS} -0 -n 1 ${OBJDUMP} -R 2> /dev/null > ${WRKDIR}/.PLIST.objdump; \ + | ${XARGS} -0 ${READELF} -r ${NONEXISTENT} 2> /dev/null > ${WRKDIR}/.PLIST.readelf; \ if \ ! ${AWK} -v audit="$${PORTS_AUDIT}" -f ${SCRIPTSDIR}/security-check.awk \ - ${WRKDIR}/.PLIST.flattened ${WRKDIR}/.PLIST.objdump ${WRKDIR}/.PLIST.setuid ${WRKDIR}/.PLIST.writable; \ + ${WRKDIR}/.PLIST.flattened ${WRKDIR}/.PLIST.readelf ${WRKDIR}/.PLIST.setuid ${WRKDIR}/.PLIST.writable; \ then \ www_site=$$(cd ${.CURDIR} && ${MAKE} www-site); \ if [ ! -z "$${www_site}" ]; then \ |