linux-kernel - Re: [PATCH 2/2] kconfig: Deny command substitution in string values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Sep 2021 17:18:43 +0200
From:   Boris Kolpackov <boris@...esynthesis.com>
To:     Richard Weinberger <richard@....at>
Cc:     masahiroy@...nel.org, linux-kernel <linux-kernel@...r.kernel.org>,
        linux-kbuild@...r.kernel.org
Subject: Re: [PATCH 2/2] kconfig: Deny command substitution in string values

Richard Weinberger <richard@....at> writes:

> > So effectively it's now impossible to include ` or $ in kconfig
> > string values. Seems like a major, backwards-incompatible
> > restriction.
> 
> Do you have a working example?

You mean of a project that uses kconfig and that is capable of
handling string values with these characters? If so, then yes,
see for example, libbuild2-kconfig[1] which is a build system
module that implements kconfig-based configuration support for
build2. In particular, it exposes values from .config  as
buildfile variables but it doesn't do this by sourcing .config.
Instead it loads .config using the kconfig API and then sets
the corresponding buildfile variables programmatically.

> Since the config is sourced in the scripts/setlocalversion it will
> not work correctly anyway.

The actual file being sources is include/config/auto.conf, not
.config, right?

> > I think if this is really desired, then it should be re-done with
> > escaping (similar to ") rather than outright banning inconvenient
> > characters.
> 
> Escaping is not so easy since the very same content is included
> in shell scripts (sertlocalversion), in Makefiles and in C files.

Again, I don't think it's .config that gets included in C files but 
rather include/generated/autoconf.h, right?

> At least I didn't find find a good way to escape these characters
> such that all three programming environments will accept it.

If my understanding is correct, then you are concerned with the
autoconf functionality: the auto.conf makefile and autoconf.h
header, and not the .config file itself. Perhaps it will be less
disruptive to do the escaping (or banning) at that level?

Specifically:

1. If you do escaping at that level, then you can do it differently
   for auto.conf and autoconf.h. Though auto.conf still seems to be
   read by both make and shell.

2. Alternatively, you can detect and ban the inconvenient characters
   when generating these files (I personally don't care for autoconf
   and have it disabled).

[1] https://github.com/build2/libbuild2-kconfig