linux-kernel - Re: [PATCH 2/2] kconfig: Deny command substitution in string values

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Sep 2021 18:17:40 +0200 (CEST)
From:   Richard Weinberger <richard@....at>
To:     Boris Kolpackov <boris@...esynthesis.com>
Cc:     masahiroy <masahiroy@...nel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        linux-kbuild <linux-kbuild@...r.kernel.org>
Subject: Re: [PATCH 2/2] kconfig: Deny command substitution in string values

Boris,

----- Ursprüngliche Mail -----
> Von: "Boris Kolpackov" <boris@...esynthesis.com>
> An: "richard" <richard@....at>
> CC: "masahiroy" <masahiroy@...nel.org>, "linux-kernel" <linux-kernel@...r.kernel.org>, "linux-kbuild"
> <linux-kbuild@...r.kernel.org>
> Gesendet: Mittwoch, 22. September 2021 17:18:43
> Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values

> Richard Weinberger <richard@....at> writes:
> 
>> > So effectively it's now impossible to include ` or $ in kconfig
>> > string values. Seems like a major, backwards-incompatible
>> > restriction.
>> 
>> Do you have a working example?
> 
> You mean of a project that uses kconfig and that is capable of
> handling string values with these characters? If so, then yes,
> see for example, libbuild2-kconfig[1] which is a build system
> module that implements kconfig-based configuration support for
> build2. In particular, it exposes values from .config  as
> buildfile variables but it doesn't do this by sourcing .config.
> Instead it loads .config using the kconfig API and then sets
> the corresponding buildfile variables programmatically.

I had a config setting of Linux in mind. :-)

> 
>> Since the config is sourced in the scripts/setlocalversion it will
>> not work correctly anyway.
> 
> The actual file being sources is include/config/auto.conf, not
> .config, right?
> 

Yes. auto.conf is .config post processed.
This is exactly where my mitigation takes place.
 
>> > I think if this is really desired, then it should be re-done with
>> > escaping (similar to ") rather than outright banning inconvenient
>> > characters.
>> 
>> Escaping is not so easy since the very same content is included
>> in shell scripts (sertlocalversion), in Makefiles and in C files.
> 
> Again, I don't think it's .config that gets included in C files but
> rather include/generated/autoconf.h, right?
> 

Yes. But the key/values are taken as-is.

Just add some odd characters to your .config, build the kernel and observe
the breakage at different levels.
Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-)

>> At least I didn't find find a good way to escape these characters
>> such that all three programming environments will accept it.
> 
> If my understanding is correct, then you are concerned with the
> autoconf functionality: the auto.conf makefile and autoconf.h
> header, and not the .config file itself. Perhaps it will be less
> disruptive to do the escaping (or banning) at that level?

My concern is that currently a .config file can contain hostile content
that will get executed at build time.
.config files are often blindly shared across untrusted developers.
So I thought that mitigating this whole is worth it.

> Specifically:
> 
> 1. If you do escaping at that level, then you can do it differently
>   for auto.conf and autoconf.h. Though auto.conf still seems to be
>   read by both make and shell.

I need to think about that. Thanks for the pointer.

Thanks,
//richard