linux-kernel - Re: [PATCH linux-next] scripts/extract_xc3028: use absolute path for which

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 22 Sep 2022 12:05:19 +0100
From:   Conor Dooley <conor.dooley@...rochip.com>
To:     <cgel.zte@...il.com>
CC:     <linux-kernel@...r.kernel.org>, Xu Panda <xu.panda@....com.cn>,
        Zeal Robot <zealci@....com.cn>, <gregkh@...uxfoundation.org>
Subject: Re: [PATCH linux-next] scripts/extract_xc3028: use absolute path for
 which

On Thu, Sep 22, 2022 at 10:26:25AM +0000, cgel.zte@...il.com wrote:
> From: Xu Panda <xu.panda@....com.cn>

Hey Xu Panda,
I accidentally found this patch while looking for your RISC-V one on
lore.

You've not CC'ed any maintainers so I am not sure who you expect to pick
this patch up, but seeing as Greg has NACKed the patch you sent to the
RISC-V list [0] earlier doing the same thing I figure it is a moot
point... maybe engaging with maintainers rather than sending more
patches would be a more successful strategy for you here :(

Either way, you'll likely have to resend this with a maintainer CCed for
someone to be able to apply your patch once you've resolved the email
issues.

Thanks,
Conor.

0 - https://lore.kernel.org/all/Yyw24J7YFVtxsnJ7@kroah.com/
> 
> Not using absolute path when invoking which can lead to serious security
> issues.
> 
> Reported-by: Zeal Robot <zealci@....com.cn>
> Signed-off-by: Xu Panda <xu.panda@....com.cn>
> ---
>  scripts/extract_xc3028.pl | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/scripts/extract_xc3028.pl b/scripts/extract_xc3028.pl
> index e1c9af25a595..c9ddcba07550 100755
> --- a/scripts/extract_xc3028.pl
> +++ b/scripts/extract_xc3028.pl
> @@ -29,7 +29,7 @@ sub verify ($$)
>         my ($filename, $hash) = @_;
>         my ($testhash);
> 
> -       if (system("which md5sum > /dev/null 2>&1")) {
> +       if (system("/usr/bin/which md5sum > /dev/null 2>&1")) {
>                 die "This firmware requires the md5sum command - see http://www.gnu.org/software/coreutils/\n";
>         }
> 
> -- 
> 2.15.2
>