linux-kernel - [PATCH] kheaders: explicitly define file modes for archived headers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240528113243.827490-2-maennich@google.com>
Date: Tue, 28 May 2024 11:32:43 +0000
From: "Matthias Männich" <maennich@...gle.com>
To: linux-kernel@...r.kernel.org
Cc: kernel-team@...roid.com, maennich@...gle.com, gprocida@...gle.com, 
	stable@...r.kernel.org, linux-kbuild@...r.kernel.org, 
	Masahiro Yamada <masahiroy@...nel.org>, Joel Fernandes <joel@...lfernandes.org>
Subject: [PATCH] kheaders: explicitly define file modes for archived headers

From: Matthias Maennich <maennich@...gle.com>

Build environments might be running with different umask settings
resulting in indeterministic file modes for the files contained in
kheaders.tar.xz. The file itself is served with 444, i.e. world
readable. Archive the files explicitly with 744,a+X to improve
reproducibility across build environments.

--mode=0444 is not suitable as directories need to be executable. Also,
444 makes it hard to delete all the readonly files after extraction.

Cc: stable@...r.kernel.org
Cc: linux-kbuild@...r.kernel.org
Cc: Masahiro Yamada <masahiroy@...nel.org>
Cc: Joel Fernandes <joel@...lfernandes.org>
Signed-off-by: Matthias Maennich <maennich@...gle.com>
---
 kernel/gen_kheaders.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
index 6d443ea22bb7..8b6e0c2bc0df 100755
--- a/kernel/gen_kheaders.sh
+++ b/kernel/gen_kheaders.sh
@@ -84,7 +84,7 @@ find $cpio_dir -type f -print0 |
 
 # Create archive and try to normalize metadata for reproducibility.
 tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
-    --owner=0 --group=0 --sort=name --numeric-owner \
+    --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \
     -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null
 
 echo $headers_md5 > kernel/kheaders.md5
-- 
2.45.1.288.g0e0cd299f1-goog