import from CS git bcc-0.25.0-9.el8
This commit is contained in:
parent
d3e9eabd27
commit
b176d06fad
1
.bcc.metadata
Normal file
1
.bcc.metadata
Normal file
@ -0,0 +1 @@
|
||||
059187f62e915eb74ea7b18e19fcb185f9d18255 SOURCES/bcc-0.25.0.tar.gz
|
||||
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
SOURCES/bcc-0.25.0.tar.gz
|
||||
SOURCES/bcc-0.25.0.tar.gz
|
||||
@ -0,0 +1,33 @@
|
||||
From 509b05f2790fd1f9e725e353521a5a555ca57aaf Mon Sep 17 00:00:00 2001
|
||||
From: Chunsheng Luo <48231204+luochenglcs@users.noreply.github.com>
|
||||
Date: Mon, 18 Mar 2024 00:09:21 +0800
|
||||
Subject: [PATCH] clang: Fix file_exists_and_ownedby return value (#4935)
|
||||
|
||||
commit 008ea09 (clang: check header ownership) updates file_exists()
|
||||
to file_exists_and_ownedby(), add verifies onwer, but the return value
|
||||
is different from before, causing problems with the original code.
|
||||
|
||||
Signed-off-by: Chunsheng Luo <luochunsheng@ustc.edu>
|
||||
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
|
||||
---
|
||||
src/cc/frontends/clang/kbuild_helper.cc | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
|
||||
index 1b291469..0387f872 100644
|
||||
--- a/src/cc/frontends/clang/kbuild_helper.cc
|
||||
+++ b/src/cc/frontends/clang/kbuild_helper.cc
|
||||
@@ -143,8 +143,8 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
|
||||
static inline int file_exists_and_ownedby(const char *f, uid_t uid)
|
||||
{
|
||||
struct stat buffer;
|
||||
- int ret;
|
||||
- if ((ret = stat(f, &buffer)) == 0) {
|
||||
+ int ret = stat(f, &buffer) == 0;
|
||||
+ if (ret) {
|
||||
if (buffer.st_uid != uid) {
|
||||
std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
|
||||
return -1;
|
||||
--
|
||||
2.44.0
|
||||
|
||||
68
SOURCES/bcc-0.25.0-clang-check-header-ownership-4928.patch
Normal file
68
SOURCES/bcc-0.25.0-clang-check-header-ownership-4928.patch
Normal file
@ -0,0 +1,68 @@
|
||||
From d6a5130c5f18499da26eef88f52da75c9e33d63d Mon Sep 17 00:00:00 2001
|
||||
From: Brendan Gregg <brendan@intel.com>
|
||||
Date: Thu, 7 Mar 2024 05:27:14 +1100
|
||||
Subject: [PATCH] clang: check header ownership (#4928)
|
||||
|
||||
Example testing with a brendan-owned /tmp/kheaders file (note the "ERROR:" message):
|
||||
|
||||
~/bcc/build$ sudo /usr/share/bcc/tools/biosnoop
|
||||
ERROR: header file ownership unexpected: /tmp/kheaders-5.15.47-internal
|
||||
<built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found
|
||||
#include "./include/linux/kconfig.h"
|
||||
^~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
1 error generated.
|
||||
Traceback (most recent call last):
|
||||
File "/usr/share/bcc/tools/biosnoop", line 335, in <module>
|
||||
b = BPF(text=bpf_text)
|
||||
File "/usr/lib/python3/dist-packages/bcc-0.1.5+6cd27218-py3.10.egg/bcc/__init__.py", line 479, in __init__
|
||||
Exception: Failed to compile BPF module <text>
|
||||
~/bcc/build$ ls -lhd /tmp/kheaders-5.15.47-internal
|
||||
drwxrwxr-x 2 brendan dev 4.0K Mar 6 02:50 /tmp/kheaders-5.15.47-internal
|
||||
|
||||
No error when chown'd back to root.
|
||||
---
|
||||
src/cc/frontends/clang/kbuild_helper.cc | 15 +++++++++++----
|
||||
1 file changed, 11 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
|
||||
index 933aec8e..1b291469 100644
|
||||
--- a/src/cc/frontends/clang/kbuild_helper.cc
|
||||
+++ b/src/cc/frontends/clang/kbuild_helper.cc
|
||||
@@ -140,15 +140,22 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
-static inline int file_exists(const char *f)
|
||||
+static inline int file_exists_and_ownedby(const char *f, uid_t uid)
|
||||
{
|
||||
struct stat buffer;
|
||||
- return (stat(f, &buffer) == 0);
|
||||
+ int ret;
|
||||
+ if ((ret = stat(f, &buffer)) == 0) {
|
||||
+ if (buffer.st_uid != uid) {
|
||||
+ std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
|
||||
+ return -1;
|
||||
+ }
|
||||
+ }
|
||||
+ return ret;
|
||||
}
|
||||
|
||||
static inline int proc_kheaders_exists(void)
|
||||
{
|
||||
- return file_exists(PROC_KHEADERS_PATH);
|
||||
+ return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
|
||||
}
|
||||
|
||||
static inline int extract_kheaders(const std::string &dirpath,
|
||||
@@ -214,7 +221,7 @@ int get_proc_kheaders(std::string &dirpath)
|
||||
snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
|
||||
dirpath = std::string(dirpath_tmp);
|
||||
|
||||
- if (file_exists(dirpath_tmp))
|
||||
+ if (file_exists_and_ownedby(dirpath_tmp, 0))
|
||||
return 0;
|
||||
|
||||
// First time so extract it
|
||||
--
|
||||
2.43.2
|
||||
|
||||
@ -0,0 +1,76 @@
|
||||
From 1d504ac46d2a0210813147b6a57d657b6c2a5d2e Mon Sep 17 00:00:00 2001
|
||||
From: Jerome Marchand <jmarchan@redhat.com>
|
||||
Date: Fri, 17 May 2024 15:36:07 +0200
|
||||
Subject: [PATCH] clang: fail when the kheaders ownership is wrong (#4928)
|
||||
(#4985)
|
||||
|
||||
file_exists_and_ownedby() returns -1 when the file exists but its
|
||||
ownership is unexpected, which is very misleading since anything non
|
||||
zero is interpreted as true and a function with such a name is
|
||||
expected to return a boolean. So currently all this does, is write a
|
||||
warning message, and continues as if nothing is wrong.
|
||||
|
||||
Make file_exists_and_ownedby() returns false when the ownership is
|
||||
wrong and have get_proc_kheaders() fails when this happen. Also have
|
||||
all the *exists* functions return bool to avoid such issues in the
|
||||
future.
|
||||
|
||||
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
|
||||
---
|
||||
src/cc/frontends/clang/kbuild_helper.cc | 22 +++++++++++++++++-----
|
||||
1 file changed, 17 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
|
||||
index 0387f872..9dd3c3c8 100644
|
||||
--- a/src/cc/frontends/clang/kbuild_helper.cc
|
||||
+++ b/src/cc/frontends/clang/kbuild_helper.cc
|
||||
@@ -140,20 +140,26 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
-static inline int file_exists_and_ownedby(const char *f, uid_t uid)
|
||||
+static inline bool file_exists(const char *f)
|
||||
+{
|
||||
+ struct stat buffer;
|
||||
+ return (stat(f, &buffer) == 0);
|
||||
+}
|
||||
+
|
||||
+static inline bool file_exists_and_ownedby(const char *f, uid_t uid)
|
||||
{
|
||||
struct stat buffer;
|
||||
int ret = stat(f, &buffer) == 0;
|
||||
if (ret) {
|
||||
if (buffer.st_uid != uid) {
|
||||
std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
|
||||
- return -1;
|
||||
+ return false;
|
||||
}
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
-static inline int proc_kheaders_exists(void)
|
||||
+static inline bool proc_kheaders_exists(void)
|
||||
{
|
||||
return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
|
||||
}
|
||||
@@ -221,8 +227,14 @@ int get_proc_kheaders(std::string &dirpath)
|
||||
snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
|
||||
dirpath = std::string(dirpath_tmp);
|
||||
|
||||
- if (file_exists_and_ownedby(dirpath_tmp, 0))
|
||||
- return 0;
|
||||
+ if (file_exists(dirpath_tmp)) {
|
||||
+ if (file_exists_and_ownedby(dirpath_tmp, 0))
|
||||
+ return 0;
|
||||
+ else
|
||||
+ // The path exists, but is owned by a non-root user
|
||||
+ // Something fishy is going on
|
||||
+ return -EEXIST;
|
||||
+ }
|
||||
|
||||
// First time so extract it
|
||||
return extract_kheaders(dirpath, uname_data);
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -9,7 +9,7 @@
|
||||
|
||||
Name: bcc
|
||||
Version: 0.25.0
|
||||
Release: 7%{?dist}
|
||||
Release: 9%{?dist}
|
||||
Summary: BPF Compiler Collection (BCC)
|
||||
License: ASL 2.0
|
||||
URL: https://github.com/iovisor/bcc
|
||||
@ -29,7 +29,9 @@ Patch11: %{name}-%{version}-Fix-a-llvm-compilation-error.patch
|
||||
Patch12: %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch
|
||||
Patch13: %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch
|
||||
Patch14: %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch
|
||||
|
||||
Patch15: %{name}-%{version}-clang-check-header-ownership-4928.patch
|
||||
Patch16: %{name}-%{version}-clang-Fix-file_exists_and_ownedby-return-value-4935.patch
|
||||
Patch17: %{name}-%{version}-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch
|
||||
|
||||
# Arches will be included as upstream support is added and dependencies are
|
||||
# satisfied in the respective arches
|
||||
@ -227,6 +229,12 @@ done
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue May 28 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-9
|
||||
- Really prevent the loading of compromised headers (RHEL-28768, CVE-2024-2314)
|
||||
|
||||
* Tue Mar 12 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-8
|
||||
- Check header ownership (RHEL-28768)
|
||||
|
||||
* Wed Nov 08 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-7
|
||||
- Fix repo URL in tests.yml
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user