summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/busybox
diff options
context:
space:
mode:
authorNathan Rossi <nathan@nathanrossi.com>2018-01-24 22:59:28 +1000
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-01-29 08:49:49 +0000
commitb8bd1f71638e3eb61e0caef926d59d41f012bc1a (patch)
tree04da2b17cfa6b4df436da0c68b00c7e4c7d4adc1 /meta/recipes-core/busybox
parentd48c2c6f38c2705e39f6478735721999ddd50fd7 (diff)
downloadpoky-b8bd1f71638e3eb61e0caef926d59d41f012bc1a.tar.gz
busybox.inc: Add sanity check to test if the suid binary provides sh
Add a sanity check during the do_compile task to fail if the suid busybox provides /bin/sh. This is considered as a hard fail since not only is providing sh as suid problematic for security reasons but also because the sh configured for suid is less functional than the nosuid configured sh and breaks a number of required features (e.g. 64-bit test). (From OE-Core rev: b64807549569817c8f1921a0aad52c815af90731) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-core/busybox')
-rw-r--r--meta/recipes-core/busybox/busybox.inc6
1 files changed, 6 insertions, 0 deletions
diff --git a/meta/recipes-core/busybox/busybox.inc b/meta/recipes-core/busybox/busybox.inc
index 4012f921c6..157aea3968 100644
--- a/meta/recipes-core/busybox/busybox.inc
+++ b/meta/recipes-core/busybox/busybox.inc
@@ -183,6 +183,12 @@ do_compile() {
183 oe_runmake busybox.links 183 oe_runmake busybox.links
184 mv busybox.links busybox.links.$s 184 mv busybox.links busybox.links.$s
185 done 185 done
186
187 # hard fail if sh is being linked to the suid busybox (detects bug 10346)
188 if grep -q -x "/bin/sh" busybox.links.suid; then
189 bbfatal "busybox suid binary incorrectly provides /bin/sh"
190 fi
191
186 # copy .config.orig back to .config, because the install process may check this file 192 # copy .config.orig back to .config, because the install process may check this file
187 cp .config.orig .config 193 cp .config.orig .config
188 # cleanup 194 # cleanup