Skip to contentSkip to conversation

busybox: remove the postinst part of the recipe

PATCH Superseded [email protected] 3 participants 16 messages Jun 7, 2013 – Jun 17, 2013 1 message not in the archive

Subsystems (2)
Kbuild Kconfig

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

[email protected]

author
#1 lore raw

PATCH 1/8 busybox: remove the postinst part of the recipe

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Signed-off-by Chen Qi <[email protected]>
---
 meta/recipes-core/busybox/busybox.inc |    8 --------
 1 file changed, 8 deletions(-)
meta/recipes-core/busybox/busybox.inc +0 -8
index c8908b0..f4efeb8 100644
@@ -265,14 +265,6 @@ python do_package_prepend () {
     f.close()
 }
 
-pkg_postinst_${PN} () {
-	# If we are not making an image we create links for the utilities that doesn't exist
-	# so the update-alternatives script will get the utilities it needs
-	# (update-alternatives have no problem replacing links later anyway)
-	test -n 2> /dev/null || alias test='busybox test'
-	if test "x$D" = "x"; then while read link; do if test ! -h "$link"; then case "$link" in /*/*/*) to="../../bin/busybox";; /bin/*) to="busybox";; /*/*) to="../bin/busybox";; esac; busybox ln -s $to $link; fi; done </etc/busybox.links; fi
-}
-
 pkg_prerm_${PN} () {
 	# This is so you can make busybox commit suicide - removing busybox with no other packages
 	# providing its files, this will make update-alternatives work, but the update-rc.d part
Signature · 1 line
1.7.9.5
#2 lore raw
Quoted 8 lines · On Fri, Jun 7, 2013 at 3:13 AM, <[email protected]> wrote:

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Signed-off-by Chen Qi <[email protected]>

Instead of removing it, please convert it here for update-alternatives so it keeps working on this commit and allow bisect in future if need.

Signature · 3 lines
Otavio Salvador                             O.S. Systems
http://www.ossystems.com.br        http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854            Mobile: +1 (347) 903-9750
author
#3 lore raw
Quoted 11 lines · Otavio Salvador

On Fri, Jun 7, 2013 at 3:13 AM, <[email protected] <mailto:[email protected]>> wrote:

From: Chen Qi <[email protected] <mailto:[email protected]>>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Quoted 6 lines
Signed-off-by Chen Qi <[email protected]

<mailto:[email protected]>>

Instead of removing it, please convert it here for update-alternatives so it keeps working on this commit and allow bisect in future if need.

Hi Otavio,

Thanks for your review and comments.
Sorry but I don't understand it :(
What do you mean by "convert it for update-alternatives"? Could you please give me a little more explanation?

Best Regards,
Chen Qi

Quoted 4 lines
Signature · 3 lines
Otavio Salvador                             O.S. Systems
http://www.ossystems.com.br http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854            Mobile: +1 (347) 903-9750
#4 lore raw
Quoted 19 lines · ChenQi

On 06/07/2013 08:32 PM, Otavio Salvador wrote:

Quoted 8 lines · On Fri, Jun 7, 2013 at 3:13 AM, <[email protected]> wrote:

From: Chen Qi <[email protected]>

Remove the pkg_postinst_${PN} from this recipe, as it's redundant. It basically wants to do the same thing as the update-alternatives does. But it doesn't do it well.

Signed-off-by Chen Qi <[email protected]>

Instead of removing it, please convert it here for update-alternatives
so it keeps working on this commit and allow bisect in future if need.

Quoted 7 lines

Hi Otavio,

Thanks for your review and comments.
Sorry but I don't understand it :(
What do you mean by "convert it for update-alternatives"? Could you please give me a little more explanation?

Yes, add the update-alternatives support here as well so we can remove the postinst and add the new code in same patch; it allows for bisect :)

Signature · 3 lines
Otavio Salvador                             O.S. Systems
http://www.ossystems.com.br        http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854            Mobile: +1 (347) 903-9750
author
#5 lore raw

PATCH 2/8 busybox: add support for CONFIG_FEATURE_INDIVIDUAL

In reply to a message not in the archive

From: Chen Qi <[email protected]>

Previously, if CONFIG_FEATURE_INDIVIDUAL was enabled for busybox, yocto-based systems could start correctly.

This is because if busybox is built as individual apps, '/bin/busybox' may not be present, so setting the default ALTERNATIVE_TARGET to '/bin/busybox' is not appropriate and could lead to errors.

This patch fixes this problem by checking the existence of '/bin/busybox' before setting the ALTERNATIVE_TARGET to '/bin/busybox'.

After this change, if busybox is built as individual apps, we'll have links like '/bin/ls -> /bin/ls.busybox', otherwise, we'll have links like '/bin/ls -> /bin/busybox'.

Note there's a grep expression change in this patch. The old expression doesn't work well, it has an unwanted underscore, so I changed it to make it work.

[YOCTO #4570]

Signed-off-by Chen Qi <[email protected]>
---
 meta/recipes-core/busybox/busybox.inc |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)
meta/recipes-core/busybox/busybox.inc +4 -3
index f4efeb8..99d4e99 100644
@@ -171,7 +171,7 @@ do_install () {
 			install -m 0755 "0_lib/$NAME" "${D}$FILE.${BPN}"
 		done
 		# add suid bit where needed
-		for i in `grep -E "APPLET.*_BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP | cut -f 3 -d '(' | cut -f 1 -d ','`; do
+		for i in `grep -E "APPLET.*BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP | cut -f 3 -d '(' | cut -f 1 -d ','`; do
 			find ${D} -name $i.${BPN} -exec chmod a+s {} \;
 		done
 		install -m 0755 0_lib/libbusybox.so.${PV} ${D}${libdir}/libbusybox.so.${PV}

@@ -242,8 +242,6 @@ ALTERNATIVE_TARGET[syslog-init] = "${sysconfdir}/init.d/syslog.${BPN}"
 ALTERNATIVE_LINK_NAME[syslog-startup-conf] = "${sysconfdir}/syslog-startup.conf"
 ALTERNATIVE_TARGET[syslog-startup-conf] = "${sysconfdir}/syslog-startup.conf.${BPN}"
 
-ALTERNATIVE_TARGET = "/bin/busybox"
-
 python do_package_prepend () {
     # We need to load the full set of busybox provides from the /etc/busybox.links
     # Use this to see the update-alternatives with the right information

@@ -252,6 +250,9 @@ python do_package_prepend () {
     pn = d.getVar('PN', True)
     f = open('%s/etc/busybox.links' % (dvar), 'r')
 
+    if os.path.exists('%s/bin/busybox' % (dvar)):
+        d.setVar('ALTERNATIVE_TARGET', "/bin/busybox")
+
     for alt_link_name in f:
         alt_link_name = alt_link_name.strip()
         alt_name = os.path.basename(alt_link_name)
Signature · 1 line
1.7.9.5
#6 lore raw

Re: [PATCH 2/8] busybox: add support for CONFIG_FEATURE_INDIVIDUAL

Quoted 16 lines · On Fri, Jun 7, 2013 at 3:13 AM, <[email protected]> wrote:

From: Chen Qi <[email protected]>

Previously, if CONFIG_FEATURE_INDIVIDUAL was enabled for busybox, yocto-based systems could start correctly.

This is because if busybox is built as individual apps, '/bin/busybox' may not be present, so setting the default ALTERNATIVE_TARGET to '/bin/busybox' is not appropriate and could lead to errors.

This patch fixes this problem by checking the existence of '/bin/busybox' before setting the ALTERNATIVE_TARGET to '/bin/busybox'.

After this change, if busybox is built as individual apps, we'll have links like '/bin/ls -> /bin/ls.busybox', otherwise, we'll have links like '/bin/ls -> /bin/busybox'.

Quoted 8 lines

Note there's a grep expression change in this patch. The old expression doesn't work well, it has an unwanted underscore, so I changed it to make it work.

[YOCTO #4570]

Signed-off-by Chen Qi <[email protected]>

Please rework 1/8 and reduce the changes here. This will be easier to test and review this way.

Signature · 3 lines
Otavio Salvador                             O.S. Systems
http://www.ossystems.com.br        http://projetos.ossystems.com.br
Mobile: +55 (53) 9981-7854            Mobile: +1 (347) 903-9750
author
#7 lore raw

PATCH 3/8 busybox: add a config fragment to enable login utilities

In reply to a message not in the archive

From: Chen Qi <[email protected]>

Create a config fragment to enable the login/passwd utilities of busybox.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>
---
 .../busybox/busybox-1.20.2/login-utilities.cfg     |   13 +++++++++++++
 meta/recipes-core/busybox/busybox_1.20.2.bb        |    3 ++-
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/login-utilities.cfg
meta/recipes-core/busybox/busybox-1.20.2/login-utilities.cfg new file +13 -0
new file mode 100644
index 0000000..cc9b2db
@@ -0,0 +1,13 @@
+CONFIG_FEATURE_SHADOWPASSWDS=y
+CONFIG_ADDUSER=y
+CONFIG_FEATURE_ADDUSER_LONG_OPTIONS=y
+CONFIG_ADDGROUP=y
+CONFIG_FEATURE_ADDGROUP_LONG_OPTIONS=y
+CONFIG_DELUSER=y
+CONFIG_DELGROUP=y
+CONFIG_GETTY=y
+CONFIG_LOGIN=y
+CONFIG_PASSWD=y
+CONFIG_SU=y
+CONFIG_SULOGIN=y
+CONFIG_VLOCK=y
meta/recipes-core/busybox/busybox_1.20.2.bb +2 -1
index 07d722d..3ff8a88 100644
@@ -35,7 +35,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://fail_on_no_media.patch \
            file://busybox-sulogin-empty-root-password.patch \
            file://inetd.conf \
-           file://inetd"
+           file://inetd \
+           file://login-utilities.cfg"
 
 SRC_URI[tarball.md5sum] = "e025414bc6cd79579cc7a32a45d3ae1c"
 SRC_URI[tarball.sha256sum] = "eb13ff01dae5618ead2ef6f92ba879e9e0390f9583bd545d8789d27cf39b6882"
Signature · 1 line
1.7.9.5
author
#8 lore raw

PATCH 4/8 busybox: add the ability to split the busybox binary

In reply to a message not in the archive

From: Chen Qi <[email protected]>

This patch enables us to split the busybox into two binaries, one containing suid applications, and the other containing nosuid apps.

Add a variable, BUSYBOX_SPLIT_SUID, to control whether to split the busybox binary into two parts. We default it to "1" to enable the splitting, but users could still override it to disable the splitting. After all, busybox has no internal support for this suid apps splitting, so there might be users out there who want just one busybox binary.

Add a configuration file, suid_config_list, to control which applications should be splitted into the suid binary. The list is first obtained from the information in include/applets.h. Some extra config items are also added to the list as they are related to the suid apps. I choose to use a configuration file here because if some config item is missed, we could add it to the list easily.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>
---
 .../busybox/busybox-1.20.2/suid_config_list        |   48 +++++++++
 meta/recipes-core/busybox/busybox.inc              |  104 +++++++++++++++-----
 meta/recipes-core/busybox/busybox_1.20.2.bb        |    3 +-
 3 files changed, 127 insertions(+), 28 deletions(-)
 create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/suid_config_list
meta/recipes-core/busybox/busybox-1.20.2/suid_config_list new file +48 -0
new file mode 100644
index 0000000..16a0b76
@@ -0,0 +1,48 @@
+# This file lists all config items which are related to suid apps in busybox.
+# The following list is obtained with the command below (splitted into two lines for readability).
+# for i in `grep -E "APPLET.*BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP |
+# cut -f 3 -d '(' | cut -f 1 -d ','`; do grep -i -E "config_(feature_|)$i(_| )" .config; done | cut -d' ' -f2
+CONFIG_PING
+CONFIG_PING6
+CONFIG_CRONTAB
+CONFIG_FINDFS
+CONFIG_LOGIN
+CONFIG_LOGIN_SESSION_AS_CHILD
+CONFIG_LOGIN_SCRIPTS
+CONFIG_MOUNT
+CONFIG_FEATURE_MOUNT_FAKE
+CONFIG_FEATURE_MOUNT_VERBOSE
+CONFIG_FEATURE_MOUNT_HELPERS
+CONFIG_FEATURE_MOUNT_LABEL
+CONFIG_FEATURE_MOUNT_NFS
+CONFIG_FEATURE_MOUNT_CIFS
+CONFIG_FEATURE_MOUNT_FLAGS
+CONFIG_FEATURE_MOUNT_FSTAB
+CONFIG_FEATURE_MOUNT_LOOP
+CONFIG_FEATURE_MOUNT_LOOP_CREATE
+CONFIG_PASSWD
+CONFIG_FEATURE_PASSWD_WEAK_CHECK
+CONFIG_SU
+CONFIG_FEATURE_SU_SYSLOG
+CONFIG_FEATURE_SU_CHECKS_SHELLS
+CONFIG_TRACEROUTE
+CONFIG_FEATURE_TRACEROUTE_VERBOSE
+CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE
+CONFIG_FEATURE_TRACEROUTE_USE_ICMP
+CONFIG_TRACEROUTE6
+CONFIG_VLOCK
+CONFIG_WALL
+
+# The following list is obtained by examining the Config.in file in busybox manually.
+# These config items are also related to suid apps.
+CONFIG_FEATURE_FANCY_PING
+CONFIG_FEATURE_SHADOWPASSWDS
+CONFIG_USE_BB_PWD_GRP
+CONFIG_USE_BB_SHADOW
+CONFIG_USE_BB_CRYPT
+CONFIG_USE_BB_CRYPT_SHA
+CONFIG_PAM
+CONFIG_FEATURE_NOLOGIN
+CONFIG_FEATURE_SECURETTY
+CONFIG_CRYPTPW
+CONFIG_CHPASSWD
meta/recipes-core/busybox/busybox.inc +77 -27

149 lines not on this page · raw message

meta/recipes-core/busybox/busybox_1.20.2.bb +2 -1
index 3ff8a88..511f1f8 100644
@@ -36,7 +36,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://busybox-sulogin-empty-root-password.patch \
            file://inetd.conf \
            file://inetd \
-           file://login-utilities.cfg"
+           file://login-utilities.cfg \
+           file://suid_config_list"
 
 SRC_URI[tarball.md5sum] = "e025414bc6cd79579cc7a32a45d3ae1c"
 SRC_URI[tarball.sha256sum] = "eb13ff01dae5618ead2ef6f92ba879e9e0390f9583bd545d8789d27cf39b6882"
Signature · 1 line
1.7.9.5
#9 lore raw

Re: [PATCH 4/8] busybox: add the ability to split the busybox binary

Quoted 97 lines · On Fri, Jun 07, 2013 at 02:13:58PM +0800, [email protected] wrote:

From: Chen Qi <[email protected]>

This patch enables us to split the busybox into two binaries, one containing suid applications, and the other containing nosuid apps.

Add a variable, BUSYBOX_SPLIT_SUID, to control whether to split the busybox binary into two parts. We default it to "1" to enable the splitting, but users could still override it to disable the splitting. After all, busybox has no internal support for this suid apps splitting, so there might be users out there who want just one busybox binary.

Add a configuration file, suid_config_list, to control which applications should be splitted into the suid binary. The list is first obtained from the information in include/applets.h. Some extra config items are also added to the list as they are related to the suid apps. I choose to use a configuration file here because if some config item is missed, we could add it to the list easily.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>

---

.../busybox/busybox-1.20.2/suid_config_list        |   48 +++++++++
meta/recipes-core/busybox/busybox.inc              |  104 +++++++++++++++-----
meta/recipes-core/busybox/busybox_1.20.2.bb        |    3 +-
3 files changed, 127 insertions(+), 28 deletions(-)

create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/suid_config_list

meta/recipes-core/busybox/busybox-1.20.2/suid_config_list new file +48 -0
new file mode 100644
index 0000000..16a0b76
@@ -0,0 +1,48 @@
+# This file lists all config items which are related to suid apps in busybox.
+# The following list is obtained with the command below (splitted into two lines for readability).
+# for i in `grep -E "APPLET.*BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP |
+# cut -f 3 -d '(' | cut -f 1 -d ','`; do grep -i -E "config_(feature_|)$i(_| )" .config; done | cut -d' ' -f2
+CONFIG_PING
+CONFIG_PING6
+CONFIG_CRONTAB
+CONFIG_FINDFS
+CONFIG_LOGIN
+CONFIG_LOGIN_SESSION_AS_CHILD
+CONFIG_LOGIN_SCRIPTS
+CONFIG_MOUNT
+CONFIG_FEATURE_MOUNT_FAKE
+CONFIG_FEATURE_MOUNT_VERBOSE
+CONFIG_FEATURE_MOUNT_HELPERS
+CONFIG_FEATURE_MOUNT_LABEL
+CONFIG_FEATURE_MOUNT_NFS
+CONFIG_FEATURE_MOUNT_CIFS
+CONFIG_FEATURE_MOUNT_FLAGS
+CONFIG_FEATURE_MOUNT_FSTAB
+CONFIG_FEATURE_MOUNT_LOOP
+CONFIG_FEATURE_MOUNT_LOOP_CREATE
+CONFIG_PASSWD
+CONFIG_FEATURE_PASSWD_WEAK_CHECK
+CONFIG_SU
+CONFIG_FEATURE_SU_SYSLOG
+CONFIG_FEATURE_SU_CHECKS_SHELLS
+CONFIG_TRACEROUTE
+CONFIG_FEATURE_TRACEROUTE_VERBOSE
+CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE
+CONFIG_FEATURE_TRACEROUTE_USE_ICMP
+CONFIG_TRACEROUTE6
+CONFIG_VLOCK
+CONFIG_WALL
+
+# The following list is obtained by examining the Config.in file in busybox manually.
+# These config items are also related to suid apps.
+CONFIG_FEATURE_FANCY_PING
+CONFIG_FEATURE_SHADOWPASSWDS
+CONFIG_USE_BB_PWD_GRP
+CONFIG_USE_BB_SHADOW
+CONFIG_USE_BB_CRYPT
+CONFIG_USE_BB_CRYPT_SHA
+CONFIG_PAM
+CONFIG_FEATURE_NOLOGIN
+CONFIG_FEATURE_SECURETTY
+CONFIG_CRYPTPW
+CONFIG_CHPASSWD
meta/recipes-core/busybox/busybox.inc +0 -0
index 99d4e99..9984c5a 100644
@@ -12,6 +12,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=de10de48642ab74318e893a61105afbb"

SECTION = "base"

meta/recipes-core/busybox/busybox.inc +3 -0
+# Whether to split the suid apps into a seperate binary
+BUSYBOX_SPLIT_SUID ?= "1"
+

export EXTRA_CFLAGS = "${CFLAGS}"
export EXTRA_LDFLAGS = "${LDFLAGS}"

meta/recipes-core/busybox/busybox.inc do_configure () { · line 143

Quoted 7 lines
meta/recipes-core/busybox/busybox.inc +2 -2
@@ -136,19 +139,52 @@ do_configure () {
 
 do_compile() {
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-	oe_runmake busybox_unstripped
-	cp busybox_unstripped busybox
+	if [ "${BUSYBOX_SPLIT_SUID}" = "1" -a x`grep "CONFIG_FEATURE_INDIVIDUAL=y" .config` = x ]; then
+	# split the .config into two parts, and make two busybox binaries

cat .config > .config-oe-full

# it would be nice to 'for s in suid nosuid'
# but that would mean operating on ${s}_config_list which bitbake (IIRC)
# ruins. Better rename the files to config_list.suid to be able to loop.
#
for s in suid nosuid; do
  egrep ^CONFIG_ ${WORKDIR}/config_list.$s | while read i; do
    grep -w "$i" .config
  done > .config.$s
  # populate the config, default everything else to no
  KCONFIG_ALLCONFIG=config.$s make allnoconfig
  oe_runmake busybox_unstripped busybox.links
  mv busybox_unstripped busybox.$s
  mv busybox.links busybox.links.$s
done
cat .config-oe-full > .config

I would much prefer to make the generation of the suid cfg stuff more robust. Could you live with the attached helper thing (untested)? That would make it a prepended oe_runmake busybox.applets.suid to generate the list busybox.applets.suid. If that suits your needs we can apply it to busybox for general use..
The other possibility is, obviously, to fit all this in busybox' build itself, but given that we do have a seemingly working, bugless suid handling this might be better suited to be dealt with by the user as you suggest here.

Thoughts?
thanks,

Quoted 149 lines
meta/recipes-core/busybox/busybox.inc +72 -25
+		cp .config .config.orig
+		oe_runmake allnoconfig
+		cp .config .config.allno
+		for item in `grep 'CONFIG_' ${WORKDIR}/suid_config_list`; do
+			echo "# $item is not set" >> .config.nosuid.tmp
+			grep -w "$item" .config.orig >> .config.suid.tmp
+		done
+		merge_config.sh -m .config.orig .config.nosuid.tmp
+		cp .config .config.nosuid
+		merge_config.sh -m .config.allno .config.suid.tmp
+		cp .config .config.suid
+
+		# compile with no suid apps
+		cp .config.nosuid .config
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox.nosuid
+		oe_runmake busybox.links
+		cp busybox.links busybox.links.nosuid
+
+		# compile with suid apps
+		cp .config.suid .config
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox.suid
+		oe_runmake busybox.links
+		cp busybox.links busybox.links.suid
+
+		# copy .config.orig back to .config, because the install process may check this file
+		cp .config.orig .config
+
+		# cleanup
+		rm .config.orig .config.nosuid.tmp .config.allno .config.suid.tmp .config.nosuid .config.suid
+	else
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox
+		oe_runmake busybox.links
+	fi
 }
 
 do_install () {
-	oe_runmake busybox.links
 	if [ "${prefix}" != "/usr" ]; then
-		sed "s:^/usr/:${prefix}/:" busybox.links > busybox.links.new
-		mv busybox.links.new busybox.links
+		sed -i "s:^/usr/:${prefix}/:" busybox.links*
 	fi
 	if [ "${base_sbindir}" != "/sbin" ]; then
-		sed "s:^/sbin/:${base_sbindir}/:" busybox.links > busybox.links.new
-		mv busybox.links.new busybox.links
+		sed "s:^/sbin/:${base_sbindir}/:" busybox.links*
 	fi
 
 	install -d ${D}${sysconfdir}/init.d

@@ -157,12 +193,21 @@ do_install () {
 		# Install /bin/busybox, and the /bin/sh link so the postinst script
 		# can run. Let update-alternatives handle the rest.
 		install -d ${D}${base_bindir}
-		if grep -q "CONFIG_FEATURE_SUID=y" ${B}/.config; then
-			install -m 4755 ${B}/busybox ${D}${base_bindir}
+		if [ "${BUSYBOX_SPLIT_SUID}" = "1" ]; then
+			install -m 4755 ${B}/busybox.suid ${D}${base_bindir}
+			install -m 0755 ${B}/busybox.nosuid ${D}${base_bindir}
+			install -m 0644 ${S}/busybox.links.suid ${D}${sysconfdir}
+			install -m 0644 ${S}/busybox.links.nosuid ${D}${sysconfdir}
+			ln -sf busybox.nosuid ${D}${base_bindir}/sh
 		else
-			install -m 0755 ${B}/busybox ${D}${base_bindir}
+			if grep -q "CONFIG_FEATURE_SUID=y" ${B}/.config; then
+				install -m 4755 ${B}/busybox ${D}${base_bindir}
+			else
+				install -m 0755 ${B}/busybox ${D}${base_bindir}
+			fi
+			install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
+			ln -sf busybox ${D}${base_bindir}/sh
 		fi
-		ln -sf busybox ${D}${base_bindir}/sh
 	else
 		install -d ${D}${base_bindir} ${D}${base_sbindir}
 		install -d ${D}${libdir} ${D}${bindir} ${D}${sbindir}

@@ -181,6 +226,7 @@ do_install () {
 		if [ -f ${D}/linuxrc.${BPN} ]; then
 			mv ${D}/linuxrc.${BPN} ${D}/linuxrc
 		fi
+		install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
 	fi
 
 	if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then

@@ -217,7 +263,6 @@ do_install () {
                       install -m 644 ${WORKDIR}/mdev.conf ${D}${sysconfdir}/mdev.conf
               fi
 	fi
-	install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
 
    if ${@base_contains('DISTRO_FEATURES','systemd','true','false',d)}; then
        install -d ${D}${systemd_unitdir}/system

@@ -248,22 +293,27 @@ python do_package_prepend () {
 
    dvar = d.getVar('D', True)
    pn = d.getVar('PN', True)
-    f = open('%s/etc/busybox.links' % (dvar), 'r')
-
-    if os.path.exists('%s/bin/busybox' % (dvar)):
-        d.setVar('ALTERNATIVE_TARGET', "/bin/busybox")
-
-    for alt_link_name in f:
-        alt_link_name = alt_link_name.strip()
-        alt_name = os.path.basename(alt_link_name)
-
-        # Match coreutils
-        if alt_name == '[':
-            alt_name = 'lbracket'
 
-        d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
-        d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
-    f.close()
+    def set_alternative_vars(links, target):
+        f = open('%s%s' % (dvar, links), 'r')
+        for alt_link_name in f:
+            alt_link_name = alt_link_name.strip()
+            alt_name = os.path.basename(alt_link_name)
+            # Match coreutils
+            if alt_name == '[':
+                alt_name = 'lbracket'
+            d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
+            d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
+            if os.path.exists('%s%s' % (dvar, target)):
+                d.setVarFlag('ALTERNATIVE_TARGET', alt_name, target)
+        f.close()
+        return
+
+    if os.path.exists('%s/etc/busybox.links' % (dvar)):
+        set_alternative_vars("/etc/busybox.links", "/bin/busybox")
+    else:
+        set_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid")
+        set_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid")
 }
 
 pkg_prerm_${PN} () {
meta/recipes-core/busybox/busybox_1.20.2.bb +2 -1
index 3ff8a88..511f1f8 100644
@@ -36,7 +36,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
           file://busybox-sulogin-empty-root-password.patch \
           file://inetd.conf \
           file://inetd \
-           file://login-utilities.cfg"
+           file://login-utilities.cfg \
+           file://suid_config_list"
Quoted 9 lines

SRC_URI[tarball.md5sum] = "e025414bc6cd79579cc7a32a45d3ae1c" SRC_URI[tarball.sha256sum] = "eb13ff01dae5618ead2ef6f92ba879e9e0390f9583bd545d8789d27cf39b6882"

Signature · 6 lines
1.7.9.5

_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

From f2fd4b0cd08860c1e81f03516faef2b489b2a794 Mon Sep 17 00:00:00 2001
From: Bernhard Reutner-Fischer <[email protected]>
Date: Tue, 11 Jun 2013 22:08:22 +0200
Subject: [PATCH] buildsys: Add helper to list suid applets

Add a helper script that lists all applets that do NOT drop suid privileges.

Some setups prefer to build two busybox binaries, one that is suid which contains all applets that do or may require suid privileges, and a second one for all the rest (which drops suid). To ease splitting these two binaries, generate a list of CONFIG_ items for the suid binary.

Signed-off-by Bernhard Reutner-Fischer <[email protected]>
---
 Makefile.custom            |    5 ++++-
 applets/busybox.mksuid     |   39 +++++++++++++++++++++++++++++++++++++++
 include/applets.src.h      |    9 ++++++++-
 scripts/kconfig/confdata.c |   24 ++++++++++++++++++++----
 4 files changed, 71 insertions(+), 6 deletions(-)
 create mode 100755 applets/busybox.mksuid
Makefile.custom +4 -1
index 6da79e6..41c351f 100644
@@ -3,7 +3,10 @@
 # ==========================================================================
 
 busybox.links: $(srctree)/applets/busybox.mkll $(objtree)/include/autoconf.h include/applets.h
-	$(Q)-$(SHELL) $^ >$@
+	$(Q)-$(SHELL) $^ > $@
+
+busybox.applets.suid: $(srctree)/applets/busybox.mksuid $(objtree)/include/autoconf.h include/applets.h
+	$(Q)-$(SHELL) $^ > $@
 
 .PHONY: install
 ifeq ($(CONFIG_INSTALL_APPLET_SYMLINKS),y)
applets/busybox.mksuid new file +39 -0
new file mode 100755
index 0000000..4235d89
@@ -0,0 +1,39 @@
+#!/bin/sh
+# Make busybox list of applets that do NOT drop suid permissions
+
+# input $1: full path to autoconf.h
+# input $2: full path to applets.h
+# input $3: full path to .config
+# output (stdout): list of CONFIG_ that do or may require suid
+
+# Maintainer: Bernhard Reutner-Fischer
+
+export LC_ALL=POSIX
+export LC_CTYPE=POSIX
+
+CONFIG_H=${1:-include/autoconf.h}
+APPLETS_H=${2:-include/applets.h}
+DOT_CONFIG=${3:-.config}
+$HOSTCC -E -DMAKE_SUID -include $CONFIG_H $APPLETS_H |
+  awk '
+    /^SUID[ \t]/{
+      if ($2 == "BB_SUID_DROP") next
+      cfg = $NF
+      gsub("\"", "", cfg)
+      cfg = substr(cfg, 8)
+      s[i++] = "CONFIG_" cfg
+      s[i++] = "CONFIG_FEATURE_" cfg "_.*"
+    }
+    END{
+      while (getline < ARGV[2]) {
+        for (j in s) {
+          if ($0 ~ "^" s[j] "=y$") {
+            sub(/=.*/, "")
+            print
+            if (s[j] !~ /\*$/) delete s[j] # can drop this applet now
+          }
+        }
+      }
+    }
+' - $DOT_CONFIG
+
include/applets.src.h +8 -1
index 00172b1..aa319bb 100644
@@ -52,6 +52,12 @@ s     - suid type:
 # define APPLET_NOEXEC(name,main,l,s,name2)  LINK l name
 # define APPLET_NOFORK(name,main,l,s,name2)  LINK l name
 
+#elif defined(MAKE_SUID)
+# define APPLET(name,l,s)                    SUID s l name
+# define APPLET_ODDNAME(name,main,l,s,name2) SUID s l name
+# define APPLET_NOEXEC(name,main,l,s,name2)  SUID s l name
+# define APPLET_NOFORK(name,main,l,s,name2)  SUID s l name
+
 #else
   static struct bb_applet applets[] = { /*    name, main, location, need_suid */
 # define APPLET(name,l,s)                    { #name, #name, l, s },

@@ -415,7 +421,8 @@ IF_YES(APPLET_NOFORK(yes, yes, BB_DIR_USR_BIN, BB_SUID_DROP, yes))
 IF_GUNZIP(APPLET_ODDNAME(zcat, gunzip, BB_DIR_BIN, BB_SUID_DROP, zcat))
 IF_ZCIP(APPLET(zcip, BB_DIR_SBIN, BB_SUID_DROP))
 
-#if !defined(PROTOTYPES) && !defined(NAME_MAIN_CNAME) && !defined(MAKE_USAGE)
+#if !defined(PROTOTYPES) && !defined(NAME_MAIN_CNAME) && !defined(MAKE_USAGE) \
+	&& !defined(MAKE_LINKS) && !defined(MAKE_SUID)
 };
 #endif
scripts/kconfig/confdata.c +20 -4
index bd2d70e..303df0b 100644
@@ -474,7 +474,11 @@ int conf_write(const char *name)
 						fprintf(out_h, "#define CONFIG_%s 1\n", sym->name);
 						/* bbox */
 						fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
-						fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
+						fprintf(out_h, "#ifdef MAKE_SUID\n");
+						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
+						fprintf(out_h, "#else\n");
+						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
+						fprintf(out_h, "#endif\n");
 						fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
 					}
 					break;

@@ -506,7 +510,11 @@ int conf_write(const char *name)
 					fputs("\"\n", out_h);
 					/* bbox */
 					fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
-					fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
+					fprintf(out_h, "#ifdef MAKE_SUID\n");
+					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
+					fprintf(out_h, "#else\n");
+					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
+					fprintf(out_h, "#endif\n");
 					fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
 				}
 				break;

@@ -518,7 +526,11 @@ int conf_write(const char *name)
 						fprintf(out_h, "#define CONFIG_%s 0x%s\n", sym->name, str);
 						/* bbox */
 						fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
-						fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
+						fprintf(out_h, "#ifdef MAKE_SUID\n");
+						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
+						fprintf(out_h, "#else\n");
+						fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
+						fprintf(out_h, "#endif\n");
 						fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
 					}
 					break;

@@ -532,7 +544,11 @@ int conf_write(const char *name)
 					fprintf(out_h, "#define CONFIG_%s %s\n", sym->name, str);
 					/* bbox */
 					fprintf(out_h, "#define ENABLE_%s 1\n", sym->name);
-					fprintf(out_h, "#define IF_%s(...) __VA_ARGS__\n", sym->name);
+					fprintf(out_h, "#ifdef MAKE_SUID\n");
+					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__ \"CONFIG_%s\"\n", sym->name, sym->name);
+					fprintf(out_h, "#else\n");
+					fprintf(out_h, "# define IF_%s(...) __VA_ARGS__\n", sym->name);
+					fprintf(out_h, "#endif\n");
 					fprintf(out_h, "#define IF_NOT_%s(...)\n", sym->name);
 				}
 				break;
Signature · 1 line
1.7.10.4
author
#10 lore raw

Re: [PATCH 4/8] busybox: add the ability to split the busybox binary

Quoted 97 lines · Bernhard Reutner-Fischer
Quoted 96 lines · On Fri, Jun 07, 2013 at 02:13:58PM +0800, [email protected] wrote:

From: Chen Qi <[email protected]>

This patch enables us to split the busybox into two binaries, one containing suid applications, and the other containing nosuid apps.

Add a variable, BUSYBOX_SPLIT_SUID, to control whether to split the busybox binary into two parts. We default it to "1" to enable the splitting, but users could still override it to disable the splitting. After all, busybox has no internal support for this suid apps splitting, so there might be users out there who want just one busybox binary.

Add a configuration file, suid_config_list, to control which applications should be splitted into the suid binary. The list is first obtained from the information in include/applets.h. Some extra config items are also added to the list as they are related to the suid apps. I choose to use a configuration file here because if some config item is missed, we could add it to the list easily.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>

---

.../busybox/busybox-1.20.2/suid_config_list        |   48 +++++++++
meta/recipes-core/busybox/busybox.inc              |  104 +++++++++++++++-----
meta/recipes-core/busybox/busybox_1.20.2.bb        |    3 +-
3 files changed, 127 insertions(+), 28 deletions(-)

create mode 100644 meta/recipes-core/busybox/busybox-1.20.2/suid_config_list

meta/recipes-core/busybox/busybox-1.20.2/suid_config_list new file +48 -0
new file mode 100644
index 0000000..16a0b76
@@ -0,0 +1,48 @@
+# This file lists all config items which are related to suid apps in busybox.
+# The following list is obtained with the command below (splitted into two lines for readability).
+# for i in `grep -E "APPLET.*BB_SUID_((MAYBE|REQUIRE))" include/applets.h | grep -v _BB_SUID_DROP |
+# cut -f 3 -d '(' | cut -f 1 -d ','`; do grep -i -E "config_(feature_|)$i(_| )" .config; done | cut -d' ' -f2
+CONFIG_PING
+CONFIG_PING6
+CONFIG_CRONTAB
+CONFIG_FINDFS
+CONFIG_LOGIN
+CONFIG_LOGIN_SESSION_AS_CHILD
+CONFIG_LOGIN_SCRIPTS
+CONFIG_MOUNT
+CONFIG_FEATURE_MOUNT_FAKE
+CONFIG_FEATURE_MOUNT_VERBOSE
+CONFIG_FEATURE_MOUNT_HELPERS
+CONFIG_FEATURE_MOUNT_LABEL
+CONFIG_FEATURE_MOUNT_NFS
+CONFIG_FEATURE_MOUNT_CIFS
+CONFIG_FEATURE_MOUNT_FLAGS
+CONFIG_FEATURE_MOUNT_FSTAB
+CONFIG_FEATURE_MOUNT_LOOP
+CONFIG_FEATURE_MOUNT_LOOP_CREATE
+CONFIG_PASSWD
+CONFIG_FEATURE_PASSWD_WEAK_CHECK
+CONFIG_SU
+CONFIG_FEATURE_SU_SYSLOG
+CONFIG_FEATURE_SU_CHECKS_SHELLS
+CONFIG_TRACEROUTE
+CONFIG_FEATURE_TRACEROUTE_VERBOSE
+CONFIG_FEATURE_TRACEROUTE_SOURCE_ROUTE
+CONFIG_FEATURE_TRACEROUTE_USE_ICMP
+CONFIG_TRACEROUTE6
+CONFIG_VLOCK
+CONFIG_WALL
+
+# The following list is obtained by examining the Config.in file in busybox manually.
+# These config items are also related to suid apps.
+CONFIG_FEATURE_FANCY_PING
+CONFIG_FEATURE_SHADOWPASSWDS
+CONFIG_USE_BB_PWD_GRP
+CONFIG_USE_BB_SHADOW
+CONFIG_USE_BB_CRYPT
+CONFIG_USE_BB_CRYPT_SHA
+CONFIG_PAM
+CONFIG_FEATURE_NOLOGIN
+CONFIG_FEATURE_SECURETTY
+CONFIG_CRYPTPW
+CONFIG_CHPASSWD
meta/recipes-core/busybox/busybox.inc +0 -0
index 99d4e99..9984c5a 100644
@@ -12,6 +12,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=de10de48642ab74318e893a61105afbb"

SECTION = "base"

meta/recipes-core/busybox/busybox.inc +3 -0
+# Whether to split the suid apps into a seperate binary
+BUSYBOX_SPLIT_SUID ?= "1"
+

export EXTRA_CFLAGS = "${CFLAGS}"
export EXTRA_LDFLAGS = "${LDFLAGS}"

Quoted 8 lines

meta/recipes-core/busybox/busybox.inc do_configure () { · line 143

Quoted 8 lines
meta/recipes-core/busybox/busybox.inc +2 -2
@@ -136,19 +139,52 @@ do_configure () {
 
 do_compile() {
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-	oe_runmake busybox_unstripped
-	cp busybox_unstripped busybox
+	if [ "${BUSYBOX_SPLIT_SUID}" = "1" -a x`grep "CONFIG_FEATURE_INDIVIDUAL=y" .config` = x ]; then
+	# split the .config into two parts, and make two busybox binaries

Hi Bernhard,

Thank you very much for your review and suggestions!
I went through your methods below very carefully and I tried your patch out.

Here are two problems.

1) The config_list.suid could be derived by renaming the `original suid_config_list' file, but what about the config_list.nosuid? We have a suid_config_list, because compared with the non-suid apps, the amount of config items for suid apps or related to suid apps are relatively small. It seems that config_list.nosuid will be a very long list.

2) Your patch in the attachment worked out well. `make busybox.applets.suid' generates a file named busybox.applets.suid which contains the following config items. CONFIG_LOGIN
CONFIG_PASSWD
CONFIG_FEATURE_PASSWD_WEAK_CHECK
CONFIG_SU
CONFIG_FEATURE_SU_SYSLOG
CONFIG_FEATURE_SU_CHECKS_SHELLS
CONFIG_VLOCK
CONFIG_FINDFS
CONFIG_MOUNT
CONFIG_FEATURE_MOUNT_FAKE
CONFIG_FEATURE_MOUNT_VERBOSE
CONFIG_FEATURE_MOUNT_LABEL
CONFIG_FEATURE_MOUNT_CIFS
CONFIG_FEATURE_MOUNT_FLAGS
CONFIG_FEATURE_MOUNT_FSTAB
CONFIG_FEATURE_MOUNT_LOOP
CONFIG_FEATURE_MOUNT_LOOP_CREATE
CONFIG_CRONTAB
CONFIG_WALL
CONFIG_PING
CONFIG_PING6
CONFIG_TRACEROUTE
CONFIG_TRACEROUTE6
CONFIG_FEATURE_TRACEROUTE_VERBOSE

You see, this is a subset of the suid_config_list. As stated in the file's comments, part of the list is obtained from a command, and part of it is obtained by manually examine the Config.in files to find out the config items that are related to suid apps.

Best Regards,
Chen Qi

Quoted 188 lines

cat .config > .config-oe-full

# it would be nice to 'for s in suid nosuid'
# but that would mean operating on ${s}_config_list which bitbake (IIRC)
# ruins. Better rename the files to config_list.suid to be able to loop.
#
for s in suid nosuid; do
   egrep ^CONFIG_ ${WORKDIR}/config_list.$s | while read i; do
     grep -w "$i" .config
   done > .config.$s
   # populate the config, default everything else to no
   KCONFIG_ALLCONFIG=config.$s make allnoconfig
   oe_runmake busybox_unstripped busybox.links
   mv busybox_unstripped busybox.$s
   mv busybox.links busybox.links.$s
done
cat .config-oe-full > .config

I would much prefer to make the generation of the suid cfg stuff more robust. Could you live with the attached helper thing (untested)? That would make it a prepended oe_runmake busybox.applets.suid to generate the list busybox.applets.suid. If that suits your needs we can apply it to busybox for general use..
The other possibility is, obviously, to fit all this in busybox' build itself, but given that we do have a seemingly working, bugless suid handling this might be better suited to be dealt with by the user as you suggest here.

Thoughts?
thanks,

Quoted 158 lines
meta/recipes-core/busybox/busybox.inc +72 -25
+		cp .config .config.orig
+		oe_runmake allnoconfig
+		cp .config .config.allno
+		for item in `grep 'CONFIG_' ${WORKDIR}/suid_config_list`; do
+			echo "# $item is not set" >> .config.nosuid.tmp
+			grep -w "$item" .config.orig >> .config.suid.tmp
+		done
+		merge_config.sh -m .config.orig .config.nosuid.tmp
+		cp .config .config.nosuid
+		merge_config.sh -m .config.allno .config.suid.tmp
+		cp .config .config.suid
+
+		# compile with no suid apps
+		cp .config.nosuid .config
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox.nosuid
+		oe_runmake busybox.links
+		cp busybox.links busybox.links.nosuid
+
+		# compile with suid apps
+		cp .config.suid .config
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox.suid
+		oe_runmake busybox.links
+		cp busybox.links busybox.links.suid
+
+		# copy .config.orig back to .config, because the install process may check this file
+		cp .config.orig .config
+
+		# cleanup
+		rm .config.orig .config.nosuid.tmp .config.allno .config.suid.tmp .config.nosuid .config.suid
+	else
+		oe_runmake busybox_unstripped
+		cp busybox_unstripped busybox
+		oe_runmake busybox.links
+	fi
 }
 
 do_install () {
-	oe_runmake busybox.links
 	if [ "${prefix}" != "/usr" ]; then
-		sed "s:^/usr/:${prefix}/:" busybox.links > busybox.links.new
-		mv busybox.links.new busybox.links
+		sed -i "s:^/usr/:${prefix}/:" busybox.links*
 	fi
 	if [ "${base_sbindir}" != "/sbin" ]; then
-		sed "s:^/sbin/:${base_sbindir}/:" busybox.links > busybox.links.new
-		mv busybox.links.new busybox.links
+		sed "s:^/sbin/:${base_sbindir}/:" busybox.links*
 	fi
 
 	install -d ${D}${sysconfdir}/init.d

@@ -157,12 +193,21 @@ do_install () {
 		# Install /bin/busybox, and the /bin/sh link so the postinst script
 		# can run. Let update-alternatives handle the rest.
 		install -d ${D}${base_bindir}
-		if grep -q "CONFIG_FEATURE_SUID=y" ${B}/.config; then
-			install -m 4755 ${B}/busybox ${D}${base_bindir}
+		if [ "${BUSYBOX_SPLIT_SUID}" = "1" ]; then
+			install -m 4755 ${B}/busybox.suid ${D}${base_bindir}
+			install -m 0755 ${B}/busybox.nosuid ${D}${base_bindir}
+			install -m 0644 ${S}/busybox.links.suid ${D}${sysconfdir}
+			install -m 0644 ${S}/busybox.links.nosuid ${D}${sysconfdir}
+			ln -sf busybox.nosuid ${D}${base_bindir}/sh
 		else
-			install -m 0755 ${B}/busybox ${D}${base_bindir}
+			if grep -q "CONFIG_FEATURE_SUID=y" ${B}/.config; then
+				install -m 4755 ${B}/busybox ${D}${base_bindir}
+			else
+				install -m 0755 ${B}/busybox ${D}${base_bindir}
+			fi
+			install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
+			ln -sf busybox ${D}${base_bindir}/sh
 		fi
-		ln -sf busybox ${D}${base_bindir}/sh
 	else
 		install -d ${D}${base_bindir} ${D}${base_sbindir}
 		install -d ${D}${libdir} ${D}${bindir} ${D}${sbindir}

@@ -181,6 +226,7 @@ do_install () {
 		if [ -f ${D}/linuxrc.${BPN} ]; then
 			mv ${D}/linuxrc.${BPN} ${D}/linuxrc
 		fi
+		install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
 	fi
 
 	if grep -q "CONFIG_SYSLOGD=y" ${B}/.config; then

@@ -217,7 +263,6 @@ do_install () {
                        install -m 644 ${WORKDIR}/mdev.conf ${D}${sysconfdir}/mdev.conf
                fi
 	fi
-	install -m 0644 ${S}/busybox.links ${D}${sysconfdir}
 
     if ${@base_contains('DISTRO_FEATURES','systemd','true','false',d)}; then
         install -d ${D}${systemd_unitdir}/system

@@ -248,22 +293,27 @@ python do_package_prepend () {
 
     dvar = d.getVar('D', True)
     pn = d.getVar('PN', True)
-    f = open('%s/etc/busybox.links' % (dvar), 'r')
-
-    if os.path.exists('%s/bin/busybox' % (dvar)):
-        d.setVar('ALTERNATIVE_TARGET', "/bin/busybox")
-
-    for alt_link_name in f:
-        alt_link_name = alt_link_name.strip()
-        alt_name = os.path.basename(alt_link_name)
-
-        # Match coreutils
-        if alt_name == '[':
-            alt_name = 'lbracket'
 
-        d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
-        d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
-    f.close()
+    def set_alternative_vars(links, target):
+        f = open('%s%s' % (dvar, links), 'r')
+        for alt_link_name in f:
+            alt_link_name = alt_link_name.strip()
+            alt_name = os.path.basename(alt_link_name)
+            # Match coreutils
+            if alt_name == '[':
+                alt_name = 'lbracket'
+            d.appendVar('ALTERNATIVE_%s' % (pn), ' ' + alt_name)
+            d.setVarFlag('ALTERNATIVE_LINK_NAME', alt_name, alt_link_name)
+            if os.path.exists('%s%s' % (dvar, target)):
+                d.setVarFlag('ALTERNATIVE_TARGET', alt_name, target)
+        f.close()
+        return
+
+    if os.path.exists('%s/etc/busybox.links' % (dvar)):
+        set_alternative_vars("/etc/busybox.links", "/bin/busybox")
+    else:
+        set_alternative_vars("/etc/busybox.links.nosuid", "/bin/busybox.nosuid")
+        set_alternative_vars("/etc/busybox.links.suid", "/bin/busybox.suid")
 }
 
 pkg_prerm_${PN} () {
meta/recipes-core/busybox/busybox_1.20.2.bb +2 -1
index 3ff8a88..511f1f8 100644
@@ -36,7 +36,8 @@ SRC_URI = "http://www.busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://busybox-sulogin-empty-root-password.patch \
            file://inetd.conf \
            file://inetd \
-           file://login-utilities.cfg"
+           file://login-utilities.cfg \
+           file://suid_config_list"

SRC_URI[tarball.md5sum] = "e025414bc6cd79579cc7a32a45d3ae1c" SRC_URI[tarball.sha256sum] = "eb13ff01dae5618ead2ef6f92ba879e9e0390f9583bd545d8789d27cf39b6882"

Signature · 6 lines
1.7.9.5

_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core
#11 lore raw

Re: [PATCH 4/8] busybox: add the ability to split the busybox binary

Quoted 9 lines · ChenQi
Quoted 2 lines · Bernhard Reutner-Fischer

On Fri, Jun 07, 2013 at 02:13:58PM +0800, [email protected] wrote:

Hi Bernhard,

Thank you very much for your review and suggestions!
I went through your methods below very carefully and I tried your patch out.

Quoted 7 lines

Here are two problems.

1) The config_list.suid could be derived by renaming the `original suid_config_list' file, but what about the config_list.nosuid? We have a suid_config_list, because compared with the non-suid apps, the amount of config items for suid apps or related to suid apps are relatively small. It seems that config_list.nosuid will be a very long list.

yes. You can derive the nosuid by subtracting the suid from the full .config. If that is inconvenient, see the attached on top to generate both busybox.cfg.nosuid and busybox.cfg.suid .
see below.

Quoted 29 lines

2) Your patch in the attachment worked out well. `make busybox.applets.suid' generates a file named busybox.applets.suid which contains the following config items.
CONFIG_LOGIN
CONFIG_PASSWD
CONFIG_FEATURE_PASSWD_WEAK_CHECK
CONFIG_SU
CONFIG_FEATURE_SU_SYSLOG
CONFIG_FEATURE_SU_CHECKS_SHELLS
CONFIG_VLOCK
CONFIG_FINDFS
CONFIG_MOUNT
CONFIG_FEATURE_MOUNT_FAKE
CONFIG_FEATURE_MOUNT_VERBOSE
CONFIG_FEATURE_MOUNT_LABEL
CONFIG_FEATURE_MOUNT_CIFS
CONFIG_FEATURE_MOUNT_FLAGS
CONFIG_FEATURE_MOUNT_FSTAB
CONFIG_FEATURE_MOUNT_LOOP
CONFIG_FEATURE_MOUNT_LOOP_CREATE
CONFIG_CRONTAB
CONFIG_WALL
CONFIG_PING
CONFIG_PING6
CONFIG_TRACEROUTE
CONFIG_TRACEROUTE6
CONFIG_FEATURE_TRACEROUTE_VERBOSE

Quoted 4 lines

You see, this is a subset of the suid_config_list. As stated in the file's comments, part of the list is obtained from a command, and part of it is obtained by manually examine the Config.in files to find out the config items that are related to suid apps.

Yes, i know. Do you have suggestions there?
I think what we/you want is to build:
- busybox.suid with all nosuid *applets* turned off, but the non-applet CONFIG_ as per full.config
- busybox.nosuid with all suid *applets* turned off, but the non-applet CONFIG_ as per full.config

I.e. take busybox.cfg.nosuid (contains only applets), take busybox.cfg.suid (also contains only applets) subtract these -> non-applet_part_of_full.config. merge non-applet_part_of_full.config + suid -> bb.suid merge non-applet_part_of_full.config + nosuid -> bb.nosuid

Didn't try that, but you get the idea.
Would that work out for you?

cheers,

Quoted 67 lines

Best Regards,
Chen Qi

Quoted 63 lines

cat .config > .config-oe-full

# it would be nice to 'for s in suid nosuid'
# but that would mean operating on ${s}_config_list which bitbake (IIRC)
# ruins. Better rename the files to config_list.suid to be able to loop.
#
for s in suid nosuid; do
   egrep ^CONFIG_ ${WORKDIR}/config_list.$s | while read i; do
     grep -w "$i" .config
   done > .config.$s
   # populate the config, default everything else to no
   KCONFIG_ALLCONFIG=config.$s make allnoconfig
   oe_runmake busybox_unstripped busybox.links
   mv busybox_unstripped busybox.$s
   mv busybox.links busybox.links.$s
done
cat .config-oe-full > .config

I would much prefer to make the generation of the suid cfg stuff more robust. Could you live with the attached helper thing (untested)? That would make it a prepended oe_runmake busybox.applets.suid to generate the list busybox.applets.suid. If that suits your needs we can apply it to busybox for general use..
The other possibility is, obviously, to fit all this in busybox' build itself, but given that we do have a seemingly working, bugless suid handling this might be better suited to be dealt with by the user as you suggest here.

Thoughts?
thanks,

Quoted 33 lines
(quoted diff) +4 -0
+               cp .config .config.orig
+               oe_runmake allnoconfig
+               cp .config .config.allno
+               for item in `grep 'CONFIG_' ${WORKDIR}/suid_config_list`;

do

(quoted diff) +23 -0
+                       echo "# $item is not set" >> .config.nosuid.tmp
+                       grep -w "$item" .config.orig >> .config.suid.tmp
+               done
+               merge_config.sh -m .config.orig .config.nosuid.tmp
+               cp .config .config.nosuid
+               merge_config.sh -m .config.allno .config.suid.tmp
+               cp .config .config.suid
+
+               # compile with no suid apps
+               cp .config.nosuid .config
+               oe_runmake busybox_unstripped
+               cp busybox_unstripped busybox.nosuid
+               oe_runmake busybox.links
+               cp busybox.links busybox.links.nosuid
+
+               # compile with suid apps
+               cp .config.suid .config
+               oe_runmake busybox_unstripped
+               cp busybox_unstripped busybox.suid
+               oe_runmake busybox.links
+               cp busybox.links busybox.links.suid
+
+               # copy .config.orig back to .config, because the install

process may check this file

(quoted diff) +3 -0
+               cp .config.orig .config
+
+               # cleanup
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines

+ rm .config.orig .config.nosuid.tmp .config.allno
.config.suid.tmp .config.nosuid .config.suid

(quoted diff) +5 -0
+       else
+               oe_runmake busybox_unstripped
+               cp busybox_unstripped busybox
+               oe_runmake busybox.links
+       fi

}

Makefile.custom +4 -2
index 41c351f..3561e57 100644
@@ -5,8 +5,10 @@
 busybox.links: $(srctree)/applets/busybox.mkll $(objtree)/include/autoconf.h include/applets.h
 	$(Q)-$(SHELL) $^ > $@
 
-busybox.applets.suid: $(srctree)/applets/busybox.mksuid $(objtree)/include/autoconf.h include/applets.h
-	$(Q)-$(SHELL) $^ > $@
+busybox.cfg.suid: $(srctree)/applets/busybox.mksuid $(objtree)/include/autoconf.h include/applets.h
+	$(Q)-SUID="yes" $(SHELL) $^ > $@
+busybox.cfg.nosuid: $(srctree)/applets/busybox.mksuid $(objtree)/include/autoconf.h include/applets.h
+	$(Q)-SUID="DROP" $(SHELL) $^ > $@
 
 .PHONY: install
 ifeq ($(CONFIG_INSTALL_APPLET_SYMLINKS),y)
applets/busybox.mksuid +18 -3
index 4235d89..6492c07 100755
@@ -1,11 +1,16 @@
 #!/bin/sh
-# Make busybox list of applets that do NOT drop suid permissions
+# Make list of configuration variables regarding suid handling
 
 # input $1: full path to autoconf.h
 # input $2: full path to applets.h
 # input $3: full path to .config
 # output (stdout): list of CONFIG_ that do or may require suid
 
+# If the environment variable SUID is not set or set to DROP,
+# lists all config options that do not require suid permissions.
+# Otherwise, lists all config options for applets that DO or MAY require
+# suid permissions.
+
 # Maintainer: Bernhard Reutner-Fischer
 
 export LC_ALL=POSIX

@@ -14,10 +19,20 @@ export LC_CTYPE=POSIX
 CONFIG_H=${1:-include/autoconf.h}
 APPLETS_H=${2:-include/applets.h}
 DOT_CONFIG=${3:-.config}
+
+case ${SUID:-DROP} in
+[dD][rR][oO][pP]) USE="DROP" ;;
+*) USE="suid" ;;
+esac
+
 $HOSTCC -E -DMAKE_SUID -include $CONFIG_H $APPLETS_H |
-  awk '
+  awk -v USE=${USE} '
     /^SUID[ \t]/{
-      if ($2 == "BB_SUID_DROP") next
+      if (USE == "DROP") {
+        if ($2 != "BB_SUID_DROP") next
+      } else {
+        if ($2 == "BB_SUID_DROP") next
+      }
       cfg = $NF
       gsub("\"", "", cfg)
       cfg = substr(cfg, 8)
author
#12 lore raw

Re: [PATCH 4/8] busybox: add the ability to split the busybox binary

Thanks for your patience and all your explanations.
Now a version 2 has been sent out, containing changes from your suggestions and the patch you wrote. Please help review it if convenient.

Best Regards,
Chen Qi

Quoted 141 lines · Bernhard Reutner-Fischer
Quoted 7 lines · ChenQi
Quoted 1 line · Bernhard Reutner-Fischer

On Fri, Jun 07, 2013 at 02:13:58PM +0800, [email protected] wrote:

Hi Bernhard,

Thank you very much for your review and suggestions!
I went through your methods below very carefully and I tried your patch out.

Quoted 7 lines

Here are two problems.

1) The config_list.suid could be derived by renaming the `original suid_config_list' file, but what about the config_list.nosuid? We have a suid_config_list, because compared with the non-suid apps, the amount of config items for suid apps or related to suid apps are relatively small. It seems that config_list.nosuid will be a very long list.

yes. You can derive the nosuid by subtracting the suid from the full .config. If that is inconvenient, see the attached on top to generate both busybox.cfg.nosuid and busybox.cfg.suid .
see below.

Quoted 28 lines

2) Your patch in the attachment worked out well. `make busybox.applets.suid' generates a file named busybox.applets.suid which contains the following config items.
CONFIG_LOGIN
CONFIG_PASSWD
CONFIG_FEATURE_PASSWD_WEAK_CHECK
CONFIG_SU
CONFIG_FEATURE_SU_SYSLOG
CONFIG_FEATURE_SU_CHECKS_SHELLS
CONFIG_VLOCK
CONFIG_FINDFS
CONFIG_MOUNT
CONFIG_FEATURE_MOUNT_FAKE
CONFIG_FEATURE_MOUNT_VERBOSE
CONFIG_FEATURE_MOUNT_LABEL
CONFIG_FEATURE_MOUNT_CIFS
CONFIG_FEATURE_MOUNT_FLAGS
CONFIG_FEATURE_MOUNT_FSTAB
CONFIG_FEATURE_MOUNT_LOOP
CONFIG_FEATURE_MOUNT_LOOP_CREATE
CONFIG_CRONTAB
CONFIG_WALL
CONFIG_PING
CONFIG_PING6
CONFIG_TRACEROUTE
CONFIG_TRACEROUTE6
CONFIG_FEATURE_TRACEROUTE_VERBOSE

Quoted 4 lines

You see, this is a subset of the suid_config_list. As stated in the file's comments, part of the list is obtained from a command, and part of it is obtained by manually examine the Config.in files to find out the config items that are related to suid apps.

Yes, i know. Do you have suggestions there?
I think what we/you want is to build:
- busybox.suid with all nosuid *applets* turned off, but the non-applet CONFIG_ as per full.config
- busybox.nosuid with all suid *applets* turned off, but the non-applet CONFIG_ as per full.config

I.e. take busybox.cfg.nosuid (contains only applets), take busybox.cfg.suid (also contains only applets) subtract these -> non-applet_part_of_full.config. merge non-applet_part_of_full.config + suid -> bb.suid merge non-applet_part_of_full.config + nosuid -> bb.nosuid

Didn't try that, but you get the idea.
Would that work out for you?

cheers,

Quoted 73 lines

Best Regards,
Chen Qi

Quoted 70 lines

cat .config > .config-oe-full

# it would be nice to 'for s in suid nosuid'
# but that would mean operating on ${s}_config_list which bitbake (IIRC)
# ruins. Better rename the files to config_list.suid to be able to loop.
#
for s in suid nosuid; do
    egrep ^CONFIG_ ${WORKDIR}/config_list.$s | while read i; do
      grep -w "$i" .config
    done > .config.$s
    # populate the config, default everything else to no
    KCONFIG_ALLCONFIG=config.$s make allnoconfig
    oe_runmake busybox_unstripped busybox.links
    mv busybox_unstripped busybox.$s
    mv busybox.links busybox.links.$s
done
cat .config-oe-full > .config

I would much prefer to make the generation of the suid cfg stuff more robust. Could you live with the attached helper thing (untested)? That would make it a prepended oe_runmake busybox.applets.suid to generate the list busybox.applets.suid. If that suits your needs we can apply it to busybox for general use..
The other possibility is, obviously, to fit all this in busybox' build itself, but given that we do have a seemingly working, bugless suid handling this might be better suited to be dealt with by the user as you suggest here.

Thoughts?
thanks,

Quoted 40 lines
(quoted diff) +4 -0
+               cp .config .config.orig
+               oe_runmake allnoconfig
+               cp .config .config.allno
+               for item in `grep 'CONFIG_' ${WORKDIR}/suid_config_list`;

do

(quoted diff) +23 -0
+                       echo "# $item is not set" >> .config.nosuid.tmp
+                       grep -w "$item" .config.orig >> .config.suid.tmp
+               done
+               merge_config.sh -m .config.orig .config.nosuid.tmp
+               cp .config .config.nosuid
+               merge_config.sh -m .config.allno .config.suid.tmp
+               cp .config .config.suid
+
+               # compile with no suid apps
+               cp .config.nosuid .config
+               oe_runmake busybox_unstripped
+               cp busybox_unstripped busybox.nosuid
+               oe_runmake busybox.links
+               cp busybox.links busybox.links.nosuid
+
+               # compile with suid apps
+               cp .config.suid .config
+               oe_runmake busybox_unstripped
+               cp busybox_unstripped busybox.suid
+               oe_runmake busybox.links
+               cp busybox.links busybox.links.suid
+
+               # copy .config.orig back to .config, because the install

process may check this file

(quoted diff) +4 -0
+               cp .config.orig .config
+
+               # cleanup
+               rm .config.orig .config.nosuid.tmp .config.allno

.config.suid.tmp .config.nosuid .config.suid

(quoted diff) +5 -0
+       else
+               oe_runmake busybox_unstripped
+               cp busybox_unstripped busybox
+               oe_runmake busybox.links
+       fi

}

author
#13 lore raw

PATCH 5/8 packagegroup-core-boot: use busybox as the default login manager

In reply to a message not in the archive

From: Chen Qi <[email protected]>

tinylogin has been deprecated and the functionality ported into busybox, so we switch to using busybox as the default login manager.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>
---
 .../packagegroups/packagegroup-core-boot.bb        |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-core/packagegroups/packagegroup-core-boot.bb +1 -1
index 9306a34..d69c41d 100644
@@ -25,7 +25,7 @@ RCONFLICTS_${PN} = "task-core-boot"
 
 # Distro can override the following VIRTUAL-RUNTIME providers:
 VIRTUAL-RUNTIME_dev_manager ?= "udev"
-VIRTUAL-RUNTIME_login_manager ?= "tinylogin"
+VIRTUAL-RUNTIME_login_manager ?= "busybox"
 VIRTUAL-RUNTIME_init_manager ?= "sysvinit"
 VIRTUAL-RUNTIME_initscripts ?= "initscripts"
 VIRTUAL-RUNTIME_keymaps ?= "keymaps"
Signature · 1 line
1.7.9.5
author
#14 lore raw

PATCH 6/8 packagegroup-core-basic: set the default login manager

In reply to a message not in the archive

From: Chen Qi <[email protected]>

Set the default login manager to 'busybox', drop the mingetty in the RDEPENDS, use ${VIRTUAL-RUNTIME_login_manager} instead.

mingetty doesn't work with serial consoles, so if the login console is ttyS0 for example, we get error messages on screen and cannot login on ttyS0.

The login manager, no matter it's tinylogin or busybox, provides getty, so we can just rdepend on it.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>
---
 .../packagegroups/packagegroup-core-basic.bb       |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
meta/recipes-extended/packagegroups/packagegroup-core-basic.bb +2 -1
index 31cac33..00405d6 100644
@@ -92,11 +92,12 @@ RDEPENDS_packagegroup-core-dev-utils = "\
 
 VIRTUAL-RUNTIME_initscripts ?= "initscripts"
 VIRTUAL-RUNTIME_init_manager ?= "sysvinit"
+VIRTUAL-RUNTIME_login_manager ?= "busybox"
 RDEPENDS_packagegroup-core-initscripts = "\
     ${VIRTUAL-RUNTIME_initscripts} \
     ${VIRTUAL-RUNTIME_init_manager} \
     ethtool \
-    mingetty \
+    ${VIRTUAL-RUNTIME_login_manager} \
     sysklogd \
     "
Signature · 1 line
1.7.9.5
author
#15 lore raw

PATCH 7/8 mingetty: lower the ALTERNATIVE_PRIORITY

In reply to a message not in the archive

From: Chen Qi <[email protected]>

mingetty doesn't work with serial consoles. Currently, it has the same ALTERNATIVE_PRIORITY with busybox. So if it is installed with busybox together, it's possible that the getty is linked to the mingetty, causing failures when we login to the serial consoles.

Lower the its ALTERNATIVE_PRIORITY to solve this problem.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>
---
 meta/recipes-extended/mingetty/mingetty_1.08.bb |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
meta/recipes-extended/mingetty/mingetty_1.08.bb +1 -1
index 6c53957..fbd9cb4 100644
@@ -25,4 +25,4 @@ inherit update-alternatives
 ALTERNATIVE_${PN} = "getty"
 ALTERNATIVE_LINK_NAME[getty] = "${base_sbindir}/getty"
 ALTERNATIVE_TARGET[getty] = "${base_sbindir}/mingetty"
-ALTERNATIVE_PRIORITY = "50"
+ALTERNATIVE_PRIORITY = "10"
Signature · 1 line
1.7.9.5
author
#16 lore raw

PATCH 8/8 tinylogin: remove recipe

In reply to a message not in the archive

From: Chen Qi <[email protected]>

tinylogin has been deprecated and the functionality ported into busybox. We now use busybox as the login manager, so the tinylogin recipe could be deleted.

[YOCTO #4207]

Signed-off-by Chen Qi <[email protected]>
---
 .../tinylogin/tinylogin-1.4/add-system.patch       |  117 ---
 .../tinylogin-1.4/adduser-empty_pwd.patch          |   45 --
 .../tinylogin/tinylogin-1.4/avoid_static.patch     |   33 -
 .../tinylogin/tinylogin-1.4/cvs-20040608.patch     |  823 --------------------
 .../tinylogin/tinylogin-1.4/glibc_crypt_fix.patch  |   23 -
 .../tinylogin-1.4/passwd_rotate_check.patch        |   41 -
 .../tinylogin/tinylogin-1.4/remove-index.patch     |   13 -
 .../tinylogin/tinylogin-1.4/use_O2_option.patch    |   21 -
 meta/recipes-core/tinylogin/tinylogin_1.4.bb       |   45 --
 9 files changed, 1161 deletions(-)
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/add-system.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/adduser-empty_pwd.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/avoid_static.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/cvs-20040608.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/glibc_crypt_fix.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/passwd_rotate_check.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/remove-index.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin-1.4/use_O2_option.patch
 delete mode 100644 meta/recipes-core/tinylogin/tinylogin_1.4.bb
meta/recipes-core/tinylogin/tinylogin-1.4/add-system.patch deleted +0 -117
deleted file mode 100644
index 0a97974..0000000
@@ -1,117 +0,0 @@
-Upstream-Status: Backport
-
-? add-system.patch
-? cvs-20040608.patch
-? familiar
-? pod2htmd.tmp
-? pod2htmi.tmp
-? system.diff
-? tinylogin_1.4-20030620.1_arm.ipk
-? tinylogin_1.4-20030620.1_arm.ipk.asc
-? tinylogin_1.4-20030620.1_arm.ipk.upload.html
-? tinylogin_1.4-20030620.2_arm.ipk
-? tinylogin_1.4-20030620.2_arm.ipk.asc
-? tinylogin_1.4-20030620.2_arm.ipk.upload.html
-? tinylogin_1.4-20030620_arm.ipk
-? tinylogin_1.4-20030620_arm.ipk.asc
-? tinylogin_1.4-20030620_arm.ipk.upload.html
-? tmp
-Index: addgroup.c
-===================================================================
-RCS file: /var/cvs/tinylogin/addgroup.c,v
-retrieving revision 1.23
-diff -u -r1.23 addgroup.c
---- a/addgroup.c	9 Jan 2003 18:43:29 -0000	1.23
-+++ b/addgroup.c	8 Jun 2004 08:56:08 -0000
-@@ -31,6 +31,7 @@
- #include <sys/stat.h>
- #include <sys/types.h>
- #include <unistd.h>
-+#include <getopt.h>
- #include "tinylogin.h"
- 
- #define GROUP_FILE      "/etc/group"
-@@ -124,6 +125,11 @@
- 	return 0;
- }
- 
-+static struct option long_options[] = {
-+  { "system",		0, NULL, 'S' },
-+  { 0,			0, 0, 0 }
-+};
-+
- /*
-  * addgroup will take a login_name as its first parameter.
-  *
-@@ -136,14 +142,19 @@
- 	int opt;
- 	char *group;
- 	char *user;
-+	int option_index = -1;
- 	gid_t gid = 0;
-+	int system = 0;
- 
- 	/* get remaining args */
--	while ((opt = getopt (argc, argv, "g:")) != -1) {
-+	while ((opt = getopt_long (argc, argv, "g:S", long_options, &option_index)) != -1) {
- 		switch (opt) {
- 			case 'g':
- 				gid = strtol(optarg, NULL, 10);
- 				break;
-+			case 'S':
-+				system = 1;
-+				break;
- 			default:
- 				show_usage();
- 				break;
-Index: adduser.c
-===================================================================
-RCS file: /var/cvs/tinylogin/adduser.c,v
-retrieving revision 1.38
-diff -u -r1.38 adduser.c
---- a/adduser.c	21 Jun 2003 19:35:42 -0000	1.38
-+++ b/adduser.c	8 Jun 2004 08:56:09 -0000
-@@ -66,13 +66,13 @@
- 
- /* remix */
- /* EDR recoded such that the uid may be passed in *p */
--static int passwd_study(const char *filename, struct passwd *p)
-+static int passwd_study(const char *filename, struct passwd *p, int system)
- {
- 	struct passwd *pw;
- 	FILE *passwd;
- 
--	const int min = 500;
--	const int max = 65000;
-+	const int min = system ? 10 : 500;
-+	const int max = system ? 99 : 65000;
- 
- 	passwd = wfopen(filename, "r");
- 	if (!passwd)
-@@ -142,7 +142,7 @@
- }
- 
- /* putpwent(3) remix */
--static int adduser(const char *filename, struct passwd *p, int makehome, int setpass)
-+static int adduser(const char *filename, struct passwd *p, int makehome, int setpass, int system)
- {
- 	FILE *passwd;
- 	int r;
-@@ -165,7 +165,7 @@
- 	fseek(passwd, 0, SEEK_END);
- 
- 	/* if (passwd_study(filename, p) == 0) { */
--	r = passwd_study(filename, p);
-+	r = passwd_study(filename, p, system);
- 	if (r) {
- 		if (r == 1)
- 			error_msg("%s: login already in use", p->pw_name);
-@@ -357,7 +357,7 @@
- 	}
- 
- 	/* grand finale */
--	return adduser(PASSWD_FILE, &pw, makehome, setpass);
-+	return adduser(PASSWD_FILE, &pw, makehome, setpass, system);
- }
- 
- /* $Id: adduser.c,v 1.38 2003/06/21 19:35:42 andersen Exp $ */
meta/recipes-core/tinylogin/tinylogin-1.4/adduser-empty_pwd.patch deleted +0 -45

45 lines not on this page · raw message

meta/recipes-core/tinylogin/tinylogin-1.4/avoid_static.patch deleted +0 -33
deleted file mode 100644
index 8a06af0..0000000
@@ -1,33 +0,0 @@
-tinylogin: Do not link statically when building debug
-
-For some reason if DODEBUG was enabled (to prevent stripping) the binary was
-also statically linked.  This patch prevents that behavior.
-
-Upstream-Status: Inappropriate [no upstream]
-
-Signed-off-by: Mark Hatle <[email protected]>
-
-diff -ur tinylogin-1.4.orig/Makefile tinylogin-1.4/Makefile
---- tinylogin-1.4.orig/Makefile	2011-06-18 11:00:23.073927349 -0500
-+++ tinylogin-1.4/Makefile	2011-06-18 11:03:26.394849372 -0500
-@@ -123,20 +123,6 @@
-     LDFLAGS += -s -Wl,-warn-common 
-     STRIP    = $(STRIPTOOL) --remove-section=.note --remove-section=.comment $(PROG)
- endif
--ifeq ($(strip $(DODEBUG)),true)
--    LDFLAGS += --static
--    #
--    #use '-ffunction-sections -fdata-sections' and '--gc-sections' (if they 
--    # work) to try and strip out any unused junk.  Doesn't do much for me, 
--    # but you may want to give it a shot...
--    #
--    #ifeq ($(shell $(CC) -ffunction-sections -fdata-sections -S \
--    #	-o /dev/null -xc /dev/null 2>/dev/null && $(LD) \
--    #			--gc-sections -v >/dev/null && echo 1),1)
--    #	CFLAGS += -ffunction-sections -fdata-sections
--    #	LDFLAGS += --gc-sections
--    #endif
--endif
- ifeq ($(strip $(DOSTATIC)),true)
-     LDFLAGS += --static
-     #
meta/recipes-core/tinylogin/tinylogin-1.4/cvs-20040608.patch deleted +0 -823

823 lines not on this page · raw message

meta/recipes-core/tinylogin/tinylogin-1.4/glibc_crypt_fix.patch deleted +0 -23
deleted file mode 100644
index 0a24656..0000000
@@ -1,23 +0,0 @@
-
-staring from glibc 2.17 the crypt() function will error out and return
-NULL if the seed or "correct" is invalid. The failure case for this is
-an unknown user which tinylogin assigns '!' for the password. crypt() 
-now expects a minimum of 2 valid characters. If we get a NULL return
-value from the crypt, assume we fail and return 0.
-
-Upstream-Status: Inappropriate [tinylogin depercated]
-Signed-off-by: Saul Wold <[email protected]>
-
-Index: tinylogin-1.4/libbb/correct_password.c
-===================================================================
---- tinylogin-1.4.orig/libbb/correct_password.c
-+++ tinylogin-1.4/libbb/correct_password.c
-@@ -74,5 +74,8 @@ int correct_password ( const struct pass
- 	}
- 	encrypted = crypt ( unencrypted, correct );
- 	memset ( unencrypted, 0, xstrlen ( unencrypted ));
-+        if ( !encrypted )
-+		return 0;
-+
- 	return ( strcmp ( encrypted, correct ) == 0 ) ? 1 : 0;
- }
meta/recipes-core/tinylogin/tinylogin-1.4/passwd_rotate_check.patch deleted +0 -41

41 lines not on this page · raw message

meta/recipes-core/tinylogin/tinylogin-1.4/remove-index.patch deleted +0 -13
deleted file mode 100644
index 9d3c324..0000000
@@ -1,13 +0,0 @@
-Upstream-Status: Inappropriate [legacy version]
-
---- /tmp/deluser.c	2007-05-13 10:38:19.000000000 +0200
-+++ tinylogin-1.4/deluser.c	2007-05-13 10:38:50.185251000 +0200
-@@ -60,7 +60,7 @@
- 	}
- 	start++;
- 
--	stop = index(start, '\n');	/* index is a BSD-ism */
-+	stop = strchr(start, '\n');	/* index is a BSD-ism, strchr hopefully isn't */
- 	b.start = start - buffer;
- 	b.stop = stop - buffer;
- 	return b;
meta/recipes-core/tinylogin/tinylogin-1.4/use_O2_option.patch deleted +0 -21
deleted file mode 100644
index 5b88060..0000000
@@ -1,21 +0,0 @@
-Upstream-Status: Inappropriate [configuration]
-
-tinylogin will meet segment fault if compiled by gcc-4.5.0 when enable both
-frename-registers and Os options. Use O2 instead.
-
-Signed-off-by: Dongxiao Xu <[email protected]>
-
-diff -ruN tinylogin-1.4-orig/Makefile tinylogin-1.4/Makefile
---- tinylogin-1.4-orig/Makefile	2010-09-16 13:02:06.302192295 +0800
-+++ tinylogin-1.4/Makefile	2010-09-16 13:02:34.634167846 +0800
-@@ -97,9 +97,7 @@
- #--------------------------------------------------------
- 
- 
--# use '-Os' optimization if available, else use -O2
--OPTIMIZATION = $(shell if $(CC) -Os -S -o /dev/null -xc /dev/null >/dev/null 2>&1; \
--    then echo "-Os"; else echo "-O2" ; fi)
-+OPTIMIZATION = -O2
- 
- WARNINGS = -Wall
-
meta/recipes-core/tinylogin/tinylogin_1.4.bb deleted +0 -45

45 lines not on this page · raw message

Signature · 1 line
1.7.9.5