#
289938 |
|
25-Oct-2015 |
jilles |
MFC r288430: wordexp: Rewrite to make WRDE_NOCMD reliable.
Shell syntax is too complicated to detect command substitution and unquoted operators reliably without implementing much of sh's parser. Therefore, have sh do this detection.
While changing sh's support anyway, also read input from a pipe instead of arguments to avoid {ARG_MAX} limits and improve privacy, and output count and length using 16 instead of 8 digits.
The basic concept is: execl("/bin/sh", "sh", "-c", "freebsd_wordexp ${1:+\"$1\"} -f "$2", "", flags & WRDE_NOCMD ? "-p" : "", <pipe with words>);
The WRDE_BADCHAR error is still implemented in libc. POSIX requires us to fail strings containing unquoted braces with code WRDE_BADCHAR. Since this is normally not a syntax error in sh, there is still a need for checking code in libc, we_check().
The new we_check() is an optimistic check that all the characters <newline> | & ; < > ( ) { } are quoted. To avoid duplicating too much sh logic, such characters are permitted when quoting characters are seen, even if the quoting characters may themselves be quoted. This code reports all WRDE_BADCHAR errors; bad characters that get past it and are a syntax error in sh return WRDE_SYNTAX.
Although many implementations of WRDE_NOCMD erroneously allow some command substitutions (and ours even documented this), there appears to be code that relies on its security (codesearch.debian.net shows quite a few uses). Passing untrusted data to wordexp() still exposes a denial of service possibility and a fairly large attack surface.
This is also a MFC of r286830 to reduce conflicts. I changed the code somewhat to avoid changes from r286941; in particular, WRDE_BADVAL can still only be returned if WRDE_UNDEF was passed.
Relnotes: yes Security: fixes command execution with wordexp(untrusted, WRDE_NOCMD)
|
#
287480 |
|
05-Sep-2015 |
kib |
MFC r287292: Switch libc from using _sig{procmask,action,suspend} symbols, which are aliases for the syscall stubs and are plt-interposed, to the libc-private aliases of internally interposed sigprocmask() etc.
MFC r287300: Use libthr interposed functions instead of syscalls, in posix_spawn()' child.
|
#
281743 |
|
19-Apr-2015 |
jilles |
MFC r280919: wordexp: Explicitly pass along IFS.
Per Austin group issue #884, sh should not import IFS from the environment but always set it to $' \t\n'. For wordexp(), however, it is documented and useful for it to use IFS from the environment.
Since sh currently imports IFS from the environment, this change has no functional effect.
|
#
287480 |
|
05-Sep-2015 |
kib |
MFC r287292: Switch libc from using _sig{procmask,action,suspend} symbols, which are aliases for the syscall stubs and are plt-interposed, to the libc-private aliases of internally interposed sigprocmask() etc.
MFC r287300: Use libthr interposed functions instead of syscalls, in posix_spawn()' child.
|
#
281743 |
|
19-Apr-2015 |
jilles |
MFC r280919: wordexp: Explicitly pass along IFS.
Per Austin group issue #884, sh should not import IFS from the environment but always set it to $' \t\n'. For wordexp(), however, it is documented and useful for it to use IFS from the environment.
Since sh currently imports IFS from the environment, this change has no functional effect.
|