[PATCH 1/2] kconfig: Refactor sym_escape_string_value

[PATCH 1/2] kconfig: Refactor sym_escape_string_value

[Richard Weinberger]

sym_escape_string_value() can take a struct symbol directly
and use sym_get_string_value() itself to obtain the string value.
We will need struct symbol later for error reporting.

Signed-off-by: Richard Weinberger <richard@nod.at>
---
 scripts/kconfig/conf.c      | 3 +--
 scripts/kconfig/confdata.c  | 3 +--
 scripts/kconfig/lkc_proto.h | 2 +-
 scripts/kconfig/symbol.c    | 6 ++++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 5d84b44a2a2a..a6dad4a2e7a2 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -650,8 +650,7 @@ static void check_conf(struct menu *menu)
 				const char *str;
 
 				if (sym->type == S_STRING) {
-					str = sym_get_string_value(sym);
-					str = sym_escape_string_value(str);
+					str = sym_escape_string(sym);
 					printf("%s%s=%s\n", CONFIG_, sym->name, str);
 					free((void *)str);
 				} else {
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index cf72680cd769..4e053f2477f9 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -734,8 +734,7 @@ static void conf_write_symbol(FILE *fp, struct symbol *sym,
 	case S_UNKNOWN:
 		break;
 	case S_STRING:
-		str = sym_get_string_value(sym);
-		str = sym_escape_string_value(str);
+		str = sym_escape_string(sym);
 		printer->print_symbol(fp, sym, str, printer_arg);
 		free((void *)str);
 		break;
diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
index a11626bdc421..035cc522808b 100644
--- a/scripts/kconfig/lkc_proto.h
+++ b/scripts/kconfig/lkc_proto.h
@@ -18,7 +18,7 @@ extern struct symbol * symbol_hash[SYMBOL_HASHSIZE];
 
 struct symbol * sym_lookup(const char *name, int flags);
 struct symbol * sym_find(const char *name);
-const char * sym_escape_string_value(const char *in);
+const char * sym_escape_string(struct symbol *sym);
 struct symbol ** sym_re_search(const char *pattern);
 const char * sym_type_name(enum symbol_type type);
 void sym_calc_value(struct symbol *sym);
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 5844d636d38f..4a31bb943f79 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -871,13 +871,15 @@ struct symbol *sym_find(const char *name)
 	return symbol;
 }
 
-const char *sym_escape_string_value(const char *in)
+const char *sym_escape_string(struct symbol *sym)
 {
-	const char *p;
+	const char *in, *p;
 	size_t reslen;
 	char *res;
 	size_t l;
 
+	in = sym_get_string_value(sym);
+
 	reslen = strlen(in) + strlen("\"\"") + 1;
 
 	p = in;
-- 
2.26.2

[PATCH 2/2] kconfig: Deny command substitution in string values

[Richard Weinberger]

The post processed .config file will get included in shell
and makefiles. So make sure that a string does not contain
symbols that allow command substitution.
If such a malformed string is found, return empty string
and report it.

Signed-off-by: Richard Weinberger <richard@nod.at>
---
 scripts/kconfig/symbol.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 4a31bb943f79..1035ecdddc99 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -880,6 +880,11 @@ const char *sym_escape_string(struct symbol *sym)
 
 	in = sym_get_string_value(sym);
 
+	if (strspn(in, "`$")) {
+		fprintf(stderr, "%s: invalid characters in string found\n", sym->name);
+		return xstrdup("\"\"");
+	}
+
 	reslen = strlen(in) + strlen("\"\"") + 1;
 
 	p = in;
-- 
2.26.2

Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Boris Kolpackov]

Richard Weinberger <richard@nod.at> writes:

> The post processed .config file will get included in shell
> and makefiles.

That depends on who you ask: a number of projects other than the
Linux kernel use kconfig for configuration and some of them do
neither of those. I also don't believe the Linux kernel sources
.config in shell (but I may be wrong).


> So make sure that a string does not contain
> symbols that allow command substitution.
> If such a malformed string is found, return empty string
> and report it.

So effectively it's now impossible to include ` or $ in kconfig
string values. Seems like a major, backwards-incompatible
restriction.

I think if this is really desired, then it should be re-done with
escaping (similar to ") rather than outright banning inconvenient 
characters.

Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Richard Weinberger]

Boris,

----- Ursprüngliche Mail -----
> Von: "Boris Kolpackov" <boris@codesynthesis.com>
> An: "richard" <richard@nod.at>
> CC: masahiroy@kernel.org, "linux-kernel" <linux-kernel@vger.kernel.org>, linux-kbuild@vger.kernel.org
> Gesendet: Mittwoch, 22. September 2021 09:17:44
> Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values

> Richard Weinberger <richard@nod.at> writes:
> 
>> The post processed .config file will get included in shell
>> and makefiles.
> 
> That depends on who you ask: a number of projects other than the
> Linux kernel use kconfig for configuration and some of them do
> neither of those. I also don't believe the Linux kernel sources
> .config in shell (but I may be wrong).

See below.

> 
>> So make sure that a string does not contain
>> symbols that allow command substitution.
>> If such a malformed string is found, return empty string
>> and report it.
> 
> So effectively it's now impossible to include ` or $ in kconfig
> string values. Seems like a major, backwards-incompatible
> restriction.

Do you have a working example?
Since the config is sourced in the scripts/setlocalversion it will
not work correctly anyway.

> I think if this is really desired, then it should be re-done with
> escaping (similar to ") rather than outright banning inconvenient
> characters.

Escaping is not so easy since the very same content is included
in shell scripts (sertlocalversion), in Makefiles and in C files.
At least I didn't find find a good way to escape these characters
such that all three programming environments will accept it.

Thanks,
//richard

Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Boris Kolpackov]

Richard Weinberger <richard@nod.at> writes:

> > So effectively it's now impossible to include ` or $ in kconfig
> > string values. Seems like a major, backwards-incompatible
> > restriction.
> 
> Do you have a working example?

You mean of a project that uses kconfig and that is capable of
handling string values with these characters? If so, then yes,
see for example, libbuild2-kconfig[1] which is a build system
module that implements kconfig-based configuration support for
build2. In particular, it exposes values from .config  as
buildfile variables but it doesn't do this by sourcing .config.
Instead it loads .config using the kconfig API and then sets
the corresponding buildfile variables programmatically.


> Since the config is sourced in the scripts/setlocalversion it will
> not work correctly anyway.

The actual file being sources is include/config/auto.conf, not
.config, right?


> > I think if this is really desired, then it should be re-done with
> > escaping (similar to ") rather than outright banning inconvenient
> > characters.
> 
> Escaping is not so easy since the very same content is included
> in shell scripts (sertlocalversion), in Makefiles and in C files.

Again, I don't think it's .config that gets included in C files but 
rather include/generated/autoconf.h, right?


> At least I didn't find find a good way to escape these characters
> such that all three programming environments will accept it.

If my understanding is correct, then you are concerned with the
autoconf functionality: the auto.conf makefile and autoconf.h
header, and not the .config file itself. Perhaps it will be less
disruptive to do the escaping (or banning) at that level?

Specifically:

1. If you do escaping at that level, then you can do it differently
   for auto.conf and autoconf.h. Though auto.conf still seems to be
   read by both make and shell.

2. Alternatively, you can detect and ban the inconvenient characters
   when generating these files (I personally don't care for autoconf
   and have it disabled).

[1] https://github.com/build2/libbuild2-kconfig

Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Richard Weinberger]

Boris,

----- Ursprüngliche Mail -----
> Von: "Boris Kolpackov" <boris@codesynthesis.com>
> An: "richard" <richard@nod.at>
> CC: "masahiroy" <masahiroy@kernel.org>, "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-kbuild"
> <linux-kbuild@vger.kernel.org>
> Gesendet: Mittwoch, 22. September 2021 17:18:43
> Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values

> Richard Weinberger <richard@nod.at> writes:
> 
>> > So effectively it's now impossible to include ` or $ in kconfig
>> > string values. Seems like a major, backwards-incompatible
>> > restriction.
>> 
>> Do you have a working example?
> 
> You mean of a project that uses kconfig and that is capable of
> handling string values with these characters? If so, then yes,
> see for example, libbuild2-kconfig[1] which is a build system
> module that implements kconfig-based configuration support for
> build2. In particular, it exposes values from .config  as
> buildfile variables but it doesn't do this by sourcing .config.
> Instead it loads .config using the kconfig API and then sets
> the corresponding buildfile variables programmatically.

I had a config setting of Linux in mind. :-)

> 
>> Since the config is sourced in the scripts/setlocalversion it will
>> not work correctly anyway.
> 
> The actual file being sources is include/config/auto.conf, not
> .config, right?
> 

Yes. auto.conf is .config post processed.
This is exactly where my mitigation takes place.
 
>> > I think if this is really desired, then it should be re-done with
>> > escaping (similar to ") rather than outright banning inconvenient
>> > characters.
>> 
>> Escaping is not so easy since the very same content is included
>> in shell scripts (sertlocalversion), in Makefiles and in C files.
> 
> Again, I don't think it's .config that gets included in C files but
> rather include/generated/autoconf.h, right?
> 

Yes. But the key/values are taken as-is.

Just add some odd characters to your .config, build the kernel and observe
the breakage at different levels.
Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-)

>> At least I didn't find find a good way to escape these characters
>> such that all three programming environments will accept it.
> 
> If my understanding is correct, then you are concerned with the
> autoconf functionality: the auto.conf makefile and autoconf.h
> header, and not the .config file itself. Perhaps it will be less
> disruptive to do the escaping (or banning) at that level?

My concern is that currently a .config file can contain hostile content
that will get executed at build time.
.config files are often blindly shared across untrusted developers.
So I thought that mitigating this whole is worth it.

> Specifically:
> 
> 1. If you do escaping at that level, then you can do it differently
>   for auto.conf and autoconf.h. Though auto.conf still seems to be
>   read by both make and shell.

I need to think about that. Thanks for the pointer.

Thanks,
//richard

Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Masahiro Yamada]

On Thu, Sep 23, 2021 at 1:17 AM Richard Weinberger <richard@nod.at> wrote:
>
> Boris,
>
> ----- Ursprüngliche Mail -----
> > Von: "Boris Kolpackov" <boris@codesynthesis.com>
> > An: "richard" <richard@nod.at>
> > CC: "masahiroy" <masahiroy@kernel.org>, "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-kbuild"
> > <linux-kbuild@vger.kernel.org>
> > Gesendet: Mittwoch, 22. September 2021 17:18:43
> > Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values
>
> > Richard Weinberger <richard@nod.at> writes:
> >
> >> > So effectively it's now impossible to include ` or $ in kconfig
> >> > string values. Seems like a major, backwards-incompatible
> >> > restriction.
> >>
> >> Do you have a working example?
> >
> > You mean of a project that uses kconfig and that is capable of
> > handling string values with these characters? If so, then yes,
> > see for example, libbuild2-kconfig[1] which is a build system
> > module that implements kconfig-based configuration support for
> > build2. In particular, it exposes values from .config  as
> > buildfile variables but it doesn't do this by sourcing .config.
> > Instead it loads .config using the kconfig API and then sets
> > the corresponding buildfile variables programmatically.
>
> I had a config setting of Linux in mind. :-)
>
> >
> >> Since the config is sourced in the scripts/setlocalversion it will
> >> not work correctly anyway.
> >
> > The actual file being sources is include/config/auto.conf, not
> > .config, right?
> >
>
> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.
>
> >> > I think if this is really desired, then it should be re-done with
> >> > escaping (similar to ") rather than outright banning inconvenient
> >> > characters.
> >>
> >> Escaping is not so easy since the very same content is included
> >> in shell scripts (sertlocalversion), in Makefiles and in C files.
> >
> > Again, I don't think it's .config that gets included in C files but
> > rather include/generated/autoconf.h, right?
> >
>
> Yes. But the key/values are taken as-is.
>
> Just add some odd characters to your .config, build the kernel and observe
> the breakage at different levels.
> Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-)
>
> >> At least I didn't find find a good way to escape these characters
> >> such that all three programming environments will accept it.
> >
> > If my understanding is correct, then you are concerned with the
> > autoconf functionality: the auto.conf makefile and autoconf.h
> > header, and not the .config file itself. Perhaps it will be less
> > disruptive to do the escaping (or banning) at that level?
>
> My concern is that currently a .config file can contain hostile content
> that will get executed at build time.
> .config files are often blindly shared across untrusted developers.
> So I thought that mitigating this whole is worth it.
>
> > Specifically:
> >
> > 1. If you do escaping at that level, then you can do it differently
> >   for auto.conf and autoconf.h. Though auto.conf still seems to be
> >   read by both make and shell.
>
> I need to think about that. Thanks for the pointer.
>
> Thanks,
> //richard


I recalled that we discussed this a few years ago.

https://lore.kernel.org/all/20180217203945.2515-1-richard@nod.at/


include/config/auto.conf is just a sub-set of .config
with "# CONFIG... is not set" dropped.

If we do some escapings in it is not feasible
as you mentioned, due to the difference of escaping
between makefile and shell-scripts.

$$ for makefiles
\$  for shell scripts


If we go this way, perhaps, we need to generate two files
include/config/autoconf.mk and include/config/autoconf.sh


BTW, xtensa relies on having $ in the .config file.

masahiro@grover:~/workspace/linux-kbuild$ find . -name '*_defconfig' |
xargs grep '\$'
./arch/xtensa/configs/cadence_csp_defconfig:CONFIG_INITRAMFS_SOURCE="$$KERNEL_INITRAMFS_SOURCE"


If we make this decision, we need to persuade xtensa folks
to not do this...





-- 
Best Regards
Masahiro Yamada

Re: [PATCH 1/2] kconfig: Refactor sym_escape_string_value

[Masahiro Yamada]

On Tue, Sep 21, 2021 at 6:42 AM Richard Weinberger <richard@nod.at> wrote:
>
> sym_escape_string_value() can take a struct symbol directly
> and use sym_get_string_value() itself to obtain the string value.
> We will need struct symbol later for error reporting.
>
> Signed-off-by: Richard Weinberger <richard@nod.at>
> ---

I think this is a nice clean-up regardless of 2/2.
Applied to linux-kbuild. Thanks.



>  scripts/kconfig/conf.c      | 3 +--
>  scripts/kconfig/confdata.c  | 3 +--
>  scripts/kconfig/lkc_proto.h | 2 +-
>  scripts/kconfig/symbol.c    | 6 ++++--
>  4 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
> index 5d84b44a2a2a..a6dad4a2e7a2 100644
> --- a/scripts/kconfig/conf.c
> +++ b/scripts/kconfig/conf.c
> @@ -650,8 +650,7 @@ static void check_conf(struct menu *menu)
>                                 const char *str;
>
>                                 if (sym->type == S_STRING) {
> -                                       str = sym_get_string_value(sym);
> -                                       str = sym_escape_string_value(str);
> +                                       str = sym_escape_string(sym);
>                                         printf("%s%s=%s\n", CONFIG_, sym->name, str);
>                                         free((void *)str);
>                                 } else {
> diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
> index cf72680cd769..4e053f2477f9 100644
> --- a/scripts/kconfig/confdata.c
> +++ b/scripts/kconfig/confdata.c
> @@ -734,8 +734,7 @@ static void conf_write_symbol(FILE *fp, struct symbol *sym,
>         case S_UNKNOWN:
>                 break;
>         case S_STRING:
> -               str = sym_get_string_value(sym);
> -               str = sym_escape_string_value(str);
> +               str = sym_escape_string(sym);
>                 printer->print_symbol(fp, sym, str, printer_arg);
>                 free((void *)str);
>                 break;
> diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
> index a11626bdc421..035cc522808b 100644
> --- a/scripts/kconfig/lkc_proto.h
> +++ b/scripts/kconfig/lkc_proto.h
> @@ -18,7 +18,7 @@ extern struct symbol * symbol_hash[SYMBOL_HASHSIZE];
>
>  struct symbol * sym_lookup(const char *name, int flags);
>  struct symbol * sym_find(const char *name);
> -const char * sym_escape_string_value(const char *in);
> +const char * sym_escape_string(struct symbol *sym);
>  struct symbol ** sym_re_search(const char *pattern);
>  const char * sym_type_name(enum symbol_type type);
>  void sym_calc_value(struct symbol *sym);
> diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
> index 5844d636d38f..4a31bb943f79 100644
> --- a/scripts/kconfig/symbol.c
> +++ b/scripts/kconfig/symbol.c
> @@ -871,13 +871,15 @@ struct symbol *sym_find(const char *name)
>         return symbol;
>  }
>
> -const char *sym_escape_string_value(const char *in)
> +const char *sym_escape_string(struct symbol *sym)
>  {
> -       const char *p;
> +       const char *in, *p;
>         size_t reslen;
>         char *res;
>         size_t l;
>
> +       in = sym_get_string_value(sym);
> +
>         reslen = strlen(in) + strlen("\"\"") + 1;
>
>         p = in;
> --
> 2.26.2
>


-- 
Best Regards
Masahiro Yamada

Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Boris Kolpackov]

Richard Weinberger <richard@nod.at> writes:

> Yes. auto.conf is .config post processed.
> This is exactly where my mitigation takes place.

No, sym_escape_string_value() is called by conf_write_symbol()
which in turn is called from conf_write() and conf_write_defconfig()
(used to write .config files) besides conf_write_autoconf() (used to
write auto.conf).

Re: [PATCH 1/2] kconfig: Refactor sym_escape_string_value

[Masahiro Yamada]

On Mon, Sep 27, 2021 at 9:36 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
>
> On Tue, Sep 21, 2021 at 6:42 AM Richard Weinberger <richard@nod.at> wrote:
> >
> > sym_escape_string_value() can take a struct symbol directly
> > and use sym_get_string_value() itself to obtain the string value.
> > We will need struct symbol later for error reporting.
> >
> > Signed-off-by: Richard Weinberger <richard@nod.at>
> > ---
>
> I think this is a nice clean-up regardless of 2/2.
> Applied to linux-kbuild. Thanks.
>

I changed my mind after all.
I dropped this patch to clean up the code in a different way.


-- 
Best Regards
Masahiro Yamada

Re: [PATCH 1/2] kconfig: Refactor sym_escape_string_value

[Richard Weinberger]

----- Ursprüngliche Mail -----
> Von: "masahiroy" <masahiroy@kernel.org>
> An: "richard" <richard@nod.at>
> CC: "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-kbuild" <linux-kbuild@vger.kernel.org>
> Gesendet: Dienstag, 5. Oktober 2021 17:42:54
> Betreff: Re: [PATCH 1/2] kconfig: Refactor sym_escape_string_value

> On Mon, Sep 27, 2021 at 9:36 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
>>
>> On Tue, Sep 21, 2021 at 6:42 AM Richard Weinberger <richard@nod.at> wrote:
>> >
>> > sym_escape_string_value() can take a struct symbol directly
>> > and use sym_get_string_value() itself to obtain the string value.
>> > We will need struct symbol later for error reporting.
>> >
>> > Signed-off-by: Richard Weinberger <richard@nod.at>
>> > ---
>>
>> I think this is a nice clean-up regardless of 2/2.
>> Applied to linux-kbuild. Thanks.
>>
> 
> I changed my mind after all.
> I dropped this patch to clean up the code in a different way.

Thanks for letting me know!
I noticed already via linux-next.

Thanks,
//richard