[PATCH] devtool: deploy-target: support "unsafe" symlinks

[PATCH] devtool: deploy-target: support "unsafe" symlinks

[Olaf Mandel]

The bosybox version of tar considers symlink targets that start with /
or with ../ to be unsafe and refuses to unpack them unless the
EXTRACT_UNSAFE_SYMLINKS environment variable is set to 1.

As even many core packages legitimately contain such links (e.g.
coreutils-locale-*, dropbear, eudev, initscripts, kmod, ...), add the
environment variable to the remote script.
---
 scripts/lib/devtool/deploy.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/lib/devtool/deploy.py b/scripts/lib/devtool/deploy.py
index f345f31b7b..9617388f90 100644
--- a/scripts/lib/devtool/deploy.py
+++ b/scripts/lib/devtool/deploy.py
@@ -114,6 +114,7 @@ def _prepare_remote_script(deploy, verbose=False, dryrun=False, undeployall=Fals
             lines.append('rm $3')
         lines.append('mkdir -p `dirname $manifest`')
         lines.append('mkdir -p $2')
+        lines.append('export EXTRACT_UNSAFE_SYMLINKS=1')
         if verbose:
             lines.append('    tar xv -C $2 -f - | tee $manifest')
         else:
-- 
2.11.0

Re: [PATCH] devtool: deploy-target: support "unsafe" symlinks

[Andre McCurdy]

On Tue, Feb 26, 2019 at 1:40 AM Olaf Mandel <o.mandel@menlosystems.com> wrote:
>
> The bosybox version of tar considers symlink targets that start with /
> or with ../ to be unsafe and refuses to unpack them unless the
> EXTRACT_UNSAFE_SYMLINKS environment variable is set to 1.
>
> As even many core packages legitimately contain such links (e.g.
> coreutils-locale-*, dropbear, eudev, initscripts, kmod, ...), add the
> environment variable to the remote script.

Upstream Busybox seems to have a different solution, so perhaps worth
adding a comment that EXTRACT_UNSAFE_SYMLINKS is a temporary /
version-specific fix.

  https://git.busybox.net/busybox/commit/?h=1_28_stable&id=37277a23fe48b13313f5d96084d890ed21d5fd8b

> ---
>  scripts/lib/devtool/deploy.py | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/scripts/lib/devtool/deploy.py b/scripts/lib/devtool/deploy.py
> index f345f31b7b..9617388f90 100644
> --- a/scripts/lib/devtool/deploy.py
> +++ b/scripts/lib/devtool/deploy.py
> @@ -114,6 +114,7 @@ def _prepare_remote_script(deploy, verbose=False, dryrun=False, undeployall=Fals
>              lines.append('rm $3')
>          lines.append('mkdir -p `dirname $manifest`')
>          lines.append('mkdir -p $2')
> +        lines.append('export EXTRACT_UNSAFE_SYMLINKS=1')
>          if verbose:
>              lines.append('    tar xv -C $2 -f - | tee $manifest')
>          else:
> --
> 2.11.0
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

[PATCH v2] devtool: deploy-target: support "unsafe" symlinks

[Olaf Mandel]

The bosybox version of tar in sumo considers symlink targets that start
with / or with ../ to be unsafe and refuses to unpack them unless the
EXTRACT_UNSAFE_SYMLINKS environment variable is set to 1.

As even many core packages legitimately contain such links (e.g.
coreutils-locale-*, dropbear, eudev, initscripts, kmod, ...), add the
environment variable to the remote script.
---
 scripts/lib/devtool/deploy.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/lib/devtool/deploy.py b/scripts/lib/devtool/deploy.py
index f345f31b7b..dc9b34e0ee 100644
--- a/scripts/lib/devtool/deploy.py
+++ b/scripts/lib/devtool/deploy.py
@@ -114,6 +114,11 @@ def _prepare_remote_script(deploy, verbose=False, dryrun=False, undeployall=Fals
             lines.append('rm $3')
         lines.append('mkdir -p `dirname $manifest`')
         lines.append('mkdir -p $2')
+        # Busybox tar v1.28.x (plus v1.27.2 with the CVE-2011-5325 patch)
+        # requires this env variable. The first release without this issue
+        # is thud.
+        # FIXME Remove once sumo goes out of support
+        lines.append('export EXTRACT_UNSAFE_SYMLINKS=1')
         if verbose:
             lines.append('    tar xv -C $2 -f - | tee $manifest')
         else:
-- 
2.11.0

Re: [PATCH v2] devtool: deploy-target: support "unsafe" symlinks

[Richard Purdie]

On Wed, 2019-02-27 at 09:10 +0000, Olaf Mandel wrote:
> The bosybox version of tar in sumo considers symlink targets that
> start
> with / or with ../ to be unsafe and refuses to unpack them unless the
> EXTRACT_UNSAFE_SYMLINKS environment variable is set to 1.
> 
> As even many core packages legitimately contain such links (e.g.
> coreutils-locale-*, dropbear, eudev, initscripts, kmod, ...), add the
> environment variable to the remote script.
> ---
>  scripts/lib/devtool/deploy.py | 5 +++++
>  1 file changed, 5 insertions(+)

I'm tempted to suggest we backport changes to busybox in sumo to
address this...

Cheers,

Richard

>