[PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
---
 meta/recipes-support/ca-certificates/ca-certificates_20161130.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20161130.bb b/meta/recipes-support/ca-certificates/ca-certificates_20161130.bb
index 9a80f43..771714d 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20161130.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20161130.bb
@@ -72,7 +72,7 @@ CONFFILES_${PN} += "${sysconfdir}/ca-certificates.conf"
 # Postinsts don't seem to be run for nativesdk packages when populating SDKs.
 CONFFILES_${PN}_append_class-nativesdk = " ${sysconfdir}/ssl/certs/ca-certificates.crt"
 do_install_append_class-nativesdk () {
-    SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
+    SYSROOT="${D}${SDKPATHNATIVE}" ${D}${sbindir}/update-ca-certificates
 }
 
 do_install_append_class-native () {
-- 
2.1.4

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Richard Purdie]

On Thu, 2017-08-17 at 16:44 +0200, Andrej Valek wrote:
> Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
> ---
>  meta/recipes-support/ca-certificates/ca-certificates_20161130.bb | 2
> +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/meta/recipes-support/ca-certificates/ca-
> certificates_20161130.bb b/meta/recipes-support/ca-certificates/ca-
> certificates_20161130.bb
> index 9a80f43..771714d 100644
> --- a/meta/recipes-support/ca-certificates/ca-
> certificates_20161130.bb
> +++ b/meta/recipes-support/ca-certificates/ca-
> certificates_20161130.bb
> @@ -72,7 +72,7 @@ CONFFILES_${PN} += "${sysconfdir}/ca-
> certificates.conf"
>  # Postinsts don't seem to be run for nativesdk packages when
> populating SDKs.
>  CONFFILES_${PN}_append_class-nativesdk = "
> ${sysconfdir}/ssl/certs/ca-certificates.crt"
>  do_install_append_class-nativesdk () {
> -    SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
> +    SYSROOT="${D}${SDKPATHNATIVE}" ${D}${sbindir}/update-ca-
> certificates
>  }
>  
>  do_install_append_class-native () {

Since the HOSTTOOLS changes, this should no longer be needed?

Cheers,

Richard

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

Yes, for actual branch is not required. But for branches like krogoth
and morty, where HOSTTOOLS is not implemented, is this necessary.

Andrej

On 08/17/2017 06:31 PM, Richard Purdie wrote:
> On Thu, 2017-08-17 at 16:44 +0200, Andrej Valek wrote:
>> Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
>> ---
>>  meta/recipes-support/ca-certificates/ca-certificates_20161130.bb | 2
>> +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/meta/recipes-support/ca-certificates/ca-
>> certificates_20161130.bb b/meta/recipes-support/ca-certificates/ca-
>> certificates_20161130.bb
>> index 9a80f43..771714d 100644
>> --- a/meta/recipes-support/ca-certificates/ca-
>> certificates_20161130.bb
>> +++ b/meta/recipes-support/ca-certificates/ca-
>> certificates_20161130.bb
>> @@ -72,7 +72,7 @@ CONFFILES_${PN} += "${sysconfdir}/ca-
>> certificates.conf"
>>  # Postinsts don't seem to be run for nativesdk packages when
>> populating SDKs.
>>  CONFFILES_${PN}_append_class-nativesdk = "
>> ${sysconfdir}/ssl/certs/ca-certificates.crt"
>>  do_install_append_class-nativesdk () {
>> -    SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
>> +    SYSROOT="${D}${SDKPATHNATIVE}" ${D}${sbindir}/update-ca-
>> certificates
>>  }
>>  
>>  do_install_append_class-native () {
> 
> Since the HOSTTOOLS changes, this should no longer be needed?
> 
> Cheers,
> 
> Richard
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Richard Purdie]

On Fri, 2017-08-18 at 08:26 +0200, Andrej Valek wrote:
> Yes, for actual branch is not required. But for branches like krogoth
> and morty, where HOSTTOOLS is not implemented, is this necessary.

Lets just apply this to krogoth/morty then...

Cheers,

Richard

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

OK thank You, so please merge it into these branches.

Regards,
Andrej

On 08/18/2017 11:35 AM, Richard Purdie wrote:
> On Fri, 2017-08-18 at 08:26 +0200, Andrej Valek wrote:
>> Yes, for actual branch is not required. But for branches like krogoth
>> and morty, where HOSTTOOLS is not implemented, is this necessary.
> 
> Lets just apply this to krogoth/morty then...
> 
> Cheers,
> 
> Richard
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Randy MacLeod]

On 2017-08-18 06:05 AM, Andrej Valek wrote:
> OK thank You, so please merge it into these branches.

Add Armin, who maintains those branches:
    https://wiki.yoctoproject.org/wiki/Releases
Is Krogoth still maintained? It's listed at Stable in the link above.

../Randy



> 
> Regards,
> Andrej
> 
> On 08/18/2017 11:35 AM, Richard Purdie wrote:
>> On Fri, 2017-08-18 at 08:26 +0200, Andrej Valek wrote:
>>> Yes, for actual branch is not required. But for branches like krogoth
>>> and morty, where HOSTTOOLS is not implemented, is this necessary.
>>
>> Lets just apply this to krogoth/morty then...
>>
>> Cheers,
>>
>> Richard
>>


-- 
# Randy MacLeod. SMTS, Linux, Wind River
Direct: 613.963.1350 | 350 Terry Fox Drive, Suite 200, Ottawa, ON, 
Canada, K2K 2W5

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

Hello Armin,

Could You please merge it into krogoth and morty branch?

@Randy: last commit into those branches was ~5weeks ago, so they are
still maintained.

Regards,
Andrej

On 08/18/2017 05:46 PM, Randy MacLeod wrote:
> On 2017-08-18 06:05 AM, Andrej Valek wrote:
>> OK thank You, so please merge it into these branches.
> 
> Add Armin, who maintains those branches:
>     https://wiki.yoctoproject.org/wiki/Releases
> Is Krogoth still maintained? It's listed at Stable in the link above.
> 
> ../Randy
> 
> 
> 
>>
>> Regards,
>> Andrej
>>
>> On 08/18/2017 11:35 AM, Richard Purdie wrote:
>>> On Fri, 2017-08-18 at 08:26 +0200, Andrej Valek wrote:
>>>> Yes, for actual branch is not required. But for branches like krogoth
>>>> and morty, where HOSTTOOLS is not implemented, is this necessary.
>>>
>>> Lets just apply this to krogoth/morty then...
>>>
>>> Cheers,
>>>
>>> Richard
>>>
> 
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

Hello Richard,

I have found out that even master with HOSTTOOLS does not fix my problem.
We use ASSUME_PROVIDED for ca-certificates-native due to corporate
environment CAs.
Since nativesdk-ca-certificates depends on ca-certificates-native which
is not built, so it could not be found.
Unfortunately adding update-ca-certificates to HOSTTOOLS is not working,
since build user does not have permissions to modify system CAs and also
is in /usr/sbin/ which is not in usual system path.

Therefore I think that this patch applies for master branch, too.
Possible improvement would be also removing ca-certificates-native from
DEPENDS of class-nativesdk.

Solution of installing corporate CAs within OE recipe does not seem to
be ideal, because the CAs have short expiration date. So using system
CAs assures reachability of resources over https.
We had to do this because svn fetcher uses https without option to
ignore errors (unlike wget which ignores certificates by default).

Regards,
Andrej

On 08/21/2017 08:12 AM, [ext] Andrej Valek wrote:
> Hello Armin,
> 
> Could You please merge it into krogoth and morty branch?
> 
> @Randy: last commit into those branches was ~5weeks ago, so they are
> still maintained.
> 
> Regards,
> Andrej
> 
> On 08/18/2017 05:46 PM, Randy MacLeod wrote:
>> On 2017-08-18 06:05 AM, Andrej Valek wrote:
>>> OK thank You, so please merge it into these branches.
>>
>> Add Armin, who maintains those branches:
>>     https://wiki.yoctoproject.org/wiki/Releases
>> Is Krogoth still maintained? It's listed at Stable in the link above.
>>
>> ../Randy
>>
>>
>>
>>>
>>> Regards,
>>> Andrej
>>>
>>> On 08/18/2017 11:35 AM, Richard Purdie wrote:
>>>> On Fri, 2017-08-18 at 08:26 +0200, Andrej Valek wrote:
>>>>> Yes, for actual branch is not required. But for branches like krogoth
>>>>> and morty, where HOSTTOOLS is not implemented, is this necessary.
>>>>
>>>> Lets just apply this to krogoth/morty then...
>>>>
>>>> Cheers,
>>>>
>>>> Richard
>>>>
>>
>>

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Richard Purdie]

On Wed, 2017-08-23 at 14:07 +0200, Andrej Valek wrote:
> I have found out that even master with HOSTTOOLS does not fix my
> problem.
> We use ASSUME_PROVIDED for ca-certificates-native due to corporate
> environment CAs.
> Since nativesdk-ca-certificates depends on ca-certificates-native
> whichis not built, so it could not be found. Unfortunately adding
> update-ca-certificates to HOSTTOOLS is not working, since build user
> does not have permissions to modify system CAs and also is in
> /usr/sbin/ which is not in usual system path.
> 
> Therefore I think that this patch applies for master branch, too.
> Possible improvement would be also removing ca-certificates-native
> from DEPENDS of class-nativesdk.
> 
> Solution of installing corporate CAs within OE recipe does not seem
> to be ideal, because the CAs have short expiration date. So using
> system CAs assures reachability of resources over https.
> We had to do this because svn fetcher uses https without option to
> ignore errors (unlike wget which ignores certificates by default).

Reading this made me realise this is a pretty complex issue. In general
we cannot assume that we can execute nativesdk binaries. Since ca-
certificates is allarch and we're executing an sh script, this is less
of an issue in this very specific case. There is a binary involved,
c_rehash and we do need to make sure there are the right -native
dependencies to get that.

There is a further complication with regard to the paths used, ca-
certificates-native will use one set of paths, nativesdk-ca-
certificates will use a different set and target ca-certificates a
differnt set again.

I suspect you're right and the ca-certificates-native dependency may be
incorrect and the certs installed into sdks may be broken too. If the
native sysroot and target sysroot layouts don't match, that would cause
an additional source of errors.

So some changes in this area does appear to be needed...

Cheers,

Richard

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Khem Raj]

On 8/23/17 5:44 AM, Richard Purdie wrote:
> On Wed, 2017-08-23 at 14:07 +0200, Andrej Valek wrote:
>> I have found out that even master with HOSTTOOLS does not fix my
>> problem.
>> We use ASSUME_PROVIDED for ca-certificates-native due to corporate
>> environment CAs.
>> Since nativesdk-ca-certificates depends on ca-certificates-native
>> whichis not built, so it could not be found. Unfortunately adding
>> update-ca-certificates to HOSTTOOLS is not working, since build user
>> does not have permissions to modify system CAs and also is in
>> /usr/sbin/ which is not in usual system path.
>>
>> Therefore I think that this patch applies for master branch, too.
>> Possible improvement would be also removing ca-certificates-native
>> from DEPENDS of class-nativesdk.
>>
>> Solution of installing corporate CAs within OE recipe does not seem
>> to be ideal, because the CAs have short expiration date. So using
>> system CAs assures reachability of resources over https.
>> We had to do this because svn fetcher uses https without option to
>> ignore errors (unlike wget which ignores certificates by default).
> 
> Reading this made me realise this is a pretty complex issue. In general
> we cannot assume that we can execute nativesdk binaries. Since ca-
> certificates is allarch and we're executing an sh script, this is less
> of an issue in this very specific case. There is a binary involved,
> c_rehash and we do need to make sure there are the right -native
> dependencies to get that.


c_rehash comes from openssl-native in this case.

> 
> There is a further complication with regard to the paths used, ca-
> certificates-native will use one set of paths, nativesdk-ca-
> certificates will use a different set and target ca-certificates a
> differnt set again.
> 
> I suspect you're right and the ca-certificates-native dependency may be
> incorrect and the certs installed into sdks may be broken too. If the
> native sysroot and target sysroot layouts don't match, that would cause
> an additional source of errors.
> 
> So some changes in this area does appear to be needed...
> 
> Cheers,
> 
> Richard
> 
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

What about enabling ASSUME_PROVIDED functionality also for nativesdk-
components?

Andrej

On 08/23/2017 09:00 PM, Khem Raj wrote:
> On 8/23/17 5:44 AM, Richard Purdie wrote:
>> On Wed, 2017-08-23 at 14:07 +0200, Andrej Valek wrote:
>>> I have found out that even master with HOSTTOOLS does not fix my
>>> problem.
>>> We use ASSUME_PROVIDED for ca-certificates-native due to corporate
>>> environment CAs.
>>> Since nativesdk-ca-certificates depends on ca-certificates-native
>>> whichis not built, so it could not be found. Unfortunately adding
>>> update-ca-certificates to HOSTTOOLS is not working, since build user
>>> does not have permissions to modify system CAs and also is in
>>> /usr/sbin/ which is not in usual system path.
>>>
>>> Therefore I think that this patch applies for master branch, too.
>>> Possible improvement would be also removing ca-certificates-native
>>> from DEPENDS of class-nativesdk.
>>>
>>> Solution of installing corporate CAs within OE recipe does not seem
>>> to be ideal, because the CAs have short expiration date. So using
>>> system CAs assures reachability of resources over https.
>>> We had to do this because svn fetcher uses https without option to
>>> ignore errors (unlike wget which ignores certificates by default).
>>
>> Reading this made me realise this is a pretty complex issue. In general
>> we cannot assume that we can execute nativesdk binaries. Since ca-
>> certificates is allarch and we're executing an sh script, this is less
>> of an issue in this very specific case. There is a binary involved,
>> c_rehash and we do need to make sure there are the right -native
>> dependencies to get that.
> 
> 
> c_rehash comes from openssl-native in this case.
> 
>>
>> There is a further complication with regard to the paths used, ca-
>> certificates-native will use one set of paths, nativesdk-ca-
>> certificates will use a different set and target ca-certificates a
>> differnt set again.
>>
>> I suspect you're right and the ca-certificates-native dependency may be
>> incorrect and the certs installed into sdks may be broken too. If the
>> native sysroot and target sysroot layouts don't match, that would cause
>> an additional source of errors.
>>
>> So some changes in this area does appear to be needed...
>>
>> Cheers,
>>
>> Richard
>>
>>
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Richard Purdie]

On Thu, 2017-08-24 at 12:38 +0200, Andrej Valek wrote:
> What about enabling ASSUME_PROVIDED functionality also for nativesdk-
> components?

That would mean something quite different, that the dependency was
provided on the system the nativesdk package ended up running on?

Since I've spent the time to understand the problem, I wrote and sent
out a patch which I think should address the issues you're seeing?

Cheers,

Richard

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

I have seen your patch, but it is not fixing my described issue.
A command update-ca-certificates will be not available due to missing
native stuff.

Regards,
Andrej

On 08/24/2017 04:16 PM, Richard Purdie wrote:
> On Thu, 2017-08-24 at 12:38 +0200, Andrej Valek wrote:
>> What about enabling ASSUME_PROVIDED functionality also for nativesdk-
>> components?
> 
> That would mean something quite different, that the dependency was
> provided on the system the nativesdk package ended up running on?
> 
> Since I've spent the time to understand the problem, I wrote and sent
> out a patch which I think should address the issues you're seeing?
> 
> Cheers,
> 
> Richard
> 
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Richard Purdie]

On Thu, 2017-08-24 at 16:23 +0200, Andrej Valek wrote:
> I have seen your patch, but it is not fixing my described issue.
> A command update-ca-certificates will be not available due to missing
> native stuff.

I changed the postinst so it doesn't need a native update-ca-
certificates though?

Its similar to one of your original patches but fixes the dependency
issues and explains why the current approach is broken (path mismatch)
and why its safe to do this (allarch recipe and script).

Cheers,

Richard

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

It's fine, but for this function

do_install_append_class-nativesdk () {
    SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
}

is still update-ca-certificates needed from native.

On 08/24/2017 04:26 PM, Richard Purdie wrote:
> On Thu, 2017-08-24 at 16:23 +0200, Andrej Valek wrote:
>> I have seen your patch, but it is not fixing my described issue.
>> A command update-ca-certificates will be not available due to missing
>> native stuff.
> 
> I changed the postinst so it doesn't need a native update-ca-
> certificates though?
> 
> Its similar to one of your original patches but fixes the dependency
> issues and explains why the current approach is broken (path mismatch)
> and why its safe to do this (allarch recipe and script).
> 
> Cheers,
> 
> Richard
> 

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Richard Purdie]

On Fri, 2017-08-25 at 08:05 +0200, Andrej Valek wrote:
> It's fine, but for this function
> 
> do_install_append_class-nativesdk () {
>     SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
> }
> 
> is still update-ca-certificates needed from native.

I realised that in testing and have updated the version in master-next
which passed testing this time.

Cheers,

Richard

Re: [PATCH] ca-certificates: prevent executing update-ca-certificates from host system

[Andrej Valek]

Hello Richard,

I have seen, that You have merge also my change into current branch.

Thank you about that.
Andrej

On 08/25/2017 10:25 AM, Richard Purdie wrote:
> On Fri, 2017-08-25 at 08:05 +0200, Andrej Valek wrote:
>> It's fine, but for this function
>>
>> do_install_append_class-nativesdk () {
>>     SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
>> }
>>
>> is still update-ca-certificates needed from native.
> 
> I realised that in testing and have updated the version in master-next
> which passed testing this time.
> 
> Cheers,
> 
> Richard
>