| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
guaranteed not to break on openbsd (tm)
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
same fix i did for lbutils
the nvmutil version is the same one used before
lbutils was introduced. just before.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
i'm trying to make nvmutil work on openbsd. the new code
in lbutils is a bit buggy, likely somewhere in mkhtemp.
i'm still debugging it.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
This will also be used in lbmk itself at some point,
which currently just uses regular mktemp, for tmpdir
handling during the build process.
Renamed util/nvmutil to util/libreboot-utils, which
now contains two tools. The new tool, mkhtemp, is a
hardened implementation of mktemp, which nvmutil
also uses now. Still experimental, but good enough
for nvmutil.
Mkhtemp attempts to provide TOCTOU resistance on
Linux, by using modern features in Linux such as
Openat2 (syscall) with O_EXCL and O_TMPFILE,
and many various security checks e.g.
inode/dev during creation. Checks are done constantly,
to try to detect race conditions. The code is very
strict about things like sticky bits in world writeable
directories, also ownership (it can be made to bar even
root access on files and directories it doesn't own).
It's a security-first implementation of mktemp, likely
even more secure than the OpenBSD mkstemp, but more
auditing and testing is needed - more features are
also planned, including a compatibility mode to make
it also work like traditional mktemp/mkstemp. The
intention, once this becomes stable, is that it will
become a modern drop-in replacement for mkstemp on
Linux and BSD systems.
Some legacy code has been removed, and in general
cleaned up. I wrote mkhtemp for nvmutil, as part of
its atomic write behaviour, but mktemp was the last
remaining liability, so I rewrote that too!
Docs/manpage/website will be made for mkhtemp once
the code is mature.
Other changes have also been made. This is from another
experimental branch of Libreboot, that I'm pushing
early. For example, nvmutil's state machine has been
tidied up, moving more logic back into main.
Mktemp is historically prone to race conditions,
e.g. symlink attacks, directory replacement, remounting
during operation, all sorts of things. Mkhtemp has
been written to solve, or otherwise mitigate, that
problem. Mkhtemp is currently experimental and will
require a major cleanup at some point, but it
already works well enough, and you can in fact use
it; at this time, the -d, -p and -q flags are
supported, and you can add a custom template at
the end, e.g.
mkhtemp -p test -d
Eventually, I will make this have complete parity
with the GNU and BSD implementations, so that it is
fully useable on existing setups, while optionally
providing the hardening as well.
A lot of code has also been tidied up. I didn't
track the changes I made with this one, because
it was a major re-write of nvmutil; it is now
libreboot-utils, and I will continue to write
more programs in here over time. It's basically
now a bunch of hardened wrappers around various
libc functions, e.g. there is also a secure I/O
wrapper for read/write.
There is a custom randomisation function, rlong,
which simply uses arc4random or getrandom, on
BSD and Linux respectively. Efforts are made to
make it as reliable as possible, to the extent
that it never returns with failure; in the unlikely
event that it fails, it aborts. It also sleeps
between failure, to mitigate certain DoS attacks.
You can just go in util/libreboot-utils and
type make, then you will have the nvmutil and
mkhtemp binaries, which you can just use. It
all works. Everything was massively rewritten.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
only keep nvmutil.c in main
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
question mark respects environmental variables
but isn't portable
you can just pass as argument on the command line
question mark is more useful for build systems,
but i'm not really bothered. the old way works.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
this is a big program now. act like it.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
older compilers might not have -std for example.
the code is portable, but old compilers can't
compile with just "make", you have to add lots
of flags
i will now use "make strict" and "make hell"
in testing, but otherwise make without flags
are fine.
move the current strictness to command:
make strict
added an extra command:
make hell
hell uses -Weverything, and is useful with
clang's strict testing, on which i only got
a very small number of errors (it's way less
than a lot of programs would get with this
flag, because -Weverything is REALLY STRICT):
ja, mich nvmutil$ make hell CC=clang
clang -I. -Wall -Wextra -pedantic -std=c90 -Os -Werror -Weverything nvmutil.c -o nvmutil
In file included from nvmutil.c:35:
./nvmutil.h:225:16: error: padding struct 'struct commands' with 1 byte to align 'rw_size' [-Werror,-Wpadded]
225 | unsigned long rw_size; /* within the 4KB GbE part */
| ^
./nvmutil.h:217:8: error: padding size of 'struct commands' with 4 bytes to alignment boundary [-Werror,-Wpadded]
217 | struct commands {
| ^
./nvmutil.h:235:8: error: padding size of 'struct xfile' with 4 bytes to alignment boundary [-Werror,-Wpadded]
235 | struct xfile {
| ^
./nvmutil.h:288:16: error: padding struct 'struct xstate' with 4 bytes to align 'xsize' [-Werror,-Wpadded]
288 | unsigned long xsize;
| ^
nvmutil.c:617:43: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
617 | _r = rw_file_exact(f->gbe_fd, f->buf, f->gbe_file_size,
| ~~~~~~~~~~~~~ ~~~^~~~~~~~~~~~~
nvmutil.c:626:43: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
626 | _r = rw_file_exact(f->tmp_fd, f->buf, f->gbe_file_size,
| ~~~~~~~~~~~~~ ~~~^~~~~~~~~~~~~
nvmutil.c:654:46: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
654 | _r = rw_file_exact(f->tmp_fd, f->bufcmp, f->gbe_file_size,
| ~~~~~~~~~~~~~ ~~~^~~~~~~~~~~~~
nvmutil.c:661:39: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
661 | if (x_i_memcmp(f->buf, f->bufcmp, f->gbe_file_size) != 0)
| ~~~~~~~~~~ ~~~^~~~~~~~~~~~~
nvmutil.c:702:23: error: implicit conversion loses integer precision: 'int' to 'unsigned char' [-Werror,-Wimplicit-int-conversion]
702 | f->part_valid[_p] = good_checksum(_p);
| ~ ^~~~~~~~~~~~~~~~~
nvmutil.c:1045:21: error: implicit conversion loses integer precision: 'int' to 'unsigned char' [-Werror,-Wimplicit-int-conversion]
1045 | f->part_valid[0] = good_checksum(0);
| ~ ^~~~~~~~~~~~~~~~
nvmutil.c:1046:21: error: implicit conversion loses integer precision: 'int' to 'unsigned char' [-Werror,-Wimplicit-int-conversion]
1046 | f->part_valid[1] = good_checksum(1);
| ~ ^~~~~~~~~~~~~~~~
nvmutil.c:1170:45: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
1170 | (unsigned long)(p * (f->gbe_file_size >> 1)));
| ~ ~~~~~~~~~~~~~~~~~^~~~
nvmutil.c:1269:37: error: implicit conversion loses integer precision: 'int' to 'unsigned short' [-Werror,-Wimplicit-int-conversion]
1269 | return (unsigned short)f->buf[pos] |
| ~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
1270 | ((unsigned short)f->buf[pos + 1] << 8);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvmutil.c:1610:9: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
1609 | r = rw_file_exact(f->tmp_fd, f->bufcmp,
| ~~~~~~~~~~~~~
1610 | f->gbe_file_size, 0, IO_PREAD,
| ~~~^~~~~~~~~~~~~
nvmutil.c:1618:9: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
1617 | r = rw_file_exact(dest_fd, f->bufcmp,
| ~~~~~~~~~~~~~
1618 | f->gbe_file_size, 0, IO_PWRITE,
| ~~~^~~~~~~~~~~~~
nvmutil.c:1609:6: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
1609 | r = rw_file_exact(f->tmp_fd, f->bufcmp,
| ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1610 | f->gbe_file_size, 0, IO_PREAD,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1611 | NO_LOOP_EAGAIN, LOOP_EINTR,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
1612 | MAX_ZERO_RW_RETRY, OFF_ERR);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvmutil.c:1617:6: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
1617 | r = rw_file_exact(dest_fd, f->bufcmp,
| ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1618 | f->gbe_file_size, 0, IO_PWRITE,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1619 | NO_LOOP_EAGAIN, LOOP_EINTR,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
1620 | MAX_ZERO_RW_RETRY, OFF_ERR);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvmutil.c:1936:45: error: implicit conversion changes signedness: 'long' to 'unsigned long' [-Werror,-Wsign-conversion]
1936 | if (rv >= 0 && (unsigned long)rv > (nrw - rc))
| ~ ^~
nvmutil.c:2193:27: error: signed shift result (0x8000000000000000) sets the sign bit of the shift expression's type ('long') and becomes negative [-Werror,-Wshift-sign-overflow]
2193 | if (nrw > (unsigned long)X_LONG_MAX)
| ^~~~~~~~~~
./nvmutil.h:147:38: note: expanded from macro 'X_LONG_MAX'
147 | #define X_LONG_MAX ((long)(~((long)1 << (sizeof(long)*CHAR_BIT-1))))
| ~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~
fatal error: too many errors emitted, stopping now [-ferror-limit=]
20 errors generated.
make: *** [Makefile:42: hell] Fehler 1
in a future commit, i intend to fix all of these issues,
so that the code reliably compiles in hell-mode.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
not compiling without it is a bug
don't let the default exclude it
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
settting it to -Werror is wrong, should set
it not -Werror.
however, put the WERROR variable in the make
command. that way, i could test with
make WERROR=-Werror
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
i need these. can always turn them off
when running make if you need to
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
-Werror removed, for older compilers
actual warnings still there
-std is configurable now
e.g.
make CSTD=-c90
make CSTD=-c99
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
one for directory, then copy the binary
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
forgot to include the binary in the path
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
-p isn't portable
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
yeah, why not use a tool that's been around since the
80s?
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
also support LDFLAGS
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
with the other changes made recently, super old
compilers now work.
yes, i needed to change some specifiers in printf.
typedefs provided for uint, and a define included
X OPEN SOURCE 500. and asserts for integers.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
that option there is already defined in the code
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
explicitly declare the directory path for the given
file (nvmutil), otherwise it's implementation-defined;
on some systems, /bin/nvmutil means a directory named
nvmutil could then contain nvmutil.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
I also needed: #define _POSIX_C_SOURCE 200809L
I use -pedantic with -Wall -Wextra -Werror, which
forces very strict error handling and ISO C; this
means pread and pwrite aren't available.
The define fixes this.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
a package manager by the name "nvm" exists, as
i discovered.
this is a courtesy to them.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Don't assume "install" is the correct command.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
The user might wish to uninstall, but not remove the
build that they just did.
The user can still do make clean if they wish.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
DESTDIR is the root directory where it goes, which
is normally an empty string; PREFIX is where the
bin directory is located, relative to DESTDIR
Default to /usr/local for PREFIX, not /usr, because
/usr/bin is for system utilities.
nvmutil is a local utility.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
We don't want to clobber anything that the user set themselves.
Instead, we should respect the user's choice.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
Signed-off-by: Riku Viitanen <riku.viitanen@protonmail.com>
|
|
make install is nice to have. now respects$(PREFIX) as well.
Signed-off-by: Riku Viitanen <riku.viitanen@protonmail.com>
|
|
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
also, some of them were out of date; years now updated.
Signed-off-by: Leah Rowe <leah@libreboot.org>
|
|
|
