02f6a49 Create a namespace for public headers and move audit into it — HardenedBSD-pkg

HardenedBSD-pkg

rad:z3QDZAW2FAfuLvihrhiyDC9fAD8G9

HardenedBSD Package Manager

Create a namespace for public headers and move audit into it

Baptiste Daroussin committed 5 years ago

commit 02f6a4929102ed3994671730b18dd5f6cdc2eb54
parent 7e1ddf8

7 files changed +113 -42

modified libpkg/Makefile.autosetup

@@ -172,9 +172,11 @@ mergelib_script: $(STATIC_LIBS)

 install: all pkg.h lib$(LIB)$(LIBSOEXT) lib$(LIB).a
 	install -d -m 755 $(DESTDIR)$(libdir)
 	install -d -m 755 $(DESTDIR)$(includedir)
 	install -d -m 755 $(DESTDIR)$(includedir)/pkg
 	install -d -m 755 $(DESTDIR)$(pkgconfigdir)
 	install -m 644 lib$(LIB)$(LIBSOEXT) $(DESTDIR)$(libdir)/
 	ln -sf lib$(LIB)$(LIBSOEXT) $(DESTDIR)$(libdir)/lib$(LIB)$(SH_SOEXT)
 	install -m 644 lib$(LIB).a $(DESTDIR)$(libdir)/
 	install -m 644 pkg.h $(DESTDIR)$(includedir)/
 	install -m 644 $(top_srcdir)/libpkg/pkg/audit.h $(DESTDIR)$(includedir)/pkg
 	install -m 644 pkg.pc $(DESTDIR)$(pkgconfigdir)/

modified libpkg/gen-version-script.sh

@@ -1,3 +1,3 @@

 #!/bin/sh
 exctags -f /dev/stdout --c-kinds=fp pkg.h | awk 'BEGIN { print "LIBPKG_1.4 {"; print "global:" } /^[^!]/ { print "\t"$1";" } END { print "# Symbols from libcsu\n\t__progname;\n\tenviron;\nlocal:\n\t*;\n};" }' > libpkg.ver
 exctags -f /dev/stdout --c-kinds=fp pkg.h pkg/*.h | awk 'BEGIN { print "LIBPKG_1.4 {"; print "global:" } /^[^!]/ { print "\t"$1";" } END { print "# Symbols from libcsu\n\t__progname;\n\tenviron;\nlocal:\n\t*;\n};" }' > libpkg.ver

modified libpkg/pkg.h.in

@@ -1629,47 +1629,6 @@ bool pkg_is_locked(const struct pkg * restrict p);

  */
 #define PKG_FILE_CKSUM_CHARS 10
 struct pkg_audit;
 /**
  * Creates new pkg_audit structure
  */
 struct pkg_audit * pkg_audit_new(void);
 /**
  * Fetch and extract audit file from url `src` to the file `dest`
  * If no update is required then this function returns `EPKG_UPTODATE`
  * @return error code
  */
 int pkg_audit_fetch(const char *src, const char *dest);
 /**
  * Load audit file into memory
  * @return error code
  */
 int pkg_audit_load(struct pkg_audit *audit, const char *fname);
 /**
  * Process loaded audit structure.
  * Can and should be executed after cap_enter(3) or another sandboxing call
  * @return error code
  */
 int pkg_audit_process(struct pkg_audit *audit);
 #if defined(__XSTRING_H_)
 /**
  * Check whether `pkg` is vulnerable against processed `audit` structure.
  * If a package is vulnerable, then `result` is set to sbuf describing the
  * vulnerability. If `quiet` is true, then this function produces reduced output
  * just returning a name of vulnerable package.
  * It's caller responsibility to free `result` after use
  * @return true and `*result` is set if a package is vulnerable
  */
 bool pkg_audit_is_vulnerable(struct pkg_audit *audit, struct pkg *pkg,
 		bool quiet, xstring **result, int *affected);
 #endif
 void pkg_audit_free (struct pkg_audit *audit);
 char *pkg_utils_tokenize(char **);
 int pkg_utils_count_spaces(const char *);
 int pkg_add_port(struct pkgdb *db, struct pkg *pkg, const char *root, \

added libpkg/pkg/audit.h

@@ -0,0 +1,107 @@

 /*
  * Copyright (c) 2020 Baptiste Daroussin <bapt@FreeBSD.org>
  * Copyright (c) 2014-2016 Vsevolod Stakhov <vsevolod@FreeBSD.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer
  *    in this position and unchanged.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  */
 #ifndef _PKG_AUDIT_H
 #define _PKG_AUDIT_H
 struct pkg_audit_version {
 	char *version;
 	int type;
 };
 struct pkg_audit_versions_range {
 	struct pkg_audit_version v1;
 	struct pkg_audit_version v2;
 	struct pkg_audit_versions_range *next;
 };
 struct pkg_audit_cve {
 	char *cvename;
 	struct pkg_audit_cve *next;
 };
 struct pkg_audit_pkgname {
 	char *pkgname;
 	struct pkg_audit_pkgname *next;
 };
 struct pkg_audit_package {
 	struct pkg_audit_pkgname *names;
 	struct pkg_audit_versions_range *versions;
 	struct pkg_audit_package *next;
 };
 struct pkg_audit_entry {
 	const char *pkgname;
 	struct pkg_audit_package *packages;
 	struct pkg_audit_pkgname *names;
 	struct pkg_audit_versions_range *versions;
 	struct pkg_audit_cve *cve;
 	char *url;
 	char *desc;
 	char *id;
 	bool ref;
 	struct pkg_audit_entry *next;
 };
 /**
  * Creates new pkg_audit structure
  */
 struct pkg_audit * pkg_audit_new(void);
 /**
  * Fetch and extract audit file from url `src` to the file `dest`
  * If no update is required then this function returns `EPKG_UPTODATE`
  * @return error code
  */
 int pkg_audit_fetch(const char *src, const char *dest);
 /**
  * Load audit file into memory
  * @return error code
  */
 int pkg_audit_load(struct pkg_audit *audit, const char *fname);
 /**
  * Process loaded audit structure.
  * Can and should be executed after cap_enter(3) or another sandboxing call
  * @return error code
  */
 int pkg_audit_process(struct pkg_audit *audit);
 #if defined(__XSTRING_H_)
 /**
  * Check whether `pkg` is vulnerable against processed `audit` structure.
  * If a package is vulnerable, then `result` is set to sbuf describing the
  * vulnerability. If `quiet` is true, then this function produces reduced output
  * just returning a name of vulnerable package.
  * It's caller responsibility to free `result` after use
  * @return true and `*result` is set if a package is vulnerable
  */
 bool pkg_audit_is_vulnerable(struct pkg_audit *audit, struct pkg *pkg,
 		bool quiet, xstring **result, int *affected);
 #endif
 void pkg_audit_free(struct pkg_audit *audit);
 #endif

modified src/Makefile.autosetup

@@ -39,6 +39,7 @@ SRCS= add.c \

 LOCAL_CFLAGS=	-I$(top_srcdir)/external/uthash \
 		-I$(top_srcdir)/compat \
 		-I$(top_srcdir)/external/libucl/klib \
 		-I$(top_srcdir)/external/libucl/include \
 		-I$(top_builddir)/ \
 		-I$(top_builddir)/libpkg \
 		-DGITHASH=\"@GITHASH@\" \

modified src/audit.c

@@ -55,6 +55,7 @@

 #endif
 #include <pkg.h>
 #include <pkg/audit.h>
 #include "pkgcli.h"
 void

modified src/upgrade.c

@@ -50,6 +50,7 @@

 #include <sys/capsicum.h>
 #endif
 #include "pkgcli.h"
 #include <pkg/audit.h>
 static const char vuln_end_lit[] = "**END**";