August 2021 - Pacman-dev - lists.archlinux.org

[pacman-dev] [PATCH] Add optional sandboxing when downloading files
by Remi Gacogne 10 Oct '21

10 Oct '21

[re-sending because my initial e-mail was rejected by spam filters, sorry!] Hi all, I would like to get some feedback on a optional sandboxing feature I would like to implement in pacman. The gist of it is to use a separate process for some sensitive operations, like downloading files, and to restrict the privileges of that process to reduce the risk of an exploitable bug turning into a code execution with full root privileges. I'm not too worried about the pacman code itself, but downloading files over the internet involves parsing HTTP payloads, as well as parsing X.509 certificates and doing cryptographic operations when HTTPS is used, which is more error-prone. For what it's worth, Debian's APT has similar options hidden behind the APT::Sandbox::Seccomp and APT::Sandbox::User parameters. The attached patch is clearly not in a finished state, but provides more details about the kind of changes needed to support this new feature. In a nutshell, what it currently does is that if the UseSandbox option is not set nothing changes. Otherwise internal and external downloads trigger the spawning of a new process, via fork(), whose result is communicated to the main process via a pipe, as is already done today for external downloads. Then: - If available, PR_SET_NO_NEW_PRIVS is called to ensure that the downloader will not be able to gain new privileges in the future, for example by executing a set-uid program. - If pacman has been built with libseccomp support and the kernel supports it, a list of system calls that are clearly of no use to a regular process downloading files is denied via a seccomp filter. That list is currently hard-coded but it would make more sense to make it configurable. - If the SandboxUser option is set to a valid user, the downloader process switches to that user via setgid, setgroups and setuid, dropping root privileges. This part requires making the download folder owned by that user. - If pacman has been built with libcap support and the downloader process still has privileged capabilities at this point, these are dropped. - If pacman has been built with landlock support (requires an updated linux-api-headers, >= 5.13) and the kernel supports it, the whole filesystem is set read-only with the exception of /tmp and DBPath. The list of writable paths is currently hard-coded but it would make sense to make it configurable as well. Any feedback will be welcome. Please be aware that I tried to keep the new code in line with the coding style and contributing guidelines but I'm not familiar with pacman's source code so I'm sure I did not do everything the right way, and that this code can be improved. What I would like to know first is whether there is any interest in that feature, then to get feedback about the "big picture" part of the design. If there is indeed interest and my approach is somewhat sane, then I can work on making the code less ugly, write the much needed documentation for the new feature and related options, and improve the logging of errors. Thanks! Remi Signed-off-by: Remi Gacogne <rgacogne(a)archlinux.org> --- lib/libalpm/alpm.h | 10 ++ lib/libalpm/alpm_sandbox.c | 341 +++++++++++++++++++++++++++++++++++++ lib/libalpm/alpm_sandbox.h | 31 ++++ lib/libalpm/dload.c | 83 ++++++++- lib/libalpm/handle.c | 20 +++ lib/libalpm/handle.h | 2 + lib/libalpm/meson.build | 1 + meson.build | 11 +- src/pacman/conf.c | 23 ++- src/pacman/conf.h | 2 + src/pacman/pacman-conf.c | 6 + 11 files changed, 526 insertions(+), 4 deletions(-) create mode 100644 lib/libalpm/alpm_sandbox.c create mode 100644 lib/libalpm/alpm_sandbox.h diff --git lib/libalpm/alpm.h lib/libalpm/alpm.h index a5f4a6ae..f414d811 100644 --- lib/libalpm/alpm.h +++ lib/libalpm/alpm.h @@ -1837,6 +1837,11 @@ int alpm_option_set_gpgdir(alpm_handle_t *handle, const char *gpgdir); /* End of gpdir accessors */ /** @} */ +/** Sets the user to switch to for sensitive operations like downloading a file. + * @param handle the context handle + * @param sandboxuser the user to set + */ +int alpm_option_set_sandboxuser(alpm_handle_t *handle, const char *sandboxuser); /** @name Accessors for use syslog * @@ -1859,6 +1864,11 @@ int alpm_option_set_usesyslog(alpm_handle_t *handle, int usesyslog); /* End of usesyslog accessors */ /** @} */ +/** Sets whether to use sandboxing for sensitive operations like downloading a file (0 is FALSE, TRUE otherwise). + * @param handle the context handle + * @param usesandbox whether to use the sandboxing (0 is FALSE, TRUE otherwise) + */ +int alpm_option_set_usesandbox(alpm_handle_t *handle, int usesandbox); /** @name Accessors to the list of no-upgrade files. * These functions modify the list of files which should diff --git lib/libalpm/alpm_sandbox.c lib/libalpm/alpm_sandbox.c new file mode 100644 index 00000000..29f46d58 --- /dev/null +++ lib/libalpm/alpm_sandbox.c @@ -0,0 +1,341 @@ +/* + * sandbox.c + * + * Copyright (c) 2021 Pacman Development Team <pacman-dev(a)archlinux.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include <errno.h> +#include <fcntl.h> +#include <grp.h> +#include <pwd.h> +#include <sys/capability.h> +#include <sys/syscall.h> +#include <sys/types.h> +#include <unistd.h> + +#ifdef HAVE_LINUX_LANDLOCK_H +# include <linux/landlock.h> +# include <sys/prctl.h> +# include <sys/syscall.h> +#endif /* HAVE_LINUX_LANDLOCK_H */ + +#ifdef HAVE_LIBSECCOMP +# include <seccomp.h> +#endif /* HAVE_LIBSECCOMP */ + +#include "alpm_sandbox.h" + +#ifdef HAVE_LINUX_LANDLOCK_H +#ifndef landlock_create_ruleset +static inline int landlock_create_ruleset(const struct landlock_ruleset_attr *const attr, + const size_t size, const __u32 flags) +{ + return syscall(__NR_landlock_create_ruleset, attr, size, flags); +} +#endif /* landlock_create_ruleset */ + +#ifndef landlock_add_rule +static inline int landlock_add_rule(const int ruleset_fd, + const enum landlock_rule_type rule_type, + const void *const rule_attr, const __u32 flags) +{ + return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags); +} +#endif /* landlock_add_rule */ + +#ifndef landlock_restrict_self +static inline int landlock_restrict_self(const int ruleset_fd, const __u32 flags) +{ + return syscall(__NR_landlock_restrict_self, ruleset_fd, flags); +} +#endif /* landlock_restrict_self */ + +#define _LANDLOCK_ACCESS_FS_WRITE ( \ + LANDLOCK_ACCESS_FS_WRITE_FILE | \ + LANDLOCK_ACCESS_FS_REMOVE_DIR | \ + LANDLOCK_ACCESS_FS_REMOVE_FILE | \ + LANDLOCK_ACCESS_FS_MAKE_CHAR | \ + LANDLOCK_ACCESS_FS_MAKE_DIR | \ + LANDLOCK_ACCESS_FS_MAKE_REG | \ + LANDLOCK_ACCESS_FS_MAKE_SOCK | \ + LANDLOCK_ACCESS_FS_MAKE_FIFO | \ + LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ + LANDLOCK_ACCESS_FS_MAKE_SYM) + +#define _LANDLOCK_ACCESS_FS_READ ( \ + LANDLOCK_ACCESS_FS_READ_FILE | \ + LANDLOCK_ACCESS_FS_READ_DIR) + +static int sandbox_write_only_beneath_cwd(void) +{ + const struct landlock_ruleset_attr ruleset_attr = { + .handled_access_fs = \ + _LANDLOCK_ACCESS_FS_READ | \ + _LANDLOCK_ACCESS_FS_WRITE | \ + LANDLOCK_ACCESS_FS_EXECUTE, + }; + struct landlock_path_beneath_attr path_beneath = { + .allowed_access = _LANDLOCK_ACCESS_FS_WRITE, + }; + int result = 0; + int ruleset_fd; + + ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); + if(ruleset_fd < 0) { + return ruleset_fd; + } + + /* allow / as read-only */ + path_beneath.parent_fd = open("/", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | LANDLOCK_ACCESS_FS_EXECUTE; + + if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) { + result = errno; + } + + close(path_beneath.parent_fd); + + if(result == 0) { + /* allow the current working directory as read-write */ + path_beneath.parent_fd = open(".", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | LANDLOCK_ACCESS_FS_EXECUTE; + + if(!landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) { + if(landlock_restrict_self(ruleset_fd, 0)) { + result = errno; + } + } else { + result = errno; + } + + close(path_beneath.parent_fd); + + if(result == 0) { + /* allow /tmp as well */ + path_beneath.parent_fd = open("/tmp", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | LANDLOCK_ACCESS_FS_EXECUTE; + + if(!landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) { + if(landlock_restrict_self(ruleset_fd, 0)) { + result = errno; + } + } else { + result = errno; + } + + close(path_beneath.parent_fd); + } + } + + close(ruleset_fd); + return result; +} +#endif /* HAVE_LINUX_LANDLOCK_H */ + +#ifdef HAVE_LIBSECCOMP + +static int sandbox_filter_syscalls(void) +{ + int ret = 0; + /* see https://docs.docker.com/engine/security/seccomp/ for inspiration, + as well as systemd's src/shared/seccomp-util.c */ + const char* denied_syscalls[] = { + /* kernel modules */ + "delete_module", + "finit_module", + "init_module", + /* mount */ + "chroot", + "fsconfig", + "fsmount", + "fsopen", + "fspick", + "mount", + "move_mount", + "open_tree", + "pivot_root", + "umount", + "umount2", + /* keyring */ + "add_key", + "keyctl", + "request_key", + /* CPU emulation */ + "modify_ldt", + "subpage_prot", + "switch_endian", + "vm86", + "vm86old", + /* debug */ + "kcmp", + "lookup_dcookie", + "perf_event_open", + "ptrace", + "rtas", + "sys_debug_setcontext", + /* set clock */ + "adjtimex", + "clock_adjtime", + "clock_adjtime64", + "clock_settime", + "clock_settime64", + "settimeofday", + /* raw IO */ + "ioperm", + "iopl", + "pciconfig_iobase", + "pciconfig_read", + "pciconfig_write", + /* kexec */ + "kexec_file_load", + "kexec_load", + /* reboot */ + "reboot", + /* privileged */ + "acct", + "bpf", + "personality", + /* obsolete */ + "_sysctl", + "afs_syscall", + "bdflush", + "break", + "create_module", + "ftime", + "get_kernel_syms", + "getpmsg", + "gtty", + "idle", + "lock", + "mpx", + "prof", + "profil", + "putpmsg", + "query_module", + "security", + "sgetmask", + "ssetmask", + "stime", + "stty", + "sysfs", + "tuxcall", + "ulimit", + "uselib", + "ustat", + "vserver", + /* swap */ + "swapon", + "swapoff", + }; + /* allow all syscalls that are not listed */ + size_t idx; + scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW); + if(ctx == NULL) { + return errno; + } + + for(idx = 0; idx < sizeof(denied_syscalls) / sizeof(*denied_syscalls); idx++) { + int syscall = seccomp_syscall_resolve_name(denied_syscalls[idx]); + if(syscall != __NR_SCMP_ERROR) { + if(seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), syscall, 0) != 0) { + /* Do not fail but log something like: _("Error blocking syscall %s\n"), denied_syscalls[idx]); */ + } + } + } + + if(seccomp_load(ctx) != 0) { + ret = errno; + } + + seccomp_release(ctx); + return ret; +} +#endif /* HAVE_LIBSECCOMP */ + +static int switch_to_user(const char *user) +{ + struct passwd const *pw = NULL; + if(getuid() != 0) { + return 1; + } + pw = getpwnam(user); + if(pw == NULL) { + return errno; + } + if(setgid(pw->pw_gid) != 0) { + return errno; + } + if(setgroups(0, NULL)) { + return errno; + } + if(setuid(pw->pw_uid) != 0) { + return errno; + } + return 0; +} + +/* check exported library symbols with: nm -C -D <lib> */ +#define SYMEXPORT __attribute__((visibility("default"))) + +int SYMEXPORT alpm_sandbox_child(const char* sandboxuser) +{ + int result = 0; +#ifdef HAVE_LINUX_LANDLOCK_H + int ret = 0; +#endif/* HAVE_LINUX_LANDLOCK_H */ + + /* make sure that we cannot gain more privileges later */ + if(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) { + result = errno; + } + +#ifdef HAVE_LIBSECCOMP + result = sandbox_filter_syscalls(); +#endif /* HAVE_LIBSECCOMP */ + + if(sandboxuser != NULL) { + result = switch_to_user(sandboxuser); + } + +#ifdef HAVE_LIBCAP + /* we might have some capabilities remaining, + * especially if sandboxuser is not set */ + cap_t caps = cap_get_proc(); + cap_clear(caps); + if(cap_set_mode(CAP_MODE_NOPRIV) != 0) { + cap_free(caps); + if(result == 0) { + result = errno; + } + } + if(cap_set_proc(caps) != 0) { + cap_free(caps); + if(result == 0) { + result = errno; + } + } + cap_free(caps); +#endif /* HAVE_LIBCAP */ + +#ifdef HAVE_LINUX_LANDLOCK_H + ret = sandbox_write_only_beneath_cwd(); + if(result == 0) { + result = ret; + } +#endif /* HAVE_LINUX_LANDLOCK_H */ + + return result; +} diff --git lib/libalpm/alpm_sandbox.h lib/libalpm/alpm_sandbox.h new file mode 100644 index 00000000..47611575 --- /dev/null +++ lib/libalpm/alpm_sandbox.h @@ -0,0 +1,31 @@ +/* + * sandbox.h + * + * Copyright (c) 2021 Pacman Development Team <pacman-dev(a)archlinux.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ +#ifndef ALPM_SANDBOX_H +#define ALPM_SANDBOX_H + +#ifdef __cplusplus +extern "C" { +#endif + +int alpm_sandbox_child(const char *sandboxuser); + +#ifdef __cplusplus +} +#endif +#endif /* ALPM_SANDBOX_H */ diff --git lib/libalpm/dload.c lib/libalpm/dload.c index ca6be7b6..6bb06b4c 100644 --- lib/libalpm/dload.c +++ lib/libalpm/dload.c @@ -28,6 +28,7 @@ #include <sys/time.h> #include <sys/types.h> #include <sys/stat.h> +#include <sys/wait.h> #include <signal.h> #ifdef HAVE_NETINET_IN_H @@ -44,6 +45,7 @@ /* libalpm */ #include "dload.h" #include "alpm_list.h" +#include "alpm_sandbox.h" #include "alpm.h" #include "log.h" #include "util.h" @@ -898,6 +900,81 @@ static int curl_download_internal(alpm_handle_t *handle, #endif +static int curl_download_internal_sandboxed(alpm_handle_t *handle, + alpm_list_t *payloads /* struct dload_payload */, + const char *localpath) +{ + int pid, err = 0, ret = -1, err_fd[2]; + sigset_t oldblock; + struct sigaction sa_ign = { .sa_handler = SIG_IGN }, oldint, oldquit; + + if(pipe(err_fd) != 0) { + return -1; + } + + sigaction(SIGINT, &sa_ign, &oldint); + sigaction(SIGQUIT, &sa_ign, &oldquit); + sigaddset(&sa_ign.sa_mask, SIGCHLD); + sigprocmask(SIG_BLOCK, &sa_ign.sa_mask, &oldblock); + + pid = fork(); + + /* child */ + if(pid == 0) { + close(err_fd[0]); + fcntl(err_fd[1], F_SETFD, FD_CLOEXEC); + + /* restore signal handling for the child to inherit */ + sigaction(SIGINT, &oldint, NULL); + sigaction(SIGQUIT, &oldquit, NULL); + sigprocmask(SIG_SETMASK, &oldblock, NULL); + + /* cwd to the download directory */ + ret = chdir(localpath); + if(ret != 0) { + _alpm_log(handle, ALPM_LOG_WARNING, _("could not chdir to download directory %s\n"), localpath); + ret = -1; + } else { + ret = alpm_sandbox_child(handle->sandboxuser); + if (ret != 0) { + _alpm_log(handle, ALPM_LOG_WARNING, _("sandboxing failed!\n")); + } + + ret = curl_download_internal(handle, payloads, localpath); + } + + /* pass the result back to the parent */ + while(write(err_fd[1], &ret, sizeof(ret)) == -1 && errno == EINTR); + _Exit(ret < 0 ? 1 : 0); + } + + /* parent */ + close(err_fd[1]); + + if(pid != -1) { + int wret; + while((wret = waitpid(pid, &ret, 0)) == -1 && errno == EINTR); + if(wret > 0) { + while(read(err_fd[0], &ret, sizeof(ret)) == -1 && errno == EINTR); + } + } else { + /* fork failed, make sure errno is preserved after cleanup */ + err = errno; + } + + close(err_fd[0]); + + sigaction(SIGINT, &oldint, NULL); + sigaction(SIGQUIT, &oldquit, NULL); + sigprocmask(SIG_SETMASK, &oldblock, NULL); + + if(err) { + errno = err; + ret = -1; + } + return ret; +} + /* Returns -1 if an error happened for a required file * Returns 0 if a payload was actually downloaded * Returns 1 if no files were downloaded and all errors were non-fatal @@ -908,7 +985,11 @@ int _alpm_download(alpm_handle_t *handle, { if(handle->fetchcb == NULL) { #ifdef HAVE_LIBCURL - return curl_download_internal(handle, payloads, localpath); + if(handle->usesandbox) { + return curl_download_internal_sandboxed(handle, payloads, localpath); + } else { + return curl_download_internal(handle, payloads, localpath); + } #else RET_ERR(handle, ALPM_ERR_EXTERNAL_DOWNLOAD, -1); #endif diff --git lib/libalpm/handle.c lib/libalpm/handle.c index e6b683cb..10ae44b2 100644 --- lib/libalpm/handle.c +++ lib/libalpm/handle.c @@ -573,6 +573,19 @@ int SYMEXPORT alpm_option_set_gpgdir(alpm_handle_t *handle, const char *gpgdir) return 0; } +int SYMEXPORT alpm_option_set_sandboxuser(alpm_handle_t *handle, const char *sandboxuser) +{ + CHECK_HANDLE(handle, return -1); + if(handle->sandboxuser) { + FREE(handle->sandboxuser); + } + + STRDUP(handle->sandboxuser, sandboxuser, RET_ERR(handle, ALPM_ERR_MEMORY, -1)); + + _alpm_log(handle, ALPM_LOG_DEBUG, "option 'sandboxuser' = %s\n", handle->sandboxuser); + return 0; +} + int SYMEXPORT alpm_option_set_usesyslog(alpm_handle_t *handle, int usesyslog) { CHECK_HANDLE(handle, return -1); @@ -580,6 +593,13 @@ int SYMEXPORT alpm_option_set_usesyslog(alpm_handle_t *handle, int usesyslog) return 0; } +int SYMEXPORT alpm_option_set_usesandbox(alpm_handle_t *handle, int usesandbox) +{ + CHECK_HANDLE(handle, return -1); + handle->usesandbox = usesandbox; + return 0; +} + static int _alpm_option_strlist_add(alpm_handle_t *handle, alpm_list_t **list, const char *str) { char *dup; diff --git lib/libalpm/handle.h lib/libalpm/handle.h index b1526c67..43550833 100644 --- lib/libalpm/handle.h +++ lib/libalpm/handle.h @@ -90,6 +90,7 @@ struct __alpm_handle_t { char *logfile; /* Name of the log file */ char *lockfile; /* Name of the lock file */ char *gpgdir; /* Directory where GnuPG files are stored */ + char *sandboxuser; /* User to switch to for sensitive operations like downloading files */ alpm_list_t *cachedirs; /* Paths to pacman cache directories */ alpm_list_t *hookdirs; /* Paths to hook directories */ alpm_list_t *overwrite_files; /* Paths that may be overwritten */ @@ -104,6 +105,7 @@ struct __alpm_handle_t { /* options */ alpm_list_t *architectures; /* Architectures of packages we should allow */ int usesyslog; /* Use syslog instead of logfile? */ /* TODO move to frontend */ + int usesandbox; /* Whether to enable sandboxing for sensitive operations like downloading files */ int checkspace; /* Check disk space before installing */ char *dbext; /* Sync DB extension */ int siglevel; /* Default signature verification level */ diff --git lib/libalpm/meson.build lib/libalpm/meson.build index 607e91a3..c36ae516 100644 --- lib/libalpm/meson.build +++ lib/libalpm/meson.build @@ -2,6 +2,7 @@ libalpm_sources = files(''' add.h add.c alpm.h alpm.c alpm_list.h alpm_list.c + alpm_sandbox.h alpm_sandbox.c backup.h backup.c base64.h base64.c be_local.c diff --git meson.build meson.build index 26c92b8e..88f0e3a1 100644 --- meson.build +++ meson.build @@ -91,6 +91,10 @@ libarchive = dependency('libarchive', version : '>=3.0.0', static : get_option('buildstatic')) +libcap = dependency('libcap', + static : get_option('buildstatic')) +conf.set('HAVE_LIBCAP', libcap.found()) + libcurl = dependency('libcurl', version : '>=7.55.0', required : get_option('curl'), @@ -120,7 +124,12 @@ else error('unhandled crypto value @0@'.format(want_crypto)) endif +libseccomp = dependency('libseccomp', + static : get_option('buildstatic')) +conf.set('HAVE_LIBSECCOMP', libseccomp.found()) + foreach header : [ + 'linux/landlock.h', 'mntent.h', 'sys/mnttab.h', 'sys/mount.h', @@ -305,7 +314,7 @@ libcommon = static_library( gnu_symbol_visibility : 'hidden', install : false) -alpm_deps = [crypto_provider, libarchive, libcurl, libintl, gpgme] +alpm_deps = [crypto_provider, libarchive, libcap, libcurl, libintl, libseccomp, gpgme] libalpm_a = static_library( 'alpm_objlib', diff --git src/pacman/conf.c src/pacman/conf.c index 12fee64c..9480a492 100644 --- src/pacman/conf.c +++ src/pacman/conf.c @@ -33,6 +33,8 @@ #include <unistd.h> #include <signal.h> +#include <alpm_sandbox.h> + /* pacman */ #include "conf.h" #include "ini.h" @@ -215,7 +217,7 @@ static char *get_tempfile(const char *path, const char *filename) * - not thread-safe * - errno may be set by fork(), pipe(), or execvp() */ -static int systemvp(const char *file, char *const argv[]) +static int systemvp(const char *file, char *const argv[], bool sandbox, const char *sandboxuser) { int pid, err = 0, ret = -1, err_fd[2]; sigset_t oldblock; @@ -242,6 +244,13 @@ static int systemvp(const char *file, char *const argv[]) sigaction(SIGQUIT, &oldquit, NULL); sigprocmask(SIG_SETMASK, &oldblock, NULL); + if (sandbox) { + ret = alpm_sandbox_child(sandboxuser); + if (ret != 0) { + pm_printf(ALPM_LOG_WARNING, _("sandboxing failed!\n")); + } + } + execvp(file, argv); /* execvp failed, pass the error back to the parent */ @@ -352,7 +361,7 @@ static int download_with_xfercommand(void *ctx, const char *url, free(cmd); } } - retval = systemvp(argv[0], (char**)argv); + retval = systemvp(argv[0], (char**)argv, config->usesandbox, config->sandboxuser); if(retval == -1) { pm_printf(ALPM_LOG_WARNING, _("running XferCommand: fork failed!\n")); @@ -601,6 +610,9 @@ static int _parse_options(const char *key, char *value, if(strcmp(key, "UseSyslog") == 0) { config->usesyslog = 1; pm_printf(ALPM_LOG_DEBUG, "config: usesyslog\n"); + } else if(strcmp(key, "UseSandbox") == 0) { + config->usesandbox = 1; + pm_printf(ALPM_LOG_DEBUG, "config: usesandbox\n"); } else if(strcmp(key, "ILoveCandy") == 0) { config->chomp = 1; pm_printf(ALPM_LOG_DEBUG, "config: chomp\n"); @@ -668,6 +680,11 @@ static int _parse_options(const char *key, char *value, config->logfile = strdup(value); pm_printf(ALPM_LOG_DEBUG, "config: logfile: %s\n", value); } + } else if(strcmp(key, "SandboxUser") == 0) { + if(!config->sandboxuser) { + config->sandboxuser = strdup(value); + pm_printf(ALPM_LOG_DEBUG, "config: sandboxuser: %s\n", value); + } } else if(strcmp(key, "XferCommand") == 0) { char **c; if((config->xfercommand_argv = wordsplit(value)) == NULL) { @@ -904,6 +921,8 @@ static int setup_libalpm(void) alpm_option_set_architectures(handle, config->architectures); alpm_option_set_checkspace(handle, config->checkspace); alpm_option_set_usesyslog(handle, config->usesyslog); + alpm_option_set_usesandbox(handle, config->usesandbox); + alpm_option_set_sandboxuser(handle, config->sandboxuser); alpm_option_set_ignorepkgs(handle, config->ignorepkg); alpm_option_set_ignoregroups(handle, config->ignoregrp); diff --git src/pacman/conf.h src/pacman/conf.h index 04350d39..8fced284 100644 --- src/pacman/conf.h +++ src/pacman/conf.h @@ -55,6 +55,7 @@ typedef struct __config_t { unsigned short print; unsigned short checkspace; unsigned short usesyslog; + unsigned short usesandbox; unsigned short color; unsigned short disable_dl_timeout; char *print_format; @@ -67,6 +68,7 @@ typedef struct __config_t { char *logfile; char *gpgdir; char *sysroot; + char *sandboxuser; alpm_list_t *hookdirs; alpm_list_t *cachedirs; alpm_list_t *architectures; diff --git src/pacman/pacman-conf.c src/pacman/pacman-conf.c index 600f1622..6da27937 100644 --- src/pacman/pacman-conf.c +++ src/pacman/pacman-conf.c @@ -251,6 +251,7 @@ static void dump_config(void) show_list_str("HookDir", config->hookdirs); show_str("GPGDir", config->gpgdir); show_str("LogFile", config->logfile); + show_str("SandboxUser", config->sandboxuser); show_list_str("HoldPkg", config->holdpkg); show_list_str("IgnorePkg", config->ignorepkg); @@ -268,6 +269,7 @@ static void dump_config(void) show_bool("DisableDownloadTimeout", config->disable_dl_timeout); show_bool("ILoveCandy", config->chomp); show_bool("NoProgressBar", config->noprogressbar); + show_bool("UseSandbox", config->usesandbox); show_int("ParallelDownloads", config->parallel_downloads); @@ -349,6 +351,8 @@ static int list_directives(void) show_str("GPGDir", config->gpgdir); } else if(strcasecmp(i->data, "LogFile") == 0) { show_str("LogFile", config->logfile); + } else if(strcasecmp(i->data, "SandboxUser") == 0) { + show_str("SandboxUser", config->sandboxuser); } else if(strcasecmp(i->data, "HoldPkg") == 0) { show_list_str("HoldPkg", config->holdpkg); @@ -369,6 +373,8 @@ static int list_directives(void) } else if(strcasecmp(i->data, "UseSyslog") == 0) { show_bool("UseSyslog", config->usesyslog); + } else if(strcasecmp(i->data, "UseSandbox") == 0) { + show_bool("UseSandbox", config->usesandbox); } else if(strcasecmp(i->data, "Color") == 0) { show_bool("Color", config->color); } else if(strcasecmp(i->data, "CheckSpace") == 0) { -- 2.33.0

3 8

[pacman-dev] Translation of man pages
by Mario Blättermann 19 Sep '21

19 Sep '21

Hello, the translation help page [1] says: --- There are currently no efforts underway to include translated manual pages in the pacman codebase. However, this is not to say translations are unwelcome. If someone has experience with i18n man pages and how to best include them with our source, please contact the pacman-dev mailing list at pacman-dev(a)archlinux.org. --- OK, then let me introduce my approach. Although the man page translations are already maintained in the manpages-l10n project [2] for some years, I think it is it better to use Pacman's upstream tree instead. The external maintenance has some disadvantages: We download distribution packages, create the templates, translate them and release the translated man pages some months later. Besides this delay, we don't know how many users know about the existence of the translated versions. Having the translations in the upstream project (translated using Transifex) would be better, and the localized versions would be released with Pacman itself and always in sync with the English ones. See the attached patch and config file. The patch manpage-markup.diff fixes the Asciidoc markup to get Po4a [3] properly working. After applying the patch, put po4a.cfg in doc/po/. I've imported German, Brazilian Portuguese and French translations from manpages-l10n, but even compressed they are too big for the list. The .po files will follow in separate mails.To test the creation of the translated Asciidoc files, just run 'po4a po4a.cfg'. This command creates a translation template and a subdirectory for each language and saves the resulting files there. Once you have the Asciidoc files, they can be processed further like those in doc/. Unfortunately, I don't have neither Autotools nor Meson knowledge, maybe someone else can help with integration into the build systems? [1] https://archlinux.org/pacman/translation-help.html#_translating_manpages [2] https://salsa.debian.org/manpages-l10n-team/manpages-l10n [3] https://po4a.org/index.php.en Best Regards, Mario

2 5

[pacman-dev] [PATCH 1/2] libalpm: add ALPM_TRANS_FLAG_NOHOOKS
by morganamilo 04 Sep '21

04 Sep '21

--- lib/libalpm/alpm.h | 3 ++- lib/libalpm/trans.c | 8 ++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index c4acc062..8dab8c62 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -2721,7 +2721,8 @@ typedef enum _alpm_transflag_t { ALPM_TRANS_FLAG_RECURSE = (1 << 5), /** Modify database but do not commit changes to the filesystem. */ ALPM_TRANS_FLAG_DBONLY = (1 << 6), - /* (1 << 7) flag can go here */ + /** Do not run hooks during a transaction */ + ALPM_TRANS_FLAG_NOHOOKS = (1 << 7), /** Use ALPM_PKG_REASON_DEPEND when installing packages. */ ALPM_TRANS_FLAG_ALLDEPS = (1 << 8), /** Only download packages and do not actually install. */ diff --git a/lib/libalpm/trans.c b/lib/libalpm/trans.c index f22f9bf9..ae5c72ae 100644 --- a/lib/libalpm/trans.c +++ b/lib/libalpm/trans.c @@ -198,7 +198,8 @@ int SYMEXPORT alpm_trans_commit(alpm_handle_t *handle, alpm_list_t **data) } } - if(_alpm_hook_run(handle, ALPM_HOOK_PRE_TRANSACTION) != 0) { + if(!(trans->flags & ALPM_TRANS_FLAG_NOHOOKS) && + _alpm_hook_run(handle, ALPM_HOOK_PRE_TRANSACTION) != 0) { RET_ERR(handle, ALPM_ERR_TRANS_HOOK_FAILED, -1); } @@ -232,7 +233,10 @@ int SYMEXPORT alpm_trans_commit(alpm_handle_t *handle, alpm_list_t **data) event.type = ALPM_EVENT_TRANSACTION_DONE; EVENT(handle, (void *)&event); alpm_logaction(handle, ALPM_CALLER_PREFIX, "transaction completed\n"); - _alpm_hook_run(handle, ALPM_HOOK_POST_TRANSACTION); + + if(!(trans->flags & ALPM_TRANS_FLAG_NOHOOKS)) { + _alpm_hook_run(handle, ALPM_HOOK_POST_TRANSACTION); + } } trans->state = STATE_COMMITED; -- 2.32.0

2 3

[pacman-dev] [PATCH 1/2] libalpm: don't use alpm_pgpkey_t in import question
by morganamilo 04 Sep '21

04 Sep '21

When constructing an import question we never really used a proper gpg key. We just zero initialize the key, set the uid and fingerprint, and sent that to the front end. Instead lets just give the import question a uid and fingerprint field. --- lib/libalpm/alpm.h | 6 ++++-- lib/libalpm/signing.c | 10 +++------- src/pacman/callback.c | 6 +++--- 3 files changed, 10 insertions(+), 12 deletions(-) diff --git a/lib/libalpm/alpm.h b/lib/libalpm/alpm.h index c4acc062..07833346 100644 --- a/lib/libalpm/alpm.h +++ b/lib/libalpm/alpm.h @@ -1082,8 +1082,10 @@ typedef struct _alpm_question_import_key_t { alpm_question_type_t type; /** Answer: whether or not to import key */ int import; - /** The key to import */ - alpm_pgpkey_t *key; + /** UID of the key to import */ + const char *uid; + /** Fingerprint the key to import */ + const char *fingerprint; } alpm_question_import_key_t; /** diff --git a/lib/libalpm/signing.c b/lib/libalpm/signing.c index a7be3a1a..bba4e991 100644 --- a/lib/libalpm/signing.c +++ b/lib/libalpm/signing.c @@ -495,7 +495,7 @@ static int email_from_uid(const char *uid, char **email) int _alpm_key_import(alpm_handle_t *handle, const char *uid, const char *fpr) { int ret = -1; - alpm_pgpkey_t fetch_key = {0}; + alpm_pgpkey_t fetch_key; char *email; if(_alpm_access(handle, handle->gpgdir, "pubring.gpg", W_OK)) { @@ -504,19 +504,15 @@ int _alpm_key_import(alpm_handle_t *handle, const char *uid, const char *fpr) return -1; } - STRDUP(fetch_key.uid, uid, return -1); - STRDUP(fetch_key.fingerprint, fpr, free(fetch_key.uid); return -1); alpm_question_import_key_t question = { .type = ALPM_QUESTION_IMPORT_KEY, .import = 0, - .key = &fetch_key + .uid = uid, + .fingerprint = fpr }; QUESTION(handle, &question); - free(fetch_key.uid); - free(fetch_key.fingerprint); - if(question.import) { /* Try to import the key from a WKD first */ if(email_from_uid(uid, &email) == 0) { diff --git a/src/pacman/callback.c b/src/pacman/callback.c index 99ad716e..c9fe4b2e 100644 --- a/src/pacman/callback.c +++ b/src/pacman/callback.c @@ -541,12 +541,12 @@ void cb_question(void *ctx, alpm_question_t *question) { alpm_question_import_key_t *q = &question->import_key; /* the uid is unknown with db signatures */ - if (q->key->uid == NULL) { + if (q->uid == NULL) { q->import = yesno(_("Import PGP key %s?"), - q->key->fingerprint); + q->fingerprint); } else { q->import = yesno(_("Import PGP key %s, \"%s\"?"), - q->key->fingerprint, q->key->uid); + q->fingerprint, q->uid); } } break; -- 2.31.1

2 1

[pacman-dev] [PATCH] pacman-key: Reorder key_is_lsigned() and key_is_revoked() checks to reduce gpg trustdb checks
by Daan De Meyer 04 Sep '21

04 Sep '21

Every time we modify gpg's state by signing or revoking a key, gpg marks the trustdb as stale and rechecks it the next time key_is_lsigned() or key_is_revoked() is called. Currently, we alternate calls signing of keys and calling key_is_lsigned() (idem for revoking) which means that for each key we sign (or revoke), gpg will check the trustdb once. When populating the keyring, this means the trustdb is checked roughly 50 times. Each time the trustdb is checked, we get the following output once: ``` gpg: checking the trustdb gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 83 trust: 0-, 0q, 0n, 6m, 0f, 0u gpg: depth: 2 valid: 78 signed: 25 trust: 78-, 0q, 0n, 0m, 0f, 0u gpg: next trustdb check due at 2021-12-01 ``` This repeated 50x leads to incredibly verbose output from pacman-key. To avoid checking the trustb so many times, we can simply do all the key_is_lsigned() and key_is_revoked() checks upfront. Inbetween read operations the trustdb is not marked stale and inbetween write operations the trustdb is also not marked stale. This reduces the amount of trustdb checks from 50 to 1. The output of pacman-key --populate now looks as follows: ``` gpg: /var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/trustdb.gpg: trustdb created gpg: no ultimately trusted keys found gpg: starting migration from earlier GnuPG versions gpg: porting secret keys from '/var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/secring.gpg' to gpg-agent gpg: migration succeeded ==> Generating pacman master key. This may take some time. gpg: Generating pacman keyring master key... gpg: key D429469316A97B49 marked as ultimately trusted gpg: directory '/var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/openpgp-revocs.d' created gpg: revocation certificate stored as '/var/tmp/mkosi-pqii6f64/root/etc/pacman.d/gnupg/openpgp-revocs.d/059BC618296EDA8B4614FAD4D429469316A97B49.rev' gpg: Done ==> Updating trust database... gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u ==> Appending keys from archlinux.gpg... ==> Locally signing trusted keys in keyring... -> Locally signed 6 keys. ==> Importing owner trust values... gpg: setting ownertrust to 4 gpg: setting ownertrust to 4 gpg: setting ownertrust to 4 gpg: setting ownertrust to 4 gpg: inserting ownertrust of 4 gpg: setting ownertrust to 4 ==> Disabling revoked keys in keyring... -> Disabled 44 keys. ==> Updating trust database... gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 83 trust: 0-, 0q, 0n, 6m, 0f, 0u gpg: depth: 2 valid: 78 signed: 25 trust: 78-, 0q, 0n, 0m, 0f, 0u gpg: next trustdb check due at 2021-12-01 ``` --- scripts/pacman-key.sh.in | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 50342649..721079b7 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -333,12 +333,29 @@ populate_keyring() { # skip blank lines, comments; these are valid in this file [[ -z $key_id || ${key_id:0:1} = \# ]] && continue + if key_is_lsigned "$key_id" ; then + continue + fi + # Mark this key to be lsigned trusted_ids[$key_id]=$keyring done < "${KEYRING_IMPORT_DIR}/${keyring}-trusted" fi done + local -A revoked_ids + for keyring in "${KEYRINGIDS[@]}"; do + if [[ -s $KEYRING_IMPORT_DIR/$keyring-revoked ]]; then + while read -r key_id; do + if key_is_revoked "$key_id" ; then + continue + fi + + revoked_ids["$key_id"]=1 + done <"$KEYRING_IMPORT_DIR/$keyring-revoked" + fi + done + if (( ${#trusted_ids[@]} > 0 )); then msg "$(gettext "Locally signing trusted keys in keyring...")" lsign_keys "${!trusted_ids[@]}" @@ -350,22 +367,10 @@ populate_keyring() { done fi - local -A revoked_ids - for keyring in "${KEYRINGIDS[@]}"; do - if [[ -s $KEYRING_IMPORT_DIR/$keyring-revoked ]]; then - while read -r key_id; do - revoked_ids["$key_id"]=1 - done <"$KEYRING_IMPORT_DIR/$keyring-revoked" - fi - done - if (( ${#revoked_ids[@]} > 0 )); then local key_count=0 msg "$(gettext "Disabling revoked keys in keyring...")" for key_id in "${!revoked_ids[@]}"; do - if key_is_revoked "$key_id" ; then - continue - fi if (( VERBOSE )); then msg2 "$(gettext "Disabling key %s...")" "${key_id}" fi @@ -485,9 +490,6 @@ lsign_keys() { local ret=0 local key_count=0 for key_id in "$@"; do - if key_is_lsigned "$key_id" ; then - continue - fi if (( VERBOSE )); then msg2 "$(gettext "Locally signing key %s...")" "${key_id}" fi -- 2.33.0

2 2

[pacman-dev] [PATCH] Update broken links pointing to git.archlinux.org
by Hugo Osvaldo Barrera 03 Sep '21

03 Sep '21

All of these links are broken since the recent move to gitlab.archlinux.org. A few projects are, apparently, only available on GitHub, so I've linked to that source (hopefully that's only temporary). For git-clone URLs, I've opted for the https URLs since those can be used by anyone -- whereas the ssh URLs require the user to be registered on the gitlab instance which is not open to the public yet. Signed-off-by: Hugo Osvaldo Barrera <hugo(a)barrera.io> --- doc/index.asciidoc | 19 ++++++++++--------- doc/submitting-patches.asciidoc | 2 +- doc/translation-help.asciidoc | 2 +- 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/doc/index.asciidoc b/doc/index.asciidoc index 47295f9b..a1bc4cc8 100644 --- a/doc/index.asciidoc +++ b/doc/index.asciidoc @@ -59,11 +59,11 @@ configuration files dealing with pacman. Changelog ~~~~~~~~~ For a good idea of what is going on in pacman development, take a look at the -link:https://git.archlinux.org/pacman.git/[Git summary page] for the +link:https://gitlab.archlinux.org/pacman/pacman[Git summary page] for the project. See the most recent -link:https://git.archlinux.org/pacman.git/tree/NEWS[NEWS] +link:https://gitlab.archlinux.org/pacman/pacman/-/blob/master/NEWS[NEWS] file for a not-as-frequently-updated list of changes. However, this should contain the biggest changes in a format more concise than the commit log. @@ -220,12 +220,13 @@ these trees). The current development tree can be fetched with the following command: - git clone git://git.archlinux.org/pacman.git pacman + git clone https://gitlab.archlinux.org/pacman/pacman.git which will fetch the full development history into a directory named pacman. You can browse the source as well using -link:https://git.archlinux.org/pacman.git/[cgit]. HTTP/HTTPS URLs are also -available for cloning purposes; these URLs are listed at the above page. +link:https://gitlab.archlinux.org/pacman/pacman/-/tree/master[gitlab]. +HTTP/HTTPS URLs are also available for cloning purposes; these URLs are listed +at the above page. If you are interested in hacking on pacman, it is highly recommended you join the mailing list mentioned above, as well as take a quick glance at our @@ -243,13 +244,13 @@ Although the package manager itself is quite simple, many scripts have been developed that help automate building and installing packages. These are used extensively in link:https://archlinux.org/[Arch Linux]. Most of these utilities are available in the Arch Linux projects -link:https://git.archlinux.org/[code browser]. +link:https://gitlab.archlinux.org/archlinux[code browser]. Utilities available: -* link:https://git.archlinux.org/dbscripts.git/[dbscripts] - scripts used by Arch Linux to manage the main package repositories -* link:https://git.archlinux.org/devtools.git/[devtools] - tools to assist in packaging and dependency checking -* link:https://git.archlinux.org/namcap.git/[namcap] - a package analysis utility written in python +* link:https://github.com/archlinux/dbscripts[dbscripts] - scripts used by Arch Linux to manage the main package repositories +* link:https://github.com/archlinux/devtools[devtools] - tools to assist in packaging and dependency checking +* link:https://gitlab.archlinux.org/pacman/namcap[namcap] - a package analysis utility written in python Bugs ---- diff --git a/doc/submitting-patches.asciidoc b/doc/submitting-patches.asciidoc index 88b58ca5..14b80b61 100644 --- a/doc/submitting-patches.asciidoc +++ b/doc/submitting-patches.asciidoc @@ -20,7 +20,7 @@ started with GIT if you have not worked with it before. The pacman code can be fetched using the following command: - git clone git://git.archlinux.org/pacman.git + git clone https://gitlab.archlinux.org/pacman/pacman.git Creating your patch diff --git a/doc/translation-help.asciidoc b/doc/translation-help.asciidoc index 5a67a2d6..4301852d 100644 --- a/doc/translation-help.asciidoc +++ b/doc/translation-help.asciidoc @@ -78,7 +78,7 @@ Incremental Updates If you have more advanced needs you will have to get a copy of the pacman repository. - git clone git://git.archlinux.org/pacman.git pacman + git clone https://gitlab.archlinux.org/pacman/pacman.git Next, you will need to run `./autogen.sh` and `./configure` in the base directory to generate the correct Makefiles. At this point, all necessary -- 2.32.0

2 8

Re: [pacman-dev] [PATCH] Order downloads by descending max_size
by Charlie Sale 03 Sep '21

03 Sep '21

>This sort is unlikely to optimal, but optimality would be much harder >to achieve. Do you have anything in mind that would be more optimal? Should I take a different strategy? > The ideal situation is to have 1 large download running to soak up bandwidth Would it be better to search for any really large packages (much larger than the rest), put those at the top of the list, and then leave everything else unsorted? Would that be too slow as well? Cheers

4 5

[pacman-dev] [PATCH 1/2] only use effective url for urls containing .db or .pkg
by morganamilo 03 Sep '21

03 Sep '21

Github and other sites redirect their downloads to a cdn. So the download http://foo.org/myrepo.db may redirect to something like https://cdn.foo.org/83749327439. This then causes pacman to try and download the sig as https://cdn.foo.org/83749327439.sig which is incorrect. In this case pacman should append .sig to the original url. However urls like https://archlinux.org/packages/community/x86_64/0ad/download/ Redirect to the mirror, so .sig has to appended after the redirects and not before. So we decide if we should append .sig on the original or effective url based on if the effective url has .db or .pkg in it. Fixes FS#71148 --- lib/libalpm/dload.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 2c14841f..72e9cfcd 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -613,11 +613,28 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, /* Let's check if client requested downloading accompanion *.sig file */ if(!payload->signature && payload->download_signature && curlerr == CURLE_OK && payload->respcode < 400) { struct dload_payload *sig = NULL; + char *url = payload->fileurl; + char *_effective_filename; - int len = strlen(effective_url) + 5; + STRDUP(_effective_filename, effective_url, GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); + const char *effective_filename = get_filename(_effective_filename); + char *query = strrchr(effective_filename, '?'); + + if(query) { + query[0] = '\0'; + } + + /* Only use the effective url for sig downloads if the effective_url contains .db or .pkg */ + if(strstr(effective_filename, ".db") || strstr(effective_filename, ".pkg")) { + url = effective_url; + } + + free(_effective_filename); + + int len = strlen(url) + 5; CALLOC(sig, 1, sizeof(*sig), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); MALLOC(sig->fileurl, len, FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); - snprintf(sig->fileurl, len, "%s.sig", effective_url); + snprintf(sig->fileurl, len, "%s.sig", url); if(payload->trust_remote_name) { /* In this case server might provide a new name for the main payload. -- 2.32.0

5 10

[pacman-dev] [PATCH] libalpm: always name signatures after original file
by morganamilo 03 Sep '21

03 Sep '21

If the original download redirects to to a different url then alpm would try to name the sig file after the url instead of <original_file>.sig. Instead force this naming scheme regardless of url. Fixes FS#71274 --- lib/libalpm/dload.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index 2c14841f..ca6be7b6 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -614,6 +614,7 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, if(!payload->signature && payload->download_signature && curlerr == CURLE_OK && payload->respcode < 400) { struct dload_payload *sig = NULL; + const char* realname = payload->destfile_name ? payload->destfile_name : payload->tempfile_name; int len = strlen(effective_url) + 5; CALLOC(sig, 1, sizeof(*sig), GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); MALLOC(sig->fileurl, len, FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); @@ -623,13 +624,18 @@ static int curl_check_finished_download(CURLM *curlm, CURLMsg *msg, /* In this case server might provide a new name for the main payload. * Choose *.sig filename based on this new name. */ - const char* realname = payload->destfile_name ? payload->destfile_name : payload->tempfile_name; const char *final_file = get_filename(realname); int remote_name_len = strlen(final_file) + 5; MALLOC(sig->remote_name, remote_name_len, FREE(sig->fileurl); FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); snprintf(sig->remote_name, remote_name_len, "%s.sig", final_file); } + /* force the filename to be realname + ".sig" */ + int destfile_name_len = strlen(realname) + 5; + MALLOC(sig->destfile_name, destfile_name_len, FREE(sig->remote_name); + FREE(sig->fileurl); FREE(sig); GOTO_ERR(handle, ALPM_ERR_MEMORY, cleanup)); + snprintf(sig->destfile_name, destfile_name_len, "%s.sig", realname); + sig->signature = 1; sig->handle = handle; sig->force = payload->force; @@ -762,7 +768,9 @@ static int curl_add_payload(alpm_handle_t *handle, CURLM *curlm, } if(payload->remote_name && strlen(payload->remote_name) > 0) { - payload->destfile_name = get_fullpath(localpath, payload->remote_name, ""); + if(!payload->destfile_name) { + payload->destfile_name = get_fullpath(localpath, payload->remote_name, ""); + } payload->tempfile_name = get_fullpath(localpath, payload->remote_name, ".part"); if(!payload->destfile_name || !payload->tempfile_name) { goto cleanup; -- 2.32.0

2 3

[pacman-dev] [PATCH] libalpm: Give -U downlaoads a random .part name
by morganamilo 03 Sep '21

03 Sep '21

archweb's download links all end in /download. This causes all the temp files to be named download.part. With parallel downloads this causes multiple downloads to go to the same temp file and breaks. Note that the final file name is not changed so once the download is complete the download is given its proper name. Fixes FS#71464 --- lib/libalpm/dload.c | 8 ++++---- lib/libalpm/dload.h | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index ca6be7b6..6bccabf4 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -767,7 +767,7 @@ static int curl_add_payload(alpm_handle_t *handle, CURLM *curlm, GOTO_ERR(handle, ALPM_ERR_SERVER_BAD_URL, cleanup); } - if(payload->remote_name && strlen(payload->remote_name) > 0) { + if(!payload->random_partfile && payload->remote_name && strlen(payload->remote_name) > 0) { if(!payload->destfile_name) { payload->destfile_name = get_fullpath(localpath, payload->remote_name, ""); } @@ -776,8 +776,8 @@ static int curl_add_payload(alpm_handle_t *handle, CURLM *curlm, goto cleanup; } } else { - /* URL doesn't contain a filename, so make a tempfile. We can't support - * resuming this kind of download; partial transfers will be destroyed */ + /* We want a random filename or URL doesn't contain a filename, so make a tempfile. + * We can't support resuming this kind of download; partial transfers will be destroyed */ payload->unlink_on_fail = 1; payload->localf = create_tempfile(payload, localpath); @@ -990,7 +990,7 @@ int SYMEXPORT alpm_fetch_pkgurl(alpm_handle_t *handle, const alpm_list_t *urls, ASSERT(url, GOTO_ERR(handle, ALPM_ERR_WRONG_ARGS, err)); CALLOC(payload, 1, sizeof(*payload), GOTO_ERR(handle, ALPM_ERR_MEMORY, err)); STRDUP(payload->fileurl, url, FREE(payload); GOTO_ERR(handle, ALPM_ERR_MEMORY, err)); - payload->allow_resume = 1; + payload->random_partfile = 1; payload->handle = handle; payload->trust_remote_name = 1; payload->download_signature = (handle->siglevel & ALPM_SIG_PACKAGE); diff --git a/lib/libalpm/dload.h b/lib/libalpm/dload.h index 8f3d17b4..dfeb7902 100644 --- a/lib/libalpm/dload.h +++ b/lib/libalpm/dload.h @@ -44,6 +44,7 @@ struct dload_payload { off_t prevprogress; int force; int allow_resume; + int random_partfile; int errors_ok; int unlink_on_fail; int trust_remote_name; -- 2.32.0

2 1

[pacman-dev] WIP: makepkg: add BLAKE3 (b3sums) support
by Konstantin Gizdov 03 Sep '21

03 Sep '21

Hi all, This is work in progress, but I did some basic tests and seems to work. Since we have b2sums support in makepkg, I was wondering if we could also add b3sums (https://github.com/BLAKE3-team/BLAKE3) It's been finalised recently and has a working package in [community] repo. It's not in coreutils and probably can't easily handle dependencies for pacman at the moment but the b3sums algo is solid and maybe worth adding if people want to use it in the future. -- Regards, Konstantin

2 1

[pacman-dev] [PATCH] Add optional sandboxing when downloading files
by Remi Gacogne 27 Aug '21

27 Aug '21

Hi all, I would like to get some feedback on a optional sandboxing feature I would like to implement in pacman. The gist of it is to use a separate process for some sensitive operations, like downloading files, and to restrict the privileges of that process to reduce the risk of an exploitable bug turning into a code execution with full root privileges. I'm not too worried about the pacman code itself, but downloading files over the internet involves parsing HTTP payloads, as well as parsing X.509 certificates and doing cryptographic operations when HTTPS is used, which is more error-prone. For what it's worth, Debian's APT has similar options hidden behind the APT::Sandbox::Seccomp and APT::Sandbox::User parameters. The attached patch is clearly not in a finished state, but provides more details about the kind of changes needed to support this new feature. In a nutshell, what it currently does is that if the UseSandbox option is not set nothing changes. Otherwise internal and external downloads trigger the spawning of a new process, via fork(), whose result is communicated to the main process via a pipe, as is already done today for external downloads. Then: - If available, PR_SET_NO_NEW_PRIVS is called to ensure that the downloader will not be able to gain new privileges in the future, for example by executing a set-uid program. - If pacman has been built with libseccomp support and the kernel supports it, a list of system calls that are clearly of no use to a regular process downloading files is denied via a seccomp filter. That list is currently hard-coded but it would make more sense to make it configurable. - If the SandboxUser option is set to a valid user, the downloader process switches to that user via setgid, setgroups and setuid, dropping root privileges. This part requires making the download folder owned by that user. - If pacman has been built with libcap support and the downloader process still has privileged capabilities at this point, these are dropped. - If pacman has been built with landlock support (requires an updated linux-api-headers, >= 5.13) and the kernel supports it, the whole filesystem is set read-only with the exception of /tmp and DBPath. The list of writable paths is currently hard-coded but it would make sense to make it configurable as well. Any feedback will be welcome. Please be aware that I tried to keep the new code in line with the coding style and contributing guidelines but I'm not familiar with pacman's source code so I'm sure I did not do everything the right way, and that this code can be improved. What I would like to know first is whether there is any interest in that feature, then to get feedback about the "big picture" part of the design. If there is indeed interest and my approach is somewhat sane, then I can work on making the code less ugly, write the much needed documentation for the new feature and related options, and improve the logging of errors. Thanks! Remi Signed-off-by: Remi Gacogne <rgacogne(a)archlinux.org> --- lib/libalpm/alpm.h | 10 ++ lib/libalpm/alpm_sandbox.c | 341 +++++++++++++++++++++++++++++++++++++ lib/libalpm/alpm_sandbox.h | 31 ++++ lib/libalpm/dload.c | 83 ++++++++- lib/libalpm/handle.c | 20 +++ lib/libalpm/handle.h | 2 + lib/libalpm/meson.build | 1 + meson.build | 11 +- src/pacman/conf.c | 23 ++- src/pacman/conf.h | 2 + src/pacman/pacman-conf.c | 6 + 11 files changed, 526 insertions(+), 4 deletions(-) create mode 100644 lib/libalpm/alpm_sandbox.c create mode 100644 lib/libalpm/alpm_sandbox.h diff --git lib/libalpm/alpm.h lib/libalpm/alpm.h index a5f4a6ae..f414d811 100644 --- lib/libalpm/alpm.h +++ lib/libalpm/alpm.h @@ -1837,6 +1837,11 @@ int alpm_option_set_gpgdir(alpm_handle_t *handle, const char *gpgdir); /* End of gpdir accessors */ /** @} */ +/** Sets the user to switch to for sensitive operations like downloading a file. + * @param handle the context handle + * @param sandboxuser the user to set + */ +int alpm_option_set_sandboxuser(alpm_handle_t *handle, const char *sandboxuser); /** @name Accessors for use syslog * @@ -1859,6 +1864,11 @@ int alpm_option_set_usesyslog(alpm_handle_t *handle, int usesyslog); /* End of usesyslog accessors */ /** @} */ +/** Sets whether to use sandboxing for sensitive operations like downloading a file (0 is FALSE, TRUE otherwise). + * @param handle the context handle + * @param usesandbox whether to use the sandboxing (0 is FALSE, TRUE otherwise) + */ +int alpm_option_set_usesandbox(alpm_handle_t *handle, int usesandbox); /** @name Accessors to the list of no-upgrade files. * These functions modify the list of files which should diff --git lib/libalpm/alpm_sandbox.c lib/libalpm/alpm_sandbox.c new file mode 100644 index 00000000..29f46d58 --- /dev/null +++ lib/libalpm/alpm_sandbox.c @@ -0,0 +1,341 @@ +/* + * sandbox.c + * + * Copyright (c) 2021 Pacman Development Team <pacman-dev(a)archlinux.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ + +#include <errno.h> +#include <fcntl.h> +#include <grp.h> +#include <pwd.h> +#include <sys/capability.h> +#include <sys/syscall.h> +#include <sys/types.h> +#include <unistd.h> + +#ifdef HAVE_LINUX_LANDLOCK_H +# include <linux/landlock.h> +# include <sys/prctl.h> +# include <sys/syscall.h> +#endif /* HAVE_LINUX_LANDLOCK_H */ + +#ifdef HAVE_LIBSECCOMP +# include <seccomp.h> +#endif /* HAVE_LIBSECCOMP */ + +#include "alpm_sandbox.h" + +#ifdef HAVE_LINUX_LANDLOCK_H +#ifndef landlock_create_ruleset +static inline int landlock_create_ruleset(const struct landlock_ruleset_attr *const attr, + const size_t size, const __u32 flags) +{ + return syscall(__NR_landlock_create_ruleset, attr, size, flags); +} +#endif /* landlock_create_ruleset */ + +#ifndef landlock_add_rule +static inline int landlock_add_rule(const int ruleset_fd, + const enum landlock_rule_type rule_type, + const void *const rule_attr, const __u32 flags) +{ + return syscall(__NR_landlock_add_rule, ruleset_fd, rule_type, rule_attr, flags); +} +#endif /* landlock_add_rule */ + +#ifndef landlock_restrict_self +static inline int landlock_restrict_self(const int ruleset_fd, const __u32 flags) +{ + return syscall(__NR_landlock_restrict_self, ruleset_fd, flags); +} +#endif /* landlock_restrict_self */ + +#define _LANDLOCK_ACCESS_FS_WRITE ( \ + LANDLOCK_ACCESS_FS_WRITE_FILE | \ + LANDLOCK_ACCESS_FS_REMOVE_DIR | \ + LANDLOCK_ACCESS_FS_REMOVE_FILE | \ + LANDLOCK_ACCESS_FS_MAKE_CHAR | \ + LANDLOCK_ACCESS_FS_MAKE_DIR | \ + LANDLOCK_ACCESS_FS_MAKE_REG | \ + LANDLOCK_ACCESS_FS_MAKE_SOCK | \ + LANDLOCK_ACCESS_FS_MAKE_FIFO | \ + LANDLOCK_ACCESS_FS_MAKE_BLOCK | \ + LANDLOCK_ACCESS_FS_MAKE_SYM) + +#define _LANDLOCK_ACCESS_FS_READ ( \ + LANDLOCK_ACCESS_FS_READ_FILE | \ + LANDLOCK_ACCESS_FS_READ_DIR) + +static int sandbox_write_only_beneath_cwd(void) +{ + const struct landlock_ruleset_attr ruleset_attr = { + .handled_access_fs = \ + _LANDLOCK_ACCESS_FS_READ | \ + _LANDLOCK_ACCESS_FS_WRITE | \ + LANDLOCK_ACCESS_FS_EXECUTE, + }; + struct landlock_path_beneath_attr path_beneath = { + .allowed_access = _LANDLOCK_ACCESS_FS_WRITE, + }; + int result = 0; + int ruleset_fd; + + ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0); + if(ruleset_fd < 0) { + return ruleset_fd; + } + + /* allow / as read-only */ + path_beneath.parent_fd = open("/", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | LANDLOCK_ACCESS_FS_EXECUTE; + + if(landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) { + result = errno; + } + + close(path_beneath.parent_fd); + + if(result == 0) { + /* allow the current working directory as read-write */ + path_beneath.parent_fd = open(".", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | LANDLOCK_ACCESS_FS_EXECUTE; + + if(!landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) { + if(landlock_restrict_self(ruleset_fd, 0)) { + result = errno; + } + } else { + result = errno; + } + + close(path_beneath.parent_fd); + + if(result == 0) { + /* allow /tmp as well */ + path_beneath.parent_fd = open("/tmp", O_PATH | O_CLOEXEC | O_DIRECTORY); + path_beneath.allowed_access = _LANDLOCK_ACCESS_FS_READ | _LANDLOCK_ACCESS_FS_WRITE | LANDLOCK_ACCESS_FS_EXECUTE; + + if(!landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH, &path_beneath, 0)) { + if(landlock_restrict_self(ruleset_fd, 0)) { + result = errno; + } + } else { + result = errno; + } + + close(path_beneath.parent_fd); + } + } + + close(ruleset_fd); + return result; +} +#endif /* HAVE_LINUX_LANDLOCK_H */ + +#ifdef HAVE_LIBSECCOMP + +static int sandbox_filter_syscalls(void) +{ + int ret = 0; + /* see https://docs.docker.com/engine/security/seccomp/ for inspiration, + as well as systemd's src/shared/seccomp-util.c */ + const char* denied_syscalls[] = { + /* kernel modules */ + "delete_module", + "finit_module", + "init_module", + /* mount */ + "chroot", + "fsconfig", + "fsmount", + "fsopen", + "fspick", + "mount", + "move_mount", + "open_tree", + "pivot_root", + "umount", + "umount2", + /* keyring */ + "add_key", + "keyctl", + "request_key", + /* CPU emulation */ + "modify_ldt", + "subpage_prot", + "switch_endian", + "vm86", + "vm86old", + /* debug */ + "kcmp", + "lookup_dcookie", + "perf_event_open", + "ptrace", + "rtas", + "sys_debug_setcontext", + /* set clock */ + "adjtimex", + "clock_adjtime", + "clock_adjtime64", + "clock_settime", + "clock_settime64", + "settimeofday", + /* raw IO */ + "ioperm", + "iopl", + "pciconfig_iobase", + "pciconfig_read", + "pciconfig_write", + /* kexec */ + "kexec_file_load", + "kexec_load", + /* reboot */ + "reboot", + /* privileged */ + "acct", + "bpf", + "personality", + /* obsolete */ + "_sysctl", + "afs_syscall", + "bdflush", + "break", + "create_module", + "ftime", + "get_kernel_syms", + "getpmsg", + "gtty", + "idle", + "lock", + "mpx", + "prof", + "profil", + "putpmsg", + "query_module", + "security", + "sgetmask", + "ssetmask", + "stime", + "stty", + "sysfs", + "tuxcall", + "ulimit", + "uselib", + "ustat", + "vserver", + /* swap */ + "swapon", + "swapoff", + }; + /* allow all syscalls that are not listed */ + size_t idx; + scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_ALLOW); + if(ctx == NULL) { + return errno; + } + + for(idx = 0; idx < sizeof(denied_syscalls) / sizeof(*denied_syscalls); idx++) { + int syscall = seccomp_syscall_resolve_name(denied_syscalls[idx]); + if(syscall != __NR_SCMP_ERROR) { + if(seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), syscall, 0) != 0) { + /* Do not fail but log something like: _("Error blocking syscall %s\n"), denied_syscalls[idx]); */ + } + } + } + + if(seccomp_load(ctx) != 0) { + ret = errno; + } + + seccomp_release(ctx); + return ret; +} +#endif /* HAVE_LIBSECCOMP */ + +static int switch_to_user(const char *user) +{ + struct passwd const *pw = NULL; + if(getuid() != 0) { + return 1; + } + pw = getpwnam(user); + if(pw == NULL) { + return errno; + } + if(setgid(pw->pw_gid) != 0) { + return errno; + } + if(setgroups(0, NULL)) { + return errno; + } + if(setuid(pw->pw_uid) != 0) { + return errno; + } + return 0; +} + +/* check exported library symbols with: nm -C -D <lib> */ +#define SYMEXPORT __attribute__((visibility("default"))) + +int SYMEXPORT alpm_sandbox_child(const char* sandboxuser) +{ + int result = 0; +#ifdef HAVE_LINUX_LANDLOCK_H + int ret = 0; +#endif/* HAVE_LINUX_LANDLOCK_H */ + + /* make sure that we cannot gain more privileges later */ + if(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) { + result = errno; + } + +#ifdef HAVE_LIBSECCOMP + result = sandbox_filter_syscalls(); +#endif /* HAVE_LIBSECCOMP */ + + if(sandboxuser != NULL) { + result = switch_to_user(sandboxuser); + } + +#ifdef HAVE_LIBCAP + /* we might have some capabilities remaining, + * especially if sandboxuser is not set */ + cap_t caps = cap_get_proc(); + cap_clear(caps); + if(cap_set_mode(CAP_MODE_NOPRIV) != 0) { + cap_free(caps); + if(result == 0) { + result = errno; + } + } + if(cap_set_proc(caps) != 0) { + cap_free(caps); + if(result == 0) { + result = errno; + } + } + cap_free(caps); +#endif /* HAVE_LIBCAP */ + +#ifdef HAVE_LINUX_LANDLOCK_H + ret = sandbox_write_only_beneath_cwd(); + if(result == 0) { + result = ret; + } +#endif /* HAVE_LINUX_LANDLOCK_H */ + + return result; +} diff --git lib/libalpm/alpm_sandbox.h lib/libalpm/alpm_sandbox.h new file mode 100644 index 00000000..47611575 --- /dev/null +++ lib/libalpm/alpm_sandbox.h @@ -0,0 +1,31 @@ +/* + * sandbox.h + * + * Copyright (c) 2021 Pacman Development Team <pacman-dev(a)archlinux.org> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see <http://www.gnu.org/licenses/>. + */ +#ifndef ALPM_SANDBOX_H +#define ALPM_SANDBOX_H + +#ifdef __cplusplus +extern "C" { +#endif + +int alpm_sandbox_child(const char *sandboxuser); + +#ifdef __cplusplus +} +#endif +#endif /* ALPM_SANDBOX_H */ diff --git lib/libalpm/dload.c lib/libalpm/dload.c index ca6be7b6..6bb06b4c 100644 --- lib/libalpm/dload.c +++ lib/libalpm/dload.c @@ -28,6 +28,7 @@ #include <sys/time.h> #include <sys/types.h> #include <sys/stat.h> +#include <sys/wait.h> #include <signal.h> #ifdef HAVE_NETINET_IN_H @@ -44,6 +45,7 @@ /* libalpm */ #include "dload.h" #include "alpm_list.h" +#include "alpm_sandbox.h" #include "alpm.h" #include "log.h" #include "util.h" @@ -898,6 +900,81 @@ static int curl_download_internal(alpm_handle_t *handle, #endif +static int curl_download_internal_sandboxed(alpm_handle_t *handle, + alpm_list_t *payloads /* struct dload_payload */, + const char *localpath) +{ + int pid, err = 0, ret = -1, err_fd[2]; + sigset_t oldblock; + struct sigaction sa_ign = { .sa_handler = SIG_IGN }, oldint, oldquit; + + if(pipe(err_fd) != 0) { + return -1; + } + + sigaction(SIGINT, &sa_ign, &oldint); + sigaction(SIGQUIT, &sa_ign, &oldquit); + sigaddset(&sa_ign.sa_mask, SIGCHLD); + sigprocmask(SIG_BLOCK, &sa_ign.sa_mask, &oldblock); + + pid = fork(); + + /* child */ + if(pid == 0) { + close(err_fd[0]); + fcntl(err_fd[1], F_SETFD, FD_CLOEXEC); + + /* restore signal handling for the child to inherit */ + sigaction(SIGINT, &oldint, NULL); + sigaction(SIGQUIT, &oldquit, NULL); + sigprocmask(SIG_SETMASK, &oldblock, NULL); + + /* cwd to the download directory */ + ret = chdir(localpath); + if(ret != 0) { + _alpm_log(handle, ALPM_LOG_WARNING, _("could not chdir to download directory %s\n"), localpath); + ret = -1; + } else { + ret = alpm_sandbox_child(handle->sandboxuser); + if (ret != 0) { + _alpm_log(handle, ALPM_LOG_WARNING, _("sandboxing failed!\n")); + } + + ret = curl_download_internal(handle, payloads, localpath); + } + + /* pass the result back to the parent */ + while(write(err_fd[1], &ret, sizeof(ret)) == -1 && errno == EINTR); + _Exit(ret < 0 ? 1 : 0); + } + + /* parent */ + close(err_fd[1]); + + if(pid != -1) { + int wret; + while((wret = waitpid(pid, &ret, 0)) == -1 && errno == EINTR); + if(wret > 0) { + while(read(err_fd[0], &ret, sizeof(ret)) == -1 && errno == EINTR); + } + } else { + /* fork failed, make sure errno is preserved after cleanup */ + err = errno; + } + + close(err_fd[0]); + + sigaction(SIGINT, &oldint, NULL); + sigaction(SIGQUIT, &oldquit, NULL); + sigprocmask(SIG_SETMASK, &oldblock, NULL); + + if(err) { + errno = err; + ret = -1; + } + return ret; +} + /* Returns -1 if an error happened for a required file * Returns 0 if a payload was actually downloaded * Returns 1 if no files were downloaded and all errors were non-fatal @@ -908,7 +985,11 @@ int _alpm_download(alpm_handle_t *handle, { if(handle->fetchcb == NULL) { #ifdef HAVE_LIBCURL - return curl_download_internal(handle, payloads, localpath); + if(handle->usesandbox) { + return curl_download_internal_sandboxed(handle, payloads, localpath); + } else { + return curl_download_internal(handle, payloads, localpath); + } #else RET_ERR(handle, ALPM_ERR_EXTERNAL_DOWNLOAD, -1); #endif diff --git lib/libalpm/handle.c lib/libalpm/handle.c index e6b683cb..10ae44b2 100644 --- lib/libalpm/handle.c +++ lib/libalpm/handle.c @@ -573,6 +573,19 @@ int SYMEXPORT alpm_option_set_gpgdir(alpm_handle_t *handle, const char *gpgdir) return 0; } +int SYMEXPORT alpm_option_set_sandboxuser(alpm_handle_t *handle, const char *sandboxuser) +{ + CHECK_HANDLE(handle, return -1); + if(handle->sandboxuser) { + FREE(handle->sandboxuser); + } + + STRDUP(handle->sandboxuser, sandboxuser, RET_ERR(handle, ALPM_ERR_MEMORY, -1)); + + _alpm_log(handle, ALPM_LOG_DEBUG, "option 'sandboxuser' = %s\n", handle->sandboxuser); + return 0; +} + int SYMEXPORT alpm_option_set_usesyslog(alpm_handle_t *handle, int usesyslog) { CHECK_HANDLE(handle, return -1); @@ -580,6 +593,13 @@ int SYMEXPORT alpm_option_set_usesyslog(alpm_handle_t *handle, int usesyslog) return 0; } +int SYMEXPORT alpm_option_set_usesandbox(alpm_handle_t *handle, int usesandbox) +{ + CHECK_HANDLE(handle, return -1); + handle->usesandbox = usesandbox; + return 0; +} + static int _alpm_option_strlist_add(alpm_handle_t *handle, alpm_list_t **list, const char *str) { char *dup; diff --git lib/libalpm/handle.h lib/libalpm/handle.h index b1526c67..43550833 100644 --- lib/libalpm/handle.h +++ lib/libalpm/handle.h @@ -90,6 +90,7 @@ struct __alpm_handle_t { char *logfile; /* Name of the log file */ char *lockfile; /* Name of the lock file */ char *gpgdir; /* Directory where GnuPG files are stored */ + char *sandboxuser; /* User to switch to for sensitive operations like downloading files */ alpm_list_t *cachedirs; /* Paths to pacman cache directories */ alpm_list_t *hookdirs; /* Paths to hook directories */ alpm_list_t *overwrite_files; /* Paths that may be overwritten */ @@ -104,6 +105,7 @@ struct __alpm_handle_t { /* options */ alpm_list_t *architectures; /* Architectures of packages we should allow */ int usesyslog; /* Use syslog instead of logfile? */ /* TODO move to frontend */ + int usesandbox; /* Whether to enable sandboxing for sensitive operations like downloading files */ int checkspace; /* Check disk space before installing */ char *dbext; /* Sync DB extension */ int siglevel; /* Default signature verification level */ diff --git lib/libalpm/meson.build lib/libalpm/meson.build index 607e91a3..c36ae516 100644 --- lib/libalpm/meson.build +++ lib/libalpm/meson.build @@ -2,6 +2,7 @@ libalpm_sources = files(''' add.h add.c alpm.h alpm.c alpm_list.h alpm_list.c + alpm_sandbox.h alpm_sandbox.c backup.h backup.c base64.h base64.c be_local.c diff --git meson.build meson.build index 26c92b8e..88f0e3a1 100644 --- meson.build +++ meson.build @@ -91,6 +91,10 @@ libarchive = dependency('libarchive', version : '>=3.0.0', static : get_option('buildstatic')) +libcap = dependency('libcap', + static : get_option('buildstatic')) +conf.set('HAVE_LIBCAP', libcap.found()) + libcurl = dependency('libcurl', version : '>=7.55.0', required : get_option('curl'), @@ -120,7 +124,12 @@ else error('unhandled crypto value @0@'.format(want_crypto)) endif +libseccomp = dependency('libseccomp', + static : get_option('buildstatic')) +conf.set('HAVE_LIBSECCOMP', libseccomp.found()) + foreach header : [ + 'linux/landlock.h', 'mntent.h', 'sys/mnttab.h', 'sys/mount.h', @@ -305,7 +314,7 @@ libcommon = static_library( gnu_symbol_visibility : 'hidden', install : false) -alpm_deps = [crypto_provider, libarchive, libcurl, libintl, gpgme] +alpm_deps = [crypto_provider, libarchive, libcap, libcurl, libintl, libseccomp, gpgme] libalpm_a = static_library( 'alpm_objlib', diff --git src/pacman/conf.c src/pacman/conf.c index 12fee64c..9480a492 100644 --- src/pacman/conf.c +++ src/pacman/conf.c @@ -33,6 +33,8 @@ #include <unistd.h> #include <signal.h> +#include <alpm_sandbox.h> + /* pacman */ #include "conf.h" #include "ini.h" @@ -215,7 +217,7 @@ static char *get_tempfile(const char *path, const char *filename) * - not thread-safe * - errno may be set by fork(), pipe(), or execvp() */ -static int systemvp(const char *file, char *const argv[]) +static int systemvp(const char *file, char *const argv[], bool sandbox, const char *sandboxuser) { int pid, err = 0, ret = -1, err_fd[2]; sigset_t oldblock; @@ -242,6 +244,13 @@ static int systemvp(const char *file, char *const argv[]) sigaction(SIGQUIT, &oldquit, NULL); sigprocmask(SIG_SETMASK, &oldblock, NULL); + if (sandbox) { + ret = alpm_sandbox_child(sandboxuser); + if (ret != 0) { + pm_printf(ALPM_LOG_WARNING, _("sandboxing failed!\n")); + } + } + execvp(file, argv); /* execvp failed, pass the error back to the parent */ @@ -352,7 +361,7 @@ static int download_with_xfercommand(void *ctx, const char *url, free(cmd); } } - retval = systemvp(argv[0], (char**)argv); + retval = systemvp(argv[0], (char**)argv, config->usesandbox, config->sandboxuser); if(retval == -1) { pm_printf(ALPM_LOG_WARNING, _("running XferCommand: fork failed!\n")); @@ -601,6 +610,9 @@ static int _parse_options(const char *key, char *value, if(strcmp(key, "UseSyslog") == 0) { config->usesyslog = 1; pm_printf(ALPM_LOG_DEBUG, "config: usesyslog\n"); + } else if(strcmp(key, "UseSandbox") == 0) { + config->usesandbox = 1; + pm_printf(ALPM_LOG_DEBUG, "config: usesandbox\n"); } else if(strcmp(key, "ILoveCandy") == 0) { config->chomp = 1; pm_printf(ALPM_LOG_DEBUG, "config: chomp\n"); @@ -668,6 +680,11 @@ static int _parse_options(const char *key, char *value, config->logfile = strdup(value); pm_printf(ALPM_LOG_DEBUG, "config: logfile: %s\n", value); } + } else if(strcmp(key, "SandboxUser") == 0) { + if(!config->sandboxuser) { + config->sandboxuser = strdup(value); + pm_printf(ALPM_LOG_DEBUG, "config: sandboxuser: %s\n", value); + } } else if(strcmp(key, "XferCommand") == 0) { char **c; if((config->xfercommand_argv = wordsplit(value)) == NULL) { @@ -904,6 +921,8 @@ static int setup_libalpm(void) alpm_option_set_architectures(handle, config->architectures); alpm_option_set_checkspace(handle, config->checkspace); alpm_option_set_usesyslog(handle, config->usesyslog); + alpm_option_set_usesandbox(handle, config->usesandbox); + alpm_option_set_sandboxuser(handle, config->sandboxuser); alpm_option_set_ignorepkgs(handle, config->ignorepkg); alpm_option_set_ignoregroups(handle, config->ignoregrp); diff --git src/pacman/conf.h src/pacman/conf.h index 04350d39..8fced284 100644 --- src/pacman/conf.h +++ src/pacman/conf.h @@ -55,6 +55,7 @@ typedef struct __config_t { unsigned short print; unsigned short checkspace; unsigned short usesyslog; + unsigned short usesandbox; unsigned short color; unsigned short disable_dl_timeout; char *print_format; @@ -67,6 +68,7 @@ typedef struct __config_t { char *logfile; char *gpgdir; char *sysroot; + char *sandboxuser; alpm_list_t *hookdirs; alpm_list_t *cachedirs; alpm_list_t *architectures; diff --git src/pacman/pacman-conf.c src/pacman/pacman-conf.c index 600f1622..6da27937 100644 --- src/pacman/pacman-conf.c +++ src/pacman/pacman-conf.c @@ -251,6 +251,7 @@ static void dump_config(void) show_list_str("HookDir", config->hookdirs); show_str("GPGDir", config->gpgdir); show_str("LogFile", config->logfile); + show_str("SandboxUser", config->sandboxuser); show_list_str("HoldPkg", config->holdpkg); show_list_str("IgnorePkg", config->ignorepkg); @@ -268,6 +269,7 @@ static void dump_config(void) show_bool("DisableDownloadTimeout", config->disable_dl_timeout); show_bool("ILoveCandy", config->chomp); show_bool("NoProgressBar", config->noprogressbar); + show_bool("UseSandbox", config->usesandbox); show_int("ParallelDownloads", config->parallel_downloads); @@ -349,6 +351,8 @@ static int list_directives(void) show_str("GPGDir", config->gpgdir); } else if(strcasecmp(i->data, "LogFile") == 0) { show_str("LogFile", config->logfile); + } else if(strcasecmp(i->data, "SandboxUser") == 0) { + show_str("SandboxUser", config->sandboxuser); } else if(strcasecmp(i->data, "HoldPkg") == 0) { show_list_str("HoldPkg", config->holdpkg); @@ -369,6 +373,8 @@ static int list_directives(void) } else if(strcasecmp(i->data, "UseSyslog") == 0) { show_bool("UseSyslog", config->usesyslog); + } else if(strcasecmp(i->data, "UseSandbox") == 0) { + show_bool("UseSandbox", config->usesandbox); } else if(strcasecmp(i->data, "Color") == 0) { show_bool("Color", config->color); } else if(strcasecmp(i->data, "CheckSpace") == 0) { -- 2.33.0

1 0

[pacman-dev] [PATCH] pacman-key: Add --quiet to a few more gpg invocations
by Daan De Meyer 26 Aug '21

26 Aug '21

Currently, when running pacman-key --populate, gpg prints the trustdb check output once for each locally signed and revoked key. When bootstrapping a new container image, about 50 keys get signed and revoked which leads to a huge amount of output when running pacman-key which is the following text repeated 50x ``` gpg: checking the trustdb gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 786C63F330D7CB92: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: key 1EB2638FF56C0C53: no user ID for key signature packet of class 10 gpg: marginals needed: 3 completes needed: 1 trust model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 83 trust: 0-, 0q, 0n, 6m, 0f, 0u gpg: depth: 2 valid: 78 signed: 25 trust: 78-, 0q, 0n, 0m, 0f, 0u gpg: next trustdb check due at 2021-12-01 ``` To avoid overloading the user with gpg output, we add --quiet to the gpg calls generating the trustdb checking output to silence those calls which gets rid of the trustdb check output on the terminal. Signed-off-by: Daan De Meyer <daan.j.demeyer(a)gmail.com> --- scripts/pacman-key.sh.in | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/pacman-key.sh.in b/scripts/pacman-key.sh.in index 50342649..0526532f 100644 --- a/scripts/pacman-key.sh.in +++ b/scripts/pacman-key.sh.in @@ -192,7 +192,7 @@ check_keyids_exist() { } key_is_lsigned() { - secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key | awk -F : 'NR==1 {print $5}') + secret_key=$("${GPG_PACMAN[@]}" --with-colons --list-secret-key --quiet | awk -F : 'NR==1 {print $5}') while IFS=: read -r type valid _ _ sign_key _; do if [[ $type != "sig" || $valid != "!" ]]; then continue @@ -200,7 +200,7 @@ key_is_lsigned() { if [[ "$sign_key" == "$secret_key" ]]; then return 0 fi - done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures "$1") + done < <("${GPG_PACMAN[@]}" --with-colons --check-signatures --quiet "$1") return 1 } @@ -212,7 +212,7 @@ key_is_revoked() { if [[ $flags == *"D"* ]]; then return 0 fi - done < <("${GPG_PACMAN[@]}" --with-colons --list-key "$1") + done < <("${GPG_PACMAN[@]}" --with-colons --list-key --quiet "$1") return 1 } -- 2.33.0

2 4

[pacman-dev] [PATCH] pacman: improve backup printing
by morganamilo 16 Aug '21

16 Aug '21

The current backup printing does not fit in with the rest of the info at all. Change to be more consistant. Old: Backup Files : MODIFIED /etc/pacman.conf UNMODIFIED /etc/makepkg.conf New: Backup Files : /etc/pacman.conf [modified] /etc/makepkg.conf [unmodified] Signed-off-by: morganamilo <morganamilo(a)archlinux.org> --- src/pacman/package.c | 52 ++++++++++++++++++++++++-------------------- src/pacman/package.h | 2 +- 2 files changed, 30 insertions(+), 24 deletions(-) diff --git a/src/pacman/package.c b/src/pacman/package.c index eaee3bb0..d4733405 100644 --- a/src/pacman/package.c +++ b/src/pacman/package.c @@ -348,7 +348,7 @@ void dump_pkg_full(alpm_pkg_t *pkg, int extra) /* Print additional package info if info flag passed more than once */ if(from == ALPM_PKG_FROM_LOCALDB && extra) { - dump_pkg_backups(pkg); + dump_pkg_backups(pkg, cols); } /* final newline to separate packages */ @@ -379,21 +379,21 @@ static const char *get_backup_file_status(const char *root, /* if checksums don't match, file has been modified */ if(strcmp(md5sum, backup->hash) != 0) { - ret = "MODIFIED"; + ret = "[modified]"; } else { - ret = "UNMODIFIED"; + ret = "[unmodified]"; } free(md5sum); } else { switch(errno) { case EACCES: - ret = "UNREADABLE"; + ret = "[unreadable]"; break; case ENOENT: - ret = "MISSING"; + ret = "[missing]"; break; default: - ret = "UNKNOWN"; + ret = "[unknown]"; } } return ret; @@ -401,27 +401,33 @@ static const char *get_backup_file_status(const char *root, /* Display list of backup files and their modification states */ -void dump_pkg_backups(alpm_pkg_t *pkg) +void dump_pkg_backups(alpm_pkg_t *pkg, unsigned short cols) { - alpm_list_t *i; + alpm_list_t *i, *text = NULL; const char *root = alpm_option_get_root(config->handle); - printf("%s%s\n%s", config->colstr.title, titles[T_BACKUP_FILES], - config->colstr.nocolor); - if(alpm_pkg_get_backup(pkg)) { - /* package has backup files, so print them */ - for(i = alpm_pkg_get_backup(pkg); i; i = alpm_list_next(i)) { - const alpm_backup_t *backup = i->data; - const char *value; - if(!backup->hash) { - continue; - } - value = get_backup_file_status(root, backup); - printf("%s\t%s%s\n", value, root, backup->name); + /* package has backup files, so print them */ + for(i = alpm_pkg_get_backup(pkg); i; i = alpm_list_next(i)) { + const alpm_backup_t *backup = i->data; + const char *value; + char *line; + size_t needed; + if(!backup->hash) { + continue; } - } else { - /* package had no backup files */ - printf(_("(none)\n")); + value = get_backup_file_status(root, backup); + needed = strlen(root) + strlen(backup->name) + 1 + strlen(value) + 1; + line = malloc(needed); + if(!line) { + goto cleanup; + } + sprintf(line, "%s%s %s", root, backup->name, value); + text = alpm_list_add(text, line); } + + list_display_linebreak(titles[T_BACKUP_FILES], text, cols); + +cleanup: + FREELIST(text); } /* List all files contained in a package diff --git a/src/pacman/package.h b/src/pacman/package.h index c1f3d5b3..809be776 100644 --- a/src/pacman/package.h +++ b/src/pacman/package.h @@ -24,7 +24,7 @@ void dump_pkg_full(alpm_pkg_t *pkg, int extra); -void dump_pkg_backups(alpm_pkg_t *pkg); +void dump_pkg_backups(alpm_pkg_t *pkg, unsigned short cols); void dump_pkg_files(alpm_pkg_t *pkg, int quiet); void dump_pkg_changelog(alpm_pkg_t *pkg); -- 2.32.0

1 0

[pacman-dev] [PATCH] Order downloads by descending max_size
by Charlie Sale 12 Aug '21

12 Aug '21

When downloading in parallel, sort by package size so that the larger packages are queued first to fully leverage parallelism. Addresses FS#70172 Signed-off-by: Charlie Sale <softwaresale01(a)gmail.com> --- lib/libalpm/dload.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/lib/libalpm/dload.c b/lib/libalpm/dload.c index ca6be7b6..58d2122f 100644 --- a/lib/libalpm/dload.c +++ b/lib/libalpm/dload.c @@ -825,6 +825,19 @@ cleanup: return ret; } +/* + * Use to sort payloads by max size in decending order (largest -> smallest) + */ +static int compare_dload_payload_sizes(const void *left_ptr, const void *right_ptr) +{ + struct dload_payload *left, *right; + + left = (struct dload_payload *) left_ptr; + right = (struct dload_payload *) right_ptr; + + return right->max_size - left->max_size; +} + /* Returns -1 if an error happened for a required file * Returns 0 if a payload was actually downloaded * Returns 1 if no files were downloaded and all errors were non-fatal @@ -838,6 +851,10 @@ static int curl_download_internal(alpm_handle_t *handle, int max_streams = handle->parallel_downloads; int updated = 0; /* was a file actually updated */ CURLM *curlm = handle->curlm; + size_t payloads_size = alpm_list_count(payloads); + + /* Sort payloads by package size */ + payloads = alpm_list_msort(payloads, payloads_size, &compare_dload_payload_sizes); while(active_downloads_num > 0 || payloads) { CURLMcode mc; -- 2.32.0

3 3

[pacman-dev] Packaging Con 2021
by Wolf Vollprecht 12 Aug '21

12 Aug '21

Hi all, we're organizing a conference about software package management: https://packaging-con.org/ It's the first time that this event happens: we are trying to bring together many different package management communities, compare approaches, share lessons learned, etc. It would be great to see people from the pacman community there – and maybe even a talk?! The call for presentations ends on August 31. Let me know if you have any questions or ideas for the conference! Best, Wolf

1 0

Re: [pacman-dev] Probléme WITH Pacman
by Morgan Adamiec 08 Aug '21

08 Aug '21

On 08/08/2021 02:20, Lahrech Rafik wrote: > Hey > I have a big problém with pacman i cant update anything it show that > there is err like this > I cant find a solution can you help ??? > > "erreur : l’ouverture du fichier /var/lib/pacman/sync/extra.db a > échoué : Unrecognized archive format " > erreur : l’ouverture du fichier /var/lib/pacman/sync/extra.db a échoué : > Unrecognized archive format > erreur : l’ouverture du fichier /var/lib/pacman/sync/community.db a > échoué : Unrecognized archive format > erreur : l’ouverture du fichier /var/lib/pacman/sync/multilib.db a > échoué : Unrecognized archive format " > Merci R-L > error 1 bugs.png > Capture d’écran_2021-08-08_03-13-44.png > This isn't a support form but it's probably it's probably that mirror that went down and now serves html instead of the database.

1 0

[pacman-dev] [PATCH] libmakepkg: reproducibilty for python packages
by Allan McRae 08 Aug '21

08 Aug '21

Arch Linux has been setting PYTHONHASHSEED=0 to create deterministic .pyc files. After a thorough review by the Arch Security Team, setting this variable was determined not to generated vulnerable .pyc files, as when the loader loads the .pyc file and unmarshalls it, the internal runtime will just populate the unordered data structures and use a new runtime hash for them. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- Despite effectively being a 1 line patch to add "export PYTHONHASHSEED=0", I decided to add a libmakepkg submodule dedicated to reproducible packages. This way anybody can drop in mdoules to test easily. I'd like to include this for pacman-6.0.1. It is a bit more than I would usually like to include in a point release, but it is an easy win to for the reproducibile builds effort. Any objections to including it? scripts/libmakepkg/meson.build | 1 + scripts/libmakepkg/reproducible.sh.in | 29 ++++++++++++++++++++ scripts/libmakepkg/reproducible/meson.build | 17 ++++++++++++ scripts/libmakepkg/reproducible/python.sh.in | 29 ++++++++++++++++++++ 4 files changed, 76 insertions(+) create mode 100644 scripts/libmakepkg/reproducible.sh.in create mode 100644 scripts/libmakepkg/reproducible/meson.build create mode 100644 scripts/libmakepkg/reproducible/python.sh.in diff --git a/scripts/libmakepkg/meson.build b/scripts/libmakepkg/meson.build index b0697f78..50eb905b 100644 --- a/scripts/libmakepkg/meson.build +++ b/scripts/libmakepkg/meson.build @@ -5,6 +5,7 @@ libmakepkg_modules = [ { 'name' : 'lint_config', 'has_subdir' : true }, { 'name' : 'lint_package', 'has_subdir' : true }, { 'name' : 'lint_pkgbuild', 'has_subdir' : true }, + { 'name' : 'reproducible', 'has_subdir' : true }, { 'name' : 'source', 'has_subdir' : true }, { 'name' : 'srcinfo', }, { 'name' : 'tidy', 'has_subdir' : true }, diff --git a/scripts/libmakepkg/reproducible.sh.in b/scripts/libmakepkg/reproducible.sh.in new file mode 100644 index 00000000..7db2a3cc --- /dev/null +++ b/scripts/libmakepkg/reproducible.sh.in @@ -0,0 +1,29 @@ +#!/bin/bash +# +# reproducible.sh - utilities for improving package reproducibility +# +# Copyright (c) 2021 Pacman Development Team <pacman-dev(a)archlinux.org> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +[[ -n "$LIBMAKEPKG_REPRODUCIBLE_SH" ]] && return +LIBMAKEPKG_REPRODUCIBLE_SH=1 + +LIBRARY=${LIBRARY:-'@libmakepkgdir@'} + + +for lib in "$LIBRARY/reproducible/"*.sh; do + source "$lib" +done diff --git a/scripts/libmakepkg/reproducible/meson.build b/scripts/libmakepkg/reproducible/meson.build new file mode 100644 index 00000000..0738fe9c --- /dev/null +++ b/scripts/libmakepkg/reproducible/meson.build @@ -0,0 +1,17 @@ +libmakepkg_module = 'reproducible' + +sources = [ + 'python.sh.in', +] + +foreach src : sources + output_dir = join_paths(get_option('datadir'), 'makepkg', libmakepkg_module) + + custom_target( + libmakepkg_module + '_' + src.underscorify(), + command : [ SCRIPT_EDITOR, '@INPUT@', '@OUTPUT@' ], + input : src, + output : '@BASENAME@', + install : true, + install_dir : output_dir) +endforeach diff --git a/scripts/libmakepkg/reproducible/python.sh.in b/scripts/libmakepkg/reproducible/python.sh.in new file mode 100644 index 00000000..45fd4521 --- /dev/null +++ b/scripts/libmakepkg/reproducible/python.sh.in @@ -0,0 +1,29 @@ +#!/bin/bash +# +# python.sh - creating reproducible python packages +# +# Copyright (c) 2021 Pacman Development Team <pacman-dev(a)archlinux.org> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +[[ -n "$LIBMAKEPKG_REPRODUCIBLE_PYTHON_SH" ]] && return +LIBMAKEPKG_REPRODUCIBLE_PYTHON_SH=1 + + +LIBRARY=${LIBRARY:-'@libmakepkgdir@'} + + +# disable hash randomization when creating .pyc files +export PYTHONHASHSEED=0 -- 2.32.0

1 0

[pacman-dev] [PATCH] Gitlab CI: add bsdtar to Fedora install
by Allan McRae 04 Aug '21

04 Aug '21

Signed-off-by: Allan McRae <allan(a)archlinux.org> --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 507e1332..668b97ba 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -103,7 +103,7 @@ fedora: - > dnf -y install git findutils patch sed - meson gcc libtool + meson gcc libtool bsdtar gpgme-devel libarchive-devel libcurl-devel openssl-devel gettext-devel asciidoc python3 dash gawk fakeroot fakechroot -- 2.32.0

1 0

[pacman-dev] [PATCH] PKGBUILD.5: Fix typo
by Andre Schröder 04 Aug '21

04 Aug '21

Signed-off-by: André Schröder <andre.schroedr(a)gmail.com> --- doc/PKGBUILD.5.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/PKGBUILD.5.asciidoc b/doc/PKGBUILD.5.asciidoc index d207d92d..dee15f5e 100644 --- a/doc/PKGBUILD.5.asciidoc +++ b/doc/PKGBUILD.5.asciidoc @@ -361,7 +361,7 @@ function. is skipped. *build() Function*:: - The optional `build()` function is use to compile and/or adjust the source + The optional `build()` function is used to compile and/or adjust the source files in preparation to be installed by the `package()` function. *check() Function*:: -- 2.32.0

2 2

[pacman-dev] [PATCH] makepkg: fix stripping of relocatable binaries with binutils>=2.37
by Allan McRae 04 Aug '21

04 Aug '21

Binutils commit 93df3340fd5ad32f784214fc125de71811da72ff enabled readelf to report "Position-Independent Executable" files. Fix stripping to account for this change. Signed-off-by: Allan McRae <allan(a)archlinux.org> --- scripts/libmakepkg/tidy/strip.sh.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/libmakepkg/tidy/strip.sh.in b/scripts/libmakepkg/tidy/strip.sh.in index 5d03b28f..96602538 100644 --- a/scripts/libmakepkg/tidy/strip.sh.in +++ b/scripts/libmakepkg/tidy/strip.sh.in @@ -135,6 +135,8 @@ tidy_strip() { case "$(LC_ALL=C readelf -h "$binary" 2>/dev/null)" in *Type:*'DYN (Shared object file)'*) # Libraries (.so) or Relocatable binaries strip_flags="$STRIP_SHARED";; + *Type:*'DYN (Position-Independent Executable file)'*) # Relocatable binaries + strip_flags="$STRIP_SHARED";; *Type:*'EXEC (Executable file)'*) # Binaries strip_flags="$STRIP_BINARIES";; *Type:*'REL (Relocatable file)'*) # Libraries (.a) or objects -- 2.32.0

1 0