An issue was discovered in disable_priv_mode in shell.c in GNU Bash
through 5.0 patch 11. By default, if Bash is run with its effective UID
not equal to its real UID, it will drop privileges by setting its
effective UID to its real UID. However, it does so incorrectly. On Linux
and other systems that support "saved UID" functionality, the saved UID
is not dropped. An attacker with command execution in the shell can use
"enable -f" for runtime loading of a new builtin, which can be a shared
object that calls setuid() and therefore regains privileges. However,
binaries running with an effective UID of 0 are unaffected.
Get the patch from [1] to fix the issue.
[1] https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=951bdaa
(From OE-Core rev: 6f01acae9c279e0a580f46d1ba4c015caa3f8c2c)
Signed-off-by: De Huo <De.Huo@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
patch 17 :-
https://ftp.gnu.org/gnu/bash/bash-5.0-patches/bash50-017
There were cases where patch 16 reaped process substitution file
descriptors (or FIFOs) and processes to early. This is a better
fix for the problem that bash50-016 attempted to solve.
path 18 :-
https://ftp.gnu.org/gnu/bash/bash-5.0-patches/bash50-018
In certain cases, bash does not perform quoted null removal on
patterns that are used as part of word expansions such as
${parameter##pattern}, so empty patterns are treated as non-empty.
(From OE-Core rev: 08f8580b1ad2a478538f6974e79cb79e726b6efa)
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The execscript test in bash fails when run with ptest-runner calling
'su', with the error:
bash: cannot set terminal process group (16036): Inappropriate ioctl for device
Even with ptest-runner fixed to make a child process use the right
process group, 'su' still results in the warning above. Use 'setpriv'
instead. 'runuser' was considered and works but depends on pam so it's
ruled out.
Now that all bash tests are run as a user, the patch:
fix-run-coproc-run-heredoc-run-execscript-run-test-f.patch
can be removed. Also to create the account 'bashtest' in the
'run-ptest' script the bash-ptest must depend on 'shadow'. Also,
in 'run-ptest', ensure that the bash ptests are owned by the 'bashtest' user.
Add 'sed' as a dependency for ptests since tests/exp8.sub runs:
var=$'x\001y\177z'
declare -p var | sed -n l
and that results in:
sed.busybox: ""
sed.sed: declare -- var="x\001y\177z"$
This appears to be a feature that busybox sed has not implemented.
With this series of changes, bash-ptest for qemux86-64 passes
79 of 81 tests. The remaining failures are:
1. run-read:
# cat tests/read6.sub
# test read with a timeout of 0 -- input polling
# sleep with fractional seconds argument is not universal
echo abcde | { sleep 0.25 2>/dev/null ; read -t 0; }
echo $?
read -t 0 < $0
echo $?
read -t 0
echo $? <-- returns 1, when 0 is expected.
I can reproduce this on my workstation but only when using ptest-runner
and initially logging into the console as root. That's a little odd and
seems like I need to continue to improve ptest-runner.
2. run-trap:
# cat tests/trap3.sub
PS4='+[$LINENO] '
trap 'echo trap: $LINENO' ERR
set -x
echo 1
echo 2
echo 3 | cat | false <--- error
echo 4
This is a scheduler behaviour difference between the common case
on a workstation and the common case in qemu. The test case does
warn about the completion order not being deterministic so I plan
to ignore it.
>From tests/run-trap:
UNIX versions number signals and schedule processes differently.
If output differing only in line numbers is produced, please
do not consider this a test failure.
Still, it's notable and slightly odd that the common case output
is different.
(From OE-Core rev: 81e3f01867cf114b728ab5a417c29426c9bf8122)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Rebase build-tests.patch and execute_cmd.patch to 5.0
- Drop 0001-help-fix-printf-format-security-warning.patch
and pathexp-dep.patch, upstream has fixed them in commit
[d233b48 bash-5.0 distribution sources and documentation]
(From OE-Core rev: db044235e72a1519a081c4f6541f7d7cfe70d49f)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
