From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 19E1D1F905; Wed, 19 Nov 2025 23:59:19 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 786661F867; Wed, 19 Nov 2025 23:59:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-yx1-xb130.google.com (mail-yx1-xb130.google.com [IPv6:2607:f8b0:4864:20::b130]) by atuin.qyliss.net (Postfix) with ESMTPS id D17E11F863 for ; Wed, 19 Nov 2025 23:59:14 +0000 (UTC) Received: by mail-yx1-xb130.google.com with SMTP id 956f58d0204a3-63bc1aeb427so249198d50.3 for ; Wed, 19 Nov 2025 15:59:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763596752; x=1764201552; darn=spectrum-os.org; h=in-reply-to:autocrypt:from:content-language:references:cc:to :subject:user-agent:mime-version:date:message-id:from:to:cc:subject :date:message-id:reply-to; bh=ljgw2nX77N/YTu8trnBJ7fVyNLnQZRk9S4W3oPSbMjU=; b=iYmqeV/qdrRJ1mugMZbhYrVrDkzdMbbkmpZBdghX74yn2wlqG5mPeTg310/RKdyty8 mNHrjD2qQxN1/LkqCSuNnoYcVUCvAgscZYPQqNuUW27j4NCmnj5EDwBR4PM0k38f7b7h Ugy+xxtlXtyL/RhzPSsEMMevSv1notofrtoU4IbZkgsHd9tieqMyJ2rELk7+mRoqOWfU EfVEWTCIcyNgH6BtG5ud1BJlLX5kh6MLfFruCV+VozOkuVMGczuxVb/Q+AdTPf4H2GlG +6f2ifBEYM4lXlqnkWhwGlkf3VECTy48j1QhKMv42aTBsqw9bpiXc6OIETu2Gt9CIMpJ mLSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763596752; x=1764201552; h=in-reply-to:autocrypt:from:content-language:references:cc:to :subject:user-agent:mime-version:date:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ljgw2nX77N/YTu8trnBJ7fVyNLnQZRk9S4W3oPSbMjU=; b=hF/vwyWRlgUVvTQOhbzLrduinRVTW/lGey/9psTQ4TB8i0L2zZkbBT6PKuYXl72vBv aUyEDscxcDhhJiHGannxjIoa1LkspM68aKL9cC83CNKsOeA+K1oULcCApEYVfx36GYFL ecpaef+9iFaH67jCVFUNnfI6Bjx4qmY4Sw+M9uOcZQDwN1Y1DM3GA0dGZe+uAoBuMsQt H4DnwUJwNV5k0qVh7DHqEP+J7pdT8DaWWHUPKQpEzo01e/NwiyVnv/orLy7EOje/rf+z ZacGwrPOJO0HlX3Aa9hbiu7yYUbXb8K8T/+pyqKfupZfCJZBD2D5gQtnUnldezGnBED1 d/Qw== X-Gm-Message-State: AOJu0YxpeTF9d9dQRLD4YfDESG95O5L1jZT2rlmKPXoQgc0lC0lC/i4n ANKbzp9MPPCiin3e2KhT+vZnax0lGZPC/qBulkn8HlVHcIX5XPGaRTX/ X-Gm-Gg: ASbGncvjQKI1AHG+5bgEFY+d3rGFQigKLCninjPKnUzkIgGlPgSkmAo/5hXlkybdJKa GujEZtxCbmHx/piYNil8yVDDB2jTN3673UIbtVbhBNDIECYA2kpT4zmoWqgZ+xCLTzHH4PPGZfE IpXEjk+C6gewinpl2I1glLLZuYpK6Jls50fLh+N44wEEBs1VBDsDgomDB0qF87WJ2kwoDwubPvh Fa5LTBt61kncyIQZDa7u2SfKiCjPvT2Vj2YzhihsOFZkBnSsK225egGBCXdl8U5b9kWYq7eVRIU 099OcGUjSBrSqaiHLer0vBscAuoBsTtwK17MmSmg/kMc3XCh+vRDkSwtOgG4WD4ohQkPCt3s14u W+gsNFP1TWj7H6d6dX5sk2wSjyueIjWPECska0uXUYs+Ryox7ZolHDTXvaBfXyTJjiILXJw+44f Ucg2ugxhi5qmN8Jv5fK6VB1F7U19d4fbxNtff9fqH4QC8ncV+NaTn5X1rfBXHAVV8yZLLPZL6Nu SphE0c1Zj8lWi4EKejjjv4vOpFAjl3WqNERsA== X-Google-Smtp-Source: AGHT+IE95AcaDaciOM4yPBL6bOP96F+E+COHY6XNQnMXZUA8kp8v/lhcPwsoA/Jl0WsNTe+BDrIA/g== X-Received: by 2002:a53:c04b:0:10b0:641:f5bc:6949 with SMTP id 956f58d0204a3-642f7a52321mr675998d50.77.1763596751807; Wed, 19 Nov 2025 15:59:11 -0800 (PST) Received: from [10.138.34.110] (h96-60-249-169.cncrtn.broadband.dynamic.tds.net. [96.60.249.169]) by smtp.gmail.com with ESMTPSA id 00721157ae682-78a798a45d2sm2981327b3.13.2025.11.19.15.59.10 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 19 Nov 2025 15:59:11 -0800 (PST) Message-ID: <9e3968d4-dfa8-4353-bf85-dd5d0a4b174f@gmail.com> Date: Wed, 19 Nov 2025 18:58:57 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 03/14] tools: Add directory checker for updates To: Alyssa Ross References: <20251119-updates-v3-0-b88a99915509@gmail.com> <20251119-updates-v3-3-b88a99915509@gmail.com> <874iqqqdxf.fsf@alyssa.is> Content-Language: en-US From: Demi Marie Obenour Autocrypt: addr=demiobenour@gmail.com; keydata= xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49yB+l2nipd aq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYfbWpr/si88QKgyGSV Z7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/UorR+FaSuVwT7rqzGrTlscnT DlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7MMPCJwI8JpPlBedRpe9tfVyfu3euTPLPx wcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9Hzx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR 6h3nBc3eyuZ+q62HS1pJ5EvUT1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl 5FMWo8TCniHynNXsBtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2 Bkg1b//r6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nSm9BBff0N m0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQABzTxEZW1pIE1hcmll IE9iZW5vdXIgKGxvdmVyIG9mIGNvZGluZykgPGRlbWlvYmVub3VyQGdtYWlsLmNvbT7CwXgE EwECACIFAlp+A0oCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJELKItV//nCLBhr8Q AK/xrb4wyi71xII2hkFBpT59ObLN+32FQT7R3lbZRjVFjc6yMUjOb1H/hJVxx+yo5gsSj5LS 9AwggioUSrcUKldfA/PKKai2mzTlUDxTcF3vKx6iMXKA6AqwAw4B57ZEJoMM6egm57TV19kz PMc879NV2nc6+elaKl+/kbVeD3qvBuEwsTe2Do3HAAdrfUG/j9erwIk6gha/Hp9yZlCnPTX+ VK+xifQqt8RtMqS5R/S8z0msJMI/ajNU03kFjOpqrYziv6OZLJ5cuKb3bZU5aoaRQRDzkFIR 6aqtFLTohTo20QywXwRa39uFaOT/0YMpNyel0kdOszFOykTEGI2u+kja35g9TkH90kkBTG+a EWttIht0Hy6YFmwjcAxisSakBuHnHuMSOiyRQLu43ej2+mDWgItLZ48Mu0C3IG1seeQDjEYP tqvyZ6bGkf2Vj+L6wLoLLIhRZxQOedqArIk/Sb2SzQYuxN44IDRt+3ZcDqsPppoKcxSyd1Ny 2tpvjYJXlfKmOYLhTWs8nwlAlSHX/c/jz/ywwf7eSvGknToo1Y0VpRtoxMaKW1nvH0OeCSVJ itfRP7YbiRVc2aNqWPCSgtqHAuVraBRbAFLKh9d2rKFB3BmynTUpc1BQLJP8+D5oNyb8Ts4x Xd3iV/uD8JLGJfYZIR7oGWFLP4uZ3tkneDfYzsFNBFp+A0oBEAC9ynZI9LU+uJkMeEJeJyQ/ 8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd8xD57ue0eB47bcJv VqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPpI4gfUbVEIEQuqdqQyO4GAe+M kD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalql1/iSyv1WYeC1OAs+2BLOAT2NEggSiVO txEfgewsQtCWi8H1SoirakIfo45Hz0tk/Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJ riwoaRIS8N2C8/nEM53jb1sH0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcN fRAIUrNlatj9TxwivQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6 dCxN0GNAORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog2LNtcyCj kTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZAgrrnNz0iZG2DVx46 x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJELKItV//nCLBwNIP/AiIHE8b oIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwjjVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGj gn0TPtsGzelyQHipaUzEyrsceUGWYoKXYyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8fr RHnJdBcjf112PzQSdKC6kqU0Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2 E0rW4tBtDAn2HkT9uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHM OBvy3EhzfAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVssZ/rYZ9+5 1yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aWemLLszcYz/u3XnbO vUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPthZlDnTnOT+C+OTsh8+m5tos8 HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E +MYSfkEjBz0E8CLOcAw7JIwAaeBT In-Reply-To: <874iqqqdxf.fsf@alyssa.is> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------Pa4IR03fejhgxYBZCcd4wQfi" Message-ID-Hash: BFU6XDYPGZQXOQUEMRIDD76MLJMSARXD X-Message-ID-Hash: BFU6XDYPGZQXOQUEMRIDD76MLJMSARXD X-MailFrom: demiobenour@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Spectrum OS Development X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------Pa4IR03fejhgxYBZCcd4wQfi Content-Type: multipart/mixed; boundary="------------08HtqX3aDo12467rwKTKQe0v"; protected-headers="v1" From: Demi Marie Obenour To: Alyssa Ross Cc: Spectrum OS Development Message-ID: <9e3968d4-dfa8-4353-bf85-dd5d0a4b174f@gmail.com> Subject: Re: [PATCH v3 03/14] tools: Add directory checker for updates References: <20251119-updates-v3-0-b88a99915509@gmail.com> <20251119-updates-v3-3-b88a99915509@gmail.com> <874iqqqdxf.fsf@alyssa.is> In-Reply-To: <874iqqqdxf.fsf@alyssa.is> Autocrypt-Gossip: addr=hi@alyssa.is; keydata= xsFNBFpSgoYBEAC4xkCYidG2JlRWulUkTWcx0pHFDf3oSbb6Q872Kb3iDChWgluNVz43hva1 3xfDo9foV0GoyfGl/ycSCkXX5hlQr7ir/5FN38E7H/yY6tH8+l68iDgIOcb1qY0OYaxyg+Lz WesfFQedrmwNTbF4L1BtWzrTR5PflDdhDo5VWSguHGJFSclchcr/6UmMb/gOUN+2ElBC2TE2 EKY099phZ6DJZ2aZCsclwKIdCpZzXlEmXPAeaH5om6xo90JYv5+sFji40R0Plqec3WC+jTxy lGca6IbPdOminuUF+GvsR86eVsgh/0XNK7/zus7gyc4PuMUA1rCoeHcWOBDPgmelgCQyJGXd /bXeKuUsGoge58uc7/YNvOh1vfpD3AaEMqAyXfmmUwBnIicml74+2eOpH3Oljfs01g+DhkOB MtpVSZSgaIDvP0WG6cbAxImoUasnmNxEDNskfVmI8bsajPW9bt4z5hiP5Q9G3vE0D5HcIFdM adOz81PpOwNiUXcjtYV1PWZQ56jbSTOf8EBvsB71WwB+XgVWcPzIlY8hAykiHIO87oV3o71U JTAn1Foj7mjSADnY0deleOmar/K5jrK3wvKKM1XlB7PXcGBdkorJC+cbxVsw0ADzMw0c7bVc wEE7OFvHjQiIK1lO+lb1cvGBBY3IZxjsjZdA/VsFHFdAeYlzNQARAQABzRpBbHlzc2EgUm9z cyA8aGlAYWx5c3NhLmlzPsLBlwQTAQgAQQIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAIZ ARYhBHVzVtd5u7iIdz5BXnNszfnvUb2XBQJpALHXBQkPJNZRAAoJEHNszfnvUb2X2jEP/AqQ aafKiC7ormevgoCH4QinAKJoXAqiwOIdRK55HOvyhGWjnlzqoK4JTUFVRMR4Vat/APlkjOUk LPXKk+DCn4loFyl7BCLvsk4Xwy7WmXyfSPqjdik8/cjTv/Q4AHTYTpnx7GMC5eTS7ULmUvcf mD/JRr7NM2273Z7dkL3gOeZdnXYOQaGAIIox91qCtmnQhn+V7s3uxvcRl8I2/Qnn3S2veV03 LXSugAXSTdKRa7LBrcSm9TtC/D3qY9kStHiaiB/eAJsOQ0l5yRfax5INorE2DQgBKjbiBcnQ mTX7Rl9LW+U0ibHmKOFG8Zs+zKlmItek49cmqoGOv66RAY6dGUOHoEQgP0EUDJ8xGwActToC lOGZrzcXfrfx0CYlgqYE1VEWgSmtbTW1DBXiZIPKUMLJGhgaIHSKEjYujHd+vGytAMGKQsVQ OwgOMHYWyzAIB/Y6hZGNK8y5fxr468zX876mDdXhYo4dKA7UEOeQOlAIGobTXDRFEC7B/UAj qYbP+qmnyUohCy/Pf04cF0ucpWW2Z00sBL83lauhyQHiLze5OznvOeEkEeXQ6DsJOY0dmrsi 0NJZ1QoyYewXOPmPBNc7IesY1MjrpAnHgeAt1rgEPwTkt4NrRASsPe5JowJcc7CpIdR8eOrG hrw+bEMyoyjk7fN6Hs6MK+hVihMNhUwMzjgEZyd/yxIKKwYBBAGXVQEFAQEHQCVxoiHOlsEo NDKGCbxg4nL3E1CV0MRQCU1hPowd77h3AwEIB8LBfAQYAQoAJgIbDBYhBHVzVtd5u7iIdz5B XnNszfnvUb2XBQJpALHQBQkCT9j5AAoJEHNszfnvUb2XhSMP/0gStw42LjpjVLh+0HKWafs3 T9NJxtefYRbyu4wkkO0dss2pkl9gekZnvgktD0SzIe8AiMszs1rUWMG8zPXVWdMi7tSNm/IR WPa0XZDIoDwJY4T342nCvHeDsfoJnGg8o0nreI2djwO8sc9aeSevm60MQ9AouFBpS6Qw7f/Z LalXH4aWCCtvAO1o95lQXEoH4Lg4qnS6GxYMYi1u3IzrYdUu0By/Ccc5+AOOICgbJnpOoYQI bVDbdjMkj18JxxmpN5amOkPdiDndpzWkWm+oNhGUITYp6EuP1esRb35MgOmFGouvt5UdKpEl Egs2y5h9oR+kiiu9DhrC0UFL2CQ/HdiukCAxADKX3RE9m+mprSbvw7CsYmXUTH6WzPpvxpGx wQq7m2O7uy85u0HyVYkiWQiAfwCbEr1vrFU7gscBW+FcrLIODauovA9eZgA4d+cHRXfzsdKW u/QuVHsABh78LLIq008GcqJChSe4KHrJ5PUjkLnyp/Sshrmuyoy+DwqYky0KK4NtkaWa2o0B TFp+Kk2VCxWA8i/azPvTMzXOWNwqogISp5SwljiEx0hkyf0HvSb3gHfuGbZ+eGfWB+qy2pTD x/YriV5EfqkP+4+1cqXjasrQxyZUW0ULRke0j92Cgt+J722PIcOAb8vdSGF4AXczO+KMtNn9 wGxvGU7TX5ou --------------08HtqX3aDo12467rwKTKQe0v Content-Type: multipart/mixed; boundary="------------cCHOYGb9fFZBRDYYa0yM3tor" --------------cCHOYGb9fFZBRDYYa0yM3tor Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 11/19/25 09:45, Alyssa Ross wrote: > Demi Marie Obenour writes: >=20 >> Spectrum OS's host has no network access. Updates must be downloaded = by >> VMs. The downloads are placed into a bind-mounted directory. The VM >> can write whatever it wants into that directory. This includes symlin= ks >> that subsequent code might open, which would create a path traversal >> vulnerability. It also includes paths with names containing containin= g >=20 > Just one "containing" is fine. :P Nice catch :) >> terminal escape sequences, newlines, or other nastiness. Furthermore,= >> the directory should not have any subdirectories either. >> >> Add a simple C program that checks for such ugliness and indicates >> (via its exit code) if the VM misbehaved. systemd-sysupdate can leave= >> behind temporary files with names starting with '.', so delete them >> instead of failing. Linux can lose cache coherency if there is an I/O= >> error, so call syncfs() on the directory before checking anything. Fo= r >> the same reason, fsync() the directory if any hidden files were delete= d. >> >> The directory checker also serves another critical function: it checks= >> if the VM actually downloaded anything. Otherwise, network problems >> could cause updates to silently do nothing. Specifically, it checks >> that the VM provided a file starting with the prefix "SHA256SUMS.". >> These will be the last ones the in-VM updater downloads. An additiona= l >> mode is provided to clean out all such files. This will be used to >> ensure that before the in-VM updater runs, no such files are present. >> Hence, if the VM didn't actually download anything, the user will get = a >> clear error instead of a false success message or a confusing error. >> >> Signed-off-by: Demi Marie Obenour >> --- >> Changes since v2: >> >> - Purge leftover temporary files rather than returning an error. >> >> - Split into two modes: one that deletes signature files, and one that= >> checks that at least one signature file exists. This allows checkin= g >> that the VM actually sent something. >> --- >> tools/default.nix | 1 + >> tools/meson.build | 4 ++ >> tools/updates-dir-check.c | 133 +++++++++++++++++++++++++++++++++++++= +++++++++ >> 3 files changed, 138 insertions(+) >=20 > Looking good. Left some style comments, but >=20 > Reviewed-by: Alyssa Ross Do you want me to send another version, or would you rather fix this up on commit? All your changes look good. >> diff --git a/tools/updates-dir-check.c b/tools/updates-dir-check.c >> new file mode 100644 >> index 0000000000000000000000000000000000000000..07eb059f2718e1ad8ab087= fe6509c1437ea3e96c >> --- /dev/null >> +++ b/tools/updates-dir-check.c >> @@ -0,0 +1,133 @@ >> +// SPDX-License-Identifier: EUPL-1.2+ >> +// SPDX-FileCopyrightText: 2025 Demi Marie Obenour >> +#include >> +#include >> +#include >> +#include >> +#include >> + >> +#include >> +#include >> +#include >> +#include >> + >> +#include >> + >> +[[noreturn]] static void bad_char(char c, char *msg_component) >> +{ >> + if (c >=3D 0x20 && c <=3D 0x7E) >> + errx(EXIT_FAILURE, "Forbidden %s character in filename: '%c'", >> + msg_component, (int)c); >> + errx(EXIT_FAILURE, >> + "Forbidden %s character in filename: byte %d", >> + msg_component, (int)(unsigned char)c); >=20 > Why not %hhu, so you don't need two layers of casts? I totally forgot that %hhu exists! >> +} >> + >> +[[noreturn]] static void usage(void) >> +{ >> + errx(EXIT_FAILURE, "Usage: updates-dir-check [cleanup|check] DIRECTO= RIES..."); >> +} >> + >> +static void checkdir(int fd, bool check_sig) >=20 > [[gnu::fd_arg_read (1)]] >=20 > (I'm bad at remembering this too so you'll see other code missing it, > but it's good to add.) Good catch! >> +{ >> + bool found_sig =3D false; >> + DIR *d =3D fdopendir(fd); >> + if (d =3D=3D NULL) >> + err(EXIT_FAILURE, "fdopendir"); >> + // If there is an I/O error while there are dirty pages outstanding,= >> + // the dirty pages are silently discarded. This means that the cont= ents >> + // of the filesystem can change behind userspace's back. Flush all >> + // dirty pages in the filesystem with the directory to prevent this.= >> + if (syncfs(fd) !=3D 0) >> + err(EXIT_FAILURE, "syncfs"); >> + bool changed =3D false; >> + for (;;) { >> + errno =3D 0; >> + struct dirent *entry =3D readdir(d); >> + if (entry =3D=3D NULL) { >> + if (errno) >> + err(EXIT_FAILURE, "readdir"); >> + break; >> + } >> + const char *ptr =3D entry->d_name; >> + if (ptr[0] =3D=3D '.') { >> + if (ptr[1] =3D=3D '\0') >> + continue; >> + if (ptr[1] =3D=3D '.' && ptr[2] =3D=3D '\0') >> + continue; >> + // systemd-sysupdate uses these for temporary files. >> + // It normally cleans them up itself, but if there is an error >> + // it does not always clean them up. I'm not sure if it is >> + // guaranteed to clean up temporary files from a past run, so >> + // delete them instead of returning an error. >> + if (unlinkat(fd, ptr, 0)) >> + err(EXIT_FAILURE, "Failed to unlink temporary file"); >> + changed =3D true; >> + continue; >> + } >> + char c =3D ptr[0]; >> + if (!((c >=3D 'A' && c <=3D 'Z') || >> + (c >=3D 'a' && c <=3D 'z'))) >> + bad_char(c, "initial"); >> + while ((c =3D *++ptr)) { >> + if (!((c >=3D 'A' && c <=3D 'Z') || >> + (c >=3D 'a' && c <=3D 'z') || >> + (c >=3D '0' && c <=3D '9') || >> + (c =3D=3D '_') || >> + (c =3D=3D '-') || >> + (c =3D=3D '.'))) >> + bad_char(c, "subsequent"); >> + } >> + // Empty filenames are rejected as having a bad initial character, >> + // and POSIX forbids them from being returned anyway. Therefore, >> + // this cannot be out of bounds. >> + if (ptr[-1] =3D=3D '.') >> + errx(EXIT_FAILURE, "Filename %s ends with a '.'", entry->d_name); >> + if (entry->d_type =3D=3D DT_UNKNOWN) >> + errx(EXIT_FAILURE, "Filesystem didn't report type of file %s", ent= ry->d_name); >> + if (entry->d_type !=3D DT_REG) >> + errx(EXIT_FAILURE, "Entry contains non-regular file %s", entry->d_= name); >> + if (strncmp(entry->d_name, "SHA256SUMS.", sizeof("SHA256SUMS.") - 1= ) =3D=3D 0) { >> + // Found a signature file! >=20 > This comment seems a bit redundant. It isn't necessarily obvious that any file with this prefix is a signature. >> + if (check_sig) >> + found_sig =3D true; >> + else { >> + if (unlinkat(fd, entry->d_name, 0)) >> + err(EXIT_FAILURE, "Unlinking old signature file"); >> + changed =3D true; >> + } >> + } >> + } >> + // fsync() the directory if it was changed, to avoid the above >> + // cache-incoherency problem. >=20 > Above where? // If there is an I/O error while there are dirty pages outstanding, // the dirty pages are silently discarded. This means that the contents= // of the filesystem can change behind userspace's back. Flush all // dirty pages in the filesystem with the directory to prevent this. In this case, only the directory got changed, so I only need to flush the directory. >> + if (changed && fsync(fd)) >> + errx(EXIT_FAILURE, "fsync"); >> + if (check_sig && !found_sig) { >> + warnx("sys.appvm-systemd-sysupdate didn't send a signature file.");= >> + warnx("There was probably a problem downloading the update."); >> + errx(EXIT_FAILURE, "Check its logs for more information."); >> + } >> + closedir(d); >> +} >> + >> +int main(int argc, char **argv) >> +{ >> + if (argc !=3D 3) >> + usage(); >> + >> + bool check_sig; >> + if (strcmp(argv[1], "cleanup") =3D=3D 0) >> + check_sig =3D false; >> + else if (strcmp(argv[1], "check") =3D=3D 0) >> + check_sig =3D true; >> + else >> + usage(); >> + >> + for (int i =3D 2; i < argc; ++i) { >> + int fd =3D open(argv[i], O_DIRECTORY|O_RDONLY|O_CLOEXEC); >> + if (fd < 0) >> + err(EXIT_FAILURE, "open(%s)", argv[i]); >=20 > Maybe we could just fdopen(argv[1]) inside checkdir()? We don't need > any special flags AFAICT. Do you mean opendir()? That works, thanks! >> + checkdir(fd, check_sig); >> + } >> + return 0; >> +} >> >> --=20 >> 2.52.0 --=20 Sincerely, Demi Marie Obenour (she/her/hers) --------------cCHOYGb9fFZBRDYYa0yM3tor Content-Type: application/pgp-keys; name="OpenPGP_0xB288B55FFF9C22C1.asc" Content-Disposition: attachment; filename="OpenPGP_0xB288B55FFF9C22C1.asc" Content-Description: OpenPGP public key Content-Transfer-Encoding: quoted-printable -----BEGIN PGP PUBLIC KEY BLOCK----- xsFNBFp+A0oBEADffj6anl9/BHhUSxGTICeVl2tob7hPDdhHNgPR4C8xlYt5q49y B+l2nipdaq+4Gk6FZfqC825TKl7eRpUjMriwle4r3R0ydSIGcy4M6eb0IcxmuPYf bWpr/si88QKgyGSVZ7GeNW1UnzTdhYHuFlk8dBSmB1fzhEYEk0RcJqg4AKoq6/3/ UorR+FaSuVwT7rqzGrTlscnTDlPWgRzrQ3jssesI7sZLm82E3pJSgaUoCdCOlL7M MPCJwI8JpPlBedRpe9tfVyfu3euTPLPxwcV3L/cfWPGSL4PofBtB8NUU6QwYiQ9H zx4xOyn67zW73/G0Q2vPPRst8LBDqlxLjbtx/WLR6h3nBc3eyuZ+q62HS1pJ5EvU T1vjyJ1ySrqtUXWQ4XlZyoEFUfpJxJoN0A9HCxmHGVckzTRl5FMWo8TCniHynNXs BtDQbabt7aNEOaAJdE7to0AH3T/Bvwzcp0ZJtBk0EM6YeMLtotUut7h2Bkg1b//r 6bTBswMBXVJ5H44Qf0+eKeUg7whSC9qpYOzzrm7+0r9F5u3qF8ZTx55TJc2g656C 9a1P1MYVysLvkLvS4H+crmxA/i08Tc1h+x9RRvqba4lSzZ6/Tmt60DPM5Sc4R0nS m9BBff0Nm0bSNRS8InXdO1Aq3362QKX2NOwcL5YaStwODNyZUqF7izjK4QARAQAB zTxEZW1pIE9iZW5vdXIgKElUTCBFbWFpbCBLZXkpIDxhdGhlbmFAaW52aXNpYmxl dGhpbmdzbGFiLmNvbT7CwY4EEwEIADgWIQR2h02fEza6IlkHHHGyiLVf/5wiwQUC X6YJvQIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCyiLVf/5wiwWRhD/0Y R+YYC5Kduv/2LBgQJIygMsFiRHbR4+tWXuTFqgrxxFSlMktZ6gQrQCWe38WnOXkB oY6n/5lSJdfnuGd2UagZ/9dkaGMUkqt+5WshLFly4BnP7pSsWReKgMP7etRTwn3S zk1OwFx2lzY1EnnconPLfPBc6rWG2moA6l0WX+3WNR1B1ndqpl2hPSjT2jUCBWDV rGOUSX7r5f1WgtBeNYnEXPBCUUM51pFGESmfHIXQrqFDA7nBNiIVFDJTmQzuEqIy Jl67pKNgooij5mKzRhFKHfjLRAH4mmWZlB9UjDStAfFBAoDFHwd1HL5VQCNQdqEc /9lZDApqWuCPadZN+pGouqLysesIYsNxUhJ7dtWOWHl0vs7/3qkWmWun/2uOJMQh ra2u8nA9g91FbOobWqjrDd6x3ZJoGQf4zLqjmn/P514gb697788e573WN/MpQ5XI Fl7aM2d6/GJiq6LC9T2gSUW4rbPBiqOCeiUx7Kd/sVm41p9TOA7fEG4bYddCfDsN xaQJH6VRK3NOuBUGeL+iQEVF5Xs6Yp+U+jwvv2M5Lel3EqAYo5xXTx4ls0xaxDCu fudcAh8CMMqx3fguSb7Mi31WlnZpk0fDuWQVNKyDP7lYpwc4nCCGNKCj622ZSocH AcQmX28L8pJdLYacv9pU3jPy4fHcQYvmTavTqowGnM08RGVtaSBNYXJpZSBPYmVu b3VyIChsb3ZlciBvZiBjb2RpbmcpIDxkZW1pb2Jlbm91ckBnbWFpbC5jb20+wsF4 BBMBAgAiBQJafgNKAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRCyiLVf /5wiwYa/EACv8a2+MMou9cSCNoZBQaU+fTmyzft9hUE+0d5W2UY1RY3OsjFIzm9R /4SVccfsqOYLEo+S0vQMIIIqFEq3FCpXXwPzyimotps05VA8U3Bd7yseojFygOgK sAMOAee2RCaDDOnoJue01dfZMzzHPO/TVdp3OvnpWipfv5G1Xg96rwbhMLE3tg6N xwAHa31Bv4/Xq8CJOoIWvx6fcmZQpz01/lSvsYn0KrfEbTKkuUf0vM9JrCTCP2oz VNN5BYzqaq2M4r+jmSyeXLim922VOWqGkUEQ85BSEemqrRS06IU6NtEMsF8EWt/b hWjk/9GDKTcnpdJHTrMxTspExBiNrvpI2t+YPU5B/dJJAUxvmhFrbSIbdB8umBZs I3AMYrEmpAbh5x7jEjoskUC7uN3o9vpg1oCLS2ePDLtAtyBtbHnkA4xGD7ar8mem xpH9lY/i+sC6CyyIUWcUDnnagKyJP0m9ks0GLsTeOCA0bft2XA6rD6aaCnMUsndT ctrab42CV5XypjmC4U1rPJ8JQJUh1/3P48/8sMH+3krxpJ06KNWNFaUbaMTGiltZ 7x9DngklSYrX0T+2G4kVXNmjaljwkoLahwLla2gUWwBSyofXdqyhQdwZsp01KXNQ UCyT/Pg+aDcm/E7OMV3d4lf7g/CSxiX2GSEe6BlhSz+Lmd7ZJ3g32M1ARGVtaSBN YXJpZSBPYmVub3VyIChJVEwgRW1haWwgS2V5KSA8ZGVtaUBpbnZpc2libGV0aGlu Z3NsYWIuY29tPsLBjgQTAQgAOBYhBHaHTZ8TNroiWQcccbKItV//nCLBBQJgOEV+ AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJELKItV//nCLBKwoP/1WSnFdv SAD0g7fD0WlF+oi7ISFT7oqJnchFLOwVHK4Jg0e4hGn1ekWsF3Ha5tFLh4V/7UUu obYJpTfBAA2CckspYBqLtKGjFxcaqjjpO1I2W/jeNELVtSYuCOZICjdNGw2Hl9yH KRZiBkqc9u8lQcHDZKq4LIpVJj6ZQV/nxttDX90ax2No1nLLQXFbr5wb465LAPpU lXwunYDij7xJGye+VUASQh9datye6orZYuJvNo8Tr3mAQxxkfR46LzWgxFCPEAZJ 5P56Nc0IMHdJZj0Uc9+1jxERhOGppp5jlLgYGK7faGB/jTV6LaRQ4Ad+xiqokDWp mUOZsmA+bMbtPfYjDZBz5mlyHcIRKIFpE1l3Y8F7PhJuzzMUKkJi90CYakCV4x/a Zs4pzk5E96c2VQx01RIEJ7fzHF7lwFdtfTS4YsLtAbQFsKayqwkGcVv2B1AHeqdo TMX+cgDvjd1ZganGlWA8Sv9RkNSMchn1hMuTwERTyFTr2dKPnQdA1F480+jUap41 ClXgn227WkCIMrNhQGNyJsnwyzi5wS8rBVRQ3BOTMyvGM07j3axUOYaejEpg7wKi wTPZGLGH1sz5GljD/916v5+v2xLbOo5606j9dWf5/tAhbPuqrQgWv41wuKDi+dDD EKkODF7DHes8No+QcHTDyETMn1RYm7t0RKR4zsFNBFp+A0oBEAC9ynZI9LU+uJkM eEJeJyQ/8VFkCJQPQZEsIGzOTlPnwvVna0AS86n2Z+rK7R/usYs5iJCZ55/JISWd 8xD57ue0eB47bcJvVqGlObI2DEG8TwaW0O0duRhDgzMEL4t1KdRAepIESBEA/iPp I4gfUbVEIEQuqdqQyO4GAe+MkD0Hy5JH/0qgFmbaSegNTdQg5iqYjRZ3ttiswalq l1/iSyv1WYeC1OAs+2BLOAT2NEggSiVOtxEfgewsQtCWi8H1SoirakIfo45Hz0tk /Ad9ZWh2PvOGt97Ka85o4TLJxgJJqGEnqcFUZnJJriwoaRIS8N2C8/nEM53jb1sH 0gYddMU3QxY7dYNLIUrRKQeNkF30dK7V6JRH7pleRlf+wQcNfRAIUrNlatj9Txwi vQrKnC9aIFFHEy/0mAgtrQShcMRmMgVlRoOA5B8RTulRLCmkafvwuhs6dCxN0GNA ORIVVFxjx9Vn7OqYPgwiofZ6SbEl0hgPyWBQvE85klFLZLoj7p+joDY1XNQztmfA rnJ9x+YV4igjWImINAZSlmEcYtd+xy3Li/8oeYDAqrsnrOjb+WvGhCykJk4urBog 2LNtcyCjkTs7F+WeXGUo0NDhbd3Z6AyFfqeF7uJ3D5hlpX2nI9no/ugPrrTVoVZA grrnNz0iZG2DVx46x913pVKHl5mlYQARAQABwsFfBBgBAgAJBQJafgNKAhsMAAoJ ELKItV//nCLBwNIP/AiIHE8boIqReFQyaMzxq6lE4YZCZNj65B/nkDOvodSiwfwj jVVE2V3iEzxMHbgyTCGA67+Bo/d5aQGjgn0TPtsGzelyQHipaUzEyrsceUGWYoKX YyVWKEfyh0cDfnd9diAm3VeNqchtcMpoehETH8frRHnJdBcjf112PzQSdKC6kqU0 Q196c4Vp5HDOQfNiDnTf7gZSj0BraHOByy9LEDCLhQiCmr+2E0rW4tBtDAn2HkT9 uf32ZGqJCn1O+2uVfFhGu6vPE5qkqrbSE8TG+03H8ecU2q50zgHWPdHMOBvy3Ehz fAh2VmOSTcRK+tSUe/u3wdLRDPwv/DTzGI36Kgky9MsDC5gpIwNbOJP2G/q1wT1o Gkw4IXfWv2ufWiXqJ+k7HEi2N1sree7Dy9KBCqb+ca1vFhYPDJfhP75I/VnzHVss Z/rYZ9+51yDoUABoNdJNSGUYl+Yh9Pw9pE3Kt4EFzUlFZWbE4xKL/NPno+z4J9aW emLLszcYz/u3XnbOvUSQHSrmfOzX3cV4yfmjM5lewgSstoxGyTx2M8enslgdXhPt hZlDnTnOT+C+OTsh8+m5tos8HQjaPM01MKBiAqdPgksm1wu2DrrwUi6ChRVTUBcj 6+/9IJ81H2P2gJk3Ls3AVIxIffLoY34E+MYSfkEjBz0E8CLOcAw7JIwAaeBTzsFN BGbyLVgBEACqClxh50hmBepTSVlan6EBq3OAoxhrAhWZYEwN78k+ENhK68KhqC5R IsHzlL7QHW1gmfVBQZ63GnWiraM6wOJqFTL4ZWvRslga9u28FJ5XyK860mZLgYhK 9BzoUk4s+dat9jVUbq6LpQ1Ot5I9vrdzo2p1jtQ8h9WCIiFxSYy8s8pZ3hHh5T64 GIj1m/kY7lG3VIdUgoNiREGf/iOMjUFjwwE9ZoJ26j9p7p1U+TkKeF6wgswEB1T3 J8KCAtvmRtqJDq558IU5jhg5fgN+xHB8cgvUWulgK9FIF9oFxcuxtaf/juhHWKMO RtL0bHfNdXoBdpUDZE+mLBUAxF6KSsRrvx6AQyJs7VjgXJDtQVWvH0PUmTrEswgb 49nNU+dLLZQAZagxqnZ9Dp5l6GqaGZCHERJcLmdY/EmMzSf5YazJ6c0vO8rdW27M kn73qcWAplQn5mOXaqbfzWkAUPyUXppuRHfrjxTDz3GyJJVOeMmMrTxH4uCaGpOX Z8tN6829J1roGw4oKDRUQsaBAeEDqizXMPRc+6U9vI5FXzbAsb+8lKW65G7JWHym YPOGUt2hK4DdTA1PmVo0DxH00eWWeKxqvmGyX+Dhcg+5e191rPsMRGsDlH6KihI6 +3JIuc0y6ngdjcp6aalbuvPIGFrCRx3tnRtNc7He6cBWQoH9RPwluwARAQABwsOs BBgBCgAgFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmbyLVgCGwICQAkQsoi1X/+c IsHBdCAEGQEKAB0WIQSilC2pUlbVp66j3+yzNoc6synyUwUCZvItWAAKCRCzNoc6 synyU85gD/0T1QDtPhovkGwoqv4jUbEMMvpeYQf+oWgm/TjWPeLwdjl7AtY0G9Ml ZoyGniYkoHi37Gnn/ShLT3B5vtyI58ap2+SSa8SnGftdAKRLiWFWCiAEklm9FRk8 N3hwxhmSFF1KR/AIDS4g+HIsZn7YEMubBSgLlZZ9zHl4O4vwuXlREBEW97iL/FSt VownU2V39t7PtFvGZNk+DJH7eLO3jmNRYB0PL4JOyyda3NH/J92iwrFmjFWWmmWb /Xz8l9DIs+Z59pRCVTTwbBEZhcUc7rVMCcIYL+q1WxBG2e6lMn15OQJ5WfiE6E0I sGirAEDnXWx92JNGx5l+mMpdpsWhBZ5iGTtttZesibNkQfd48/eCgFi4cxJUC4PT UQwfD9AMgzwSTGJrkI5XGy+XqxwOjL8UA0iIrtTpMh49zw46uV6kwFQCgkf32jZM OLwLTNSzclbnA7GRd8tKwezQ/XqeK3dal2n+cOr+o+Eka7yGmGWNUqFbIe8cjj9T JeF3mgOCmZOwMI+wIcQYRSf+e5VTMO6TNWH5BI3vqeHSt7HkYuPlHT0pGum88d4a pWqhulH4rUhEMtirX1hYx8Q4HlUOQqLtxzmwOYWkhl1C+yPObAvUDNiHCLf9w28n uihgEkzHt9J4VKYulyJM9fe3ENcyU6rpXD7iANQqcr87ogKXFxknZ97uEACvSucc RbnnAgRqZ7GDzgoBerJ2zrmhLkeREZ08iz1zze1JgyW3HEwdr2UbyAuqvSADCSUU GN0vtQHsPzWl8onRc7lOPqPDF8OO+UfN9NAfA4wl3QyChD1GXl9rwKQOkbvdlYFV UFx9u86LNi4ssTmU8p9NtHIGpz1SYMVYNoYy9NU7EVqypGMguDCL7gJt6GUmA0sw p+YCroXiwL2BJ7RwRqTpgQuFL1gShkA17D5jK4mDPEetq1d8kz9rQYvAR/sTKBsR ImC3xSfn8zpWoNTTB6lnwyP5Ng1bu6esS7+SpYprFTe7ZqGZF6xhvBPf1Ldi9UAm U2xPN1/eeWxEa2kusidmFKPmN8lcT4miiAvwGxEnY7Oww9CgZlUB+LP4dl5VPjEt sFeAhrgxLdpVTjPRRwTd9VQF3/XYl83j5wySIQKIPXgT3sG3ngAhDhC8I8GpM36r 8WJJ3x2yVzyJUbBPO0GBhWE2xPNIfhxVoU4cGGhpFqz7dPKSTRDGq++MrFgKKGpI ZwT3CPTSSKc7ySndEXWkOYArDIdtyxdE1p5/c3aoz4utzUU7NDHQ+vVIwlnZSMiZ jek2IJP3SZ+COOIHCVxpUaZ4lnzWT4eDqABhMLpIzw6NmGfg+kLBJhouqz81WITr EtJuZYM5blWncBOJCoWMnBEcTEo/viU3GgcVRw=3D=3D =3Dx94R -----END PGP PUBLIC KEY BLOCK----- --------------cCHOYGb9fFZBRDYYa0yM3tor-- --------------08HtqX3aDo12467rwKTKQe0v-- --------------Pa4IR03fejhgxYBZCcd4wQfi Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEopQtqVJW1aeuo9/sszaHOrMp8lMFAmkeWcoACgkQszaHOrMp 8lOTeg//Xy4eDya988lJcENgEvoQYnuwsJ98OURWMmuXVVv3q5ux/xSddNM5rbkQ TX5NLn7I/rvoohu660+Wm2CyV+WjByPU1GHSsjwlU5oHM2XNlbXgIIVv84U+LK05 1nus+nD7ueeEtmV1BRQx2md4Hn0IRrIJKHUfXPtGGkdNjJCWaNuhDEjAU6LYOFKj Xi1lh+qH7+Uzz9N6TEYSN7ma3hDRxtdMLM+LkZhsYoMT/KXk0xKsi8wIuxWmOK/P Av/pikt/xYI1Wu94rRlRwHpJmv3jVgLMht5LvsW4CriyWRLTiZwTvy+/gEhvOVDK 4SjUhGL91GM8Kpr1SNpbbtBCca7s3etnd9YQZr3Ojc7I1dTgogUm7w0sGIo/8yr8 dsUpkFtu/mGL2BZNpxU0xZzWz1cx3+b8l2GaavPfWy+GLzZANRoJv06dAItoBcJ1 LYtztdFoTuGyhEgc8lGFoi1WLGqE4Uatsr2ZLvBoXpXQwEUvArtNAhwOWOGpT6/9 5iYxmPHlAdOTzEsk3T7DhupBNLBW3Q5KyYhvSAyhPCSDIYYsYR1fVqxkJfhwD63+ elJcneSVcOhgHSYwna/yh9HAX+kHJVIWBtx/t7QMLSSsBN5UOyb5K0bQQgkTzAt+ 3KUdTBDqayprNW5rOWAg2InB5VVZTIbS7oRRc49b6lj9jMUqkpk= =Xirf -----END PGP SIGNATURE----- --------------Pa4IR03fejhgxYBZCcd4wQfi--