hasher-1.3.31-alt1 If hasher or the programs being run are allowed to read from stdin of the caller, they (the caller and the hasher) can affect each other, which is not good for the purposes of hasher. Example -- it should print "hello" at the end, but it doesn't: [imz@team ~]$ { hsh --without-stuff /ALT/Sisyphus/files/SRPMS/altlinux-release-sisyphus-20081222-alt1.src.rpm; cat; echo end; } <<<hello <86>Mar 22 18:13:14 userdel[12613]: delete user 'rooter' <86>Mar 22 18:13:14 userdel[12613]: removed group 'rooter' owned by 'rooter' <86>Mar 22 18:13:14 userdel[12613]: removed shadow group 'rooter' owned by 'rooter' <86>Mar 22 18:13:14 groupadd[12618]: group added to /etc/group: name=rooter, GID=747 <86>Mar 22 18:13:14 groupadd[12618]: group added to /etc/gshadow: name=rooter <86>Mar 22 18:13:14 groupadd[12618]: new group: name=rooter, GID=747 <86>Mar 22 18:13:14 useradd[12622]: new user: name=rooter, UID=747, GID=747, home=/root, shell=/bin/bash <86>Mar 22 18:13:14 userdel[12629]: delete user 'builder' <86>Mar 22 18:13:14 userdel[12629]: removed group 'builder' owned by 'builder' <86>Mar 22 18:13:14 userdel[12629]: removed shadow group 'builder' owned by 'builder' <86>Mar 22 18:13:14 groupadd[12634]: group added to /etc/group: name=builder, GID=748 <86>Mar 22 18:13:14 groupadd[12634]: group added to /etc/gshadow: name=builder <86>Mar 22 18:13:14 groupadd[12634]: new group: name=builder, GID=748 <86>Mar 22 18:13:14 useradd[12638]: new user: name=builder, UID=748, GID=748, home=/usr/src, shell=/bin/bash Installing altlinux-release-sisyphus-20081222-alt1.src.rpm Building target platforms: x86_64 Building for target x86_64 Executing(%install): /bin/sh -e /usr/src/tmp/rpm-tmp.68012 + umask 022 + /bin/mkdir -p /usr/src/RPM/BUILD + cd /usr/src/RPM/BUILD + /bin/chmod -Rf u+rwX -- /usr/src/tmp/altlinux-release-sisyphus-buildroot + : + /bin/rm -rf -- /usr/src/tmp/altlinux-release-sisyphus-buildroot + install -pD -m644 /dev/null /usr/src/tmp/altlinux-release-sisyphus-buildroot/etc/buildreqs/packages/ignore.d/altlinux-release-sisyphus + echo 'ALT Sisyphus (20081222)' + for n in fedora redhat system + ln -s altlinux-release /usr/src/tmp/altlinux-release-sisyphus-buildroot/etc/fedora-release + for n in fedora redhat system + ln -s altlinux-release /usr/src/tmp/altlinux-release-sisyphus-buildroot/etc/redhat-release + for n in fedora redhat system + ln -s altlinux-release /usr/src/tmp/altlinux-release-sisyphus-buildroot/etc/system-release + /usr/lib/rpm/brp-alt Cleaning files in /usr/src/tmp/altlinux-release-sisyphus-buildroot (auto) Verifying and fixing files in /usr/src/tmp/altlinux-release-sisyphus-buildroot (binconfig,pkgconfig,libtool,desktop) Checking contents of files in /usr/src/tmp/altlinux-release-sisyphus-buildroot/ (default) Compressing files in /usr/src/tmp/altlinux-release-sisyphus-buildroot (auto) Verifying ELF objects in /usr/src/tmp/altlinux-release-sisyphus-buildroot (arch=normal,fhs=normal,lfs=relaxed,lint=relaxed,rpath=normal,stack=normal,textrel=normal,unresolved=normal) Hardlinking identical .pyc and .pyo files Processing files: altlinux-release-sisyphus-20081222-alt1 Finding Provides (using /usr/lib/rpm/find-provides) Executing: /bin/sh -e /usr/src/tmp/rpm-tmp.TsXVlN find-provides: running scripts (alternatives,debuginfo,lib,pam,perl,pkgconfig,python,shell) Finding Requires (using /usr/lib/rpm/find-requires) Executing: /bin/sh -e /usr/src/tmp/rpm-tmp.ibQS86 find-requires: running scripts (cpp,debuginfo,files,lib,pam,perl,pkgconfig,pkgconfiglib,python,rpmlib,shebang,shell,static,symlinks) Provides: altlinux-release = 20081222-alt1, fedora-release = 20081222-alt1, redhat-release = 20081222-alt1, system-release = 20081222-alt1 Obsoletes: altlinux-4.0, altlinux-release, altlinux-release-4.0, altlinux-release-4.1, altlinux-release-5.0, altlinux-release-chainmail, altlinux-release-desktop, altlinux-release-homeros, altlinux-release-hpc, altlinux-release-junior, altlinux-release-master, altlinux-release-office-server, altlinux-release-school-server, altlinux-release-server, altlinux-release-skif, altlinux-release-small_business, altlinux-release-terminal, fedora-release, redhat-release Wrote: /usr/src/RPM/SRPMS/altlinux-release-sisyphus-20081222-alt1.src.rpm Wrote: /usr/src/RPM/RPMS/noarch/altlinux-release-sisyphus-20081222-alt1.noarch.rpm 0.20user 0.10system 0:02.34elapsed 13%CPU (0avgtext+0avgdata 5572maxresident)k 0inputs+0outputs (0major+122410minor)pagefaults 0swaps end [imz@team ~]$
По коду не исправлено. hasher 1.7.7-alt1: единственная правка на эту тему — коммит 723a602 "Redirect chrootuid{1,2} stdin to /dev/null where appropriate" (2007, версия 1.2.7), то есть она предшествует отчёту и закрывает не все вызовы. Без перенаправления stdin остались: hasher/hsh-sh-cache-chroot-functions:72, :224, :285 (архивация и распаковка кэша chroot) hasher/hsh-sh-rebuild-functions:342 (создание точки монтирования) Отдельно hsh-run:197,199 — там интерактивный запуск, туда stdin передаётся намеренно, а hsh-run:209,268 читают архив из stdin по назначению. Воспроизвести пример из отчёта в контейнере нельзя: hasher-priv требует setuid-помощника и настроенного хоста, поэтому вывод сделан по исходникам. Минимальная правка — дописать </dev/null в четырёх перечисленных местах; более радикальная — exec </dev/null в hsh сразу после разбора опций, с сохранением нынешнего поведения hsh-run.