summaryrefslogtreecommitdiff
path: root/src/database.c
AgeCommit message (Collapse)AuthorFilesLines
2021-07-26db: fix installed db writing with long namesSamanta Navarro1-6/+11
Packages containing files with path names longer than 1024 characters cannot fit into the buffer which is used to write "installed" database. This leads to bbuf being APK_BLOB_NULL in apk_db_write_fdb because apk_blob_push_blob notices the condition and correctly handles it. The problem occurs when arguments to apk_ostream_write are manually calculated by pointer arithmetics. Since bbuf.ptr is NULL in such a case, bbuf.ptr - buf leads to a huge size value while buf still points into the stack. fixes #10751 [TT: minor edit to commit and abbreviating the commit message]
2021-07-23db: check syscall errors in update_permissions()Timo Teräs1-5/+17
2021-04-11database: do not chroot(".") unless actually necessaryAriadne Conill1-2/+13
If we use default root (/), then we do not have to chroot to run scripts. Use APK_NO_CHROOT flag for this scenario to avoid the chroot. This helps with using apk with bwrap and OSTree. Closes #10736. [TT: backported to 2.12-stable] (cherry picked from commit 73504fb7ab2bb659660dae7e1cafab0cfedeb13d)
2021-04-11db: fix control character check to use uint8_tTimo Teräs1-2/+2
fixes #10737 (cherry picked from commit ab7b8e3c995eb5a05ddbaa4546cd16a10da2d836)
2021-04-11db: consider control characters in filename as maliciousTimo Teräs1-7/+19
Especially a newline can produce havoc in the database file as the filename is written there as-is. This hardenes the extraction to consider any control character as malicious. Additional hardening is added to database loading to better detect corrupt state and return proper error code about it. Reported-by: Luca Weiss <luca@z3ntu.xyz> (backported from commit c1594f60770483625891541375a074fe07338401)
2021-04-11database: automatically create missing cache dirPaul Spooren1-0/+6
On some systems the `/var/` dir is mounted in a tmpfs which is reseted after each reboot. For that reason no post-install script can handle the creation of the cache dir at `/var/cache/apk`. Check on database opnening if the folder is available, if not create it. Fixes #10715 Signed-off-by: Paul Spooren <mail@aparcar.org> (cherry picked from commit dac30d50497214c8722a57ee1ae8d3c369babe38)
2021-04-11db: mask password component of printed URLsTimo Teräs1-12/+19
fixes #10710 (cherry picked from commit 6cedfe27ac566e7de7d0c24778c4280e8311bbec)
2021-04-11db: check cache only if some repositories are enabledTimo Teräs1-1/+1
(cherry picked from commit c269e9c24da57ab1b69ad6c80e9a1cb52b2b67d2)
2021-04-11db: fix unaligned memory access in csum_hash()Timo Teräs1-1/+3
(cherry picked from commit c054fbc11e9beca0d45285c3e1f448c81416c5ce)
2020-02-18remove apk_time() as it is causing problems with shared objectsTimo Teräs1-2/+2
Instead, to make sure test mode produces same output, redefine time() for the test mode binary. Reverts parts of 0b82bcc53e60. (cherry picked from commit 45d313c51cbae20bce0789db86ba82ff79c9b202)
2020-02-18database.c: drop GNU extension for fnmatchDrew DeVault1-1/+1
The non-wildcard version of the function is case-sensitive anyway. (cherry picked from commit 7e2e440d4c7c51bff3ffb83ad3fd29d7b6088e32)
2020-02-18io: remove unused size parameter from bstream closeTimo Teräs1-5/+5
(cherry picked from commit e39334e44f723b0a1d1036f354c5d8f5d0a12377)
2019-12-27db: parse tabulator as repository separator charTimo Teräs1-0/+1
Fixes #10662
2019-11-22Don't unpack files to system rootFredrik Gustafsson1-1/+5
When unpacking a file that is in root, it got a temporary file name /.apk... however if the --root option was used it should have the name root/.apk... otherwise unpacking will fail if the user does not have write access to /. Signed-off-by: Fredrik Gustafsson <fredrigu@axis.com>
2019-06-03use fixed system time in test mode to have fixed test outputTimo Teräs1-2/+2
fixes test suite regression from previous commit
2019-02-13fix strncpy bounds errorsTimo Teräs1-1/+4
error: 'strncpy' specified bound 4096 equals destination size [-Werror=stringop-truncation] Based on patch by Elan Ruusamäe <glen@delfi.ee>
2019-02-13include sys/sysmacros.h for makedev definitionElan Ruusamäe1-0/+1
2018-11-12prefer selecting packages by their primary nameTimo Teräs1-0/+8
2018-10-26add support for openssl 1.1Timo Teräs1-7/+12
2018-09-10rework unpacking of packages and harden package file format requirementsTimo Teräs1-53/+107
A crafted .apk file could to trick apk writing unverified data to an unexpected file during temporary file creation due to bugs in handling long link target name and the way a regular file is extracted. Several hardening steps are implemented to avoid this: - the temporary file is now always first unlinked (apk thus reserved all filenames .apk.* to be it's working files) - the temporary file is after that created with O_EXCL to avoid races - the temporary file is no longer directly the archive entry name and thus directly controlled by potentially untrusted data - long file names and link target names are now rejected - hard link targets are now more rigorously checked - various additional checks added for the extraction process to error out early in case of malformed (or old legacy) file Reported-by: Max Justicz <max@justi.cz>
2018-08-21prevent automatic repository index update with --no-networkNatanael Copa1-1/+2
We should not update repository index when --no-network is specified. ref #9126
2018-07-18prevent automatic repository index update for 'apk del'Timo Teräs1-2/+4
ref #9063
2018-04-05db: fix refreshing index if time is zeroTimo Teräs1-3/+5
During netboot on systems without RTC, time() will be near zero, and the index fill not exist. Thus the plain test of st.st_mtime against system time failed. Verify that fstatat() succeeds.
2018-01-08auto-update index only when database is opened for writingTimo Teräs1-1/+2
2018-01-04enable automatic update of indexes controlled by --cache-max-ageTimo Teräs1-18/+25
This modifies apk cache for indexes to be automatically refreshed periodically without explicit 'update' or '--update-cache' usage. The default is to do if-modified-since request if the local copy is older than 4 hours. This age can be changed with --cache-max-age. Using --update-cache will change this age to 60 seconds to make sure the cached copy is relatively new. The small age is in order to try to avoid downloading indexes second time when apk-tools is upgraded and apk re-execs after self-upgrade. Accordingly using explicitly 'apk update' will now enforce --force-refresh and request the very latest index by requesting any potential http proxy to do refresh too.
2018-01-03split --force to several --force-[type] optionsTimo Teräs1-6/+6
This unloads --force as several of the things are really not wanted together. E.g. --force-refresh is a lot different from --force-broken-world and doing --force to get the other might introduce unwanted behaviour. --force is still kept for backwards compatibility and it enables most things --force was used for.
2018-01-03db: fix triggers to report deleted directoriesTimo Teräs1-16/+19
This change just changes to keep deleted directory items in the hash with ref count zero and modified flag set. Those entries are reused when needed. The side effect is that fire_triggers() will now see those removed direcotries and reports them. Other enumerators of the directories hash are protected to skip removed directories when appropriate.
2017-10-10db: handle default root correctly for /procTimo Teräs1-1/+1
dbopts->root may be null; use db->root instead fixes #7162
2017-07-29database: include POSIX header for ST_* definesA. Wilcox1-0/+1
2017-06-26db: fix current directory instance caching in tar extractionTimo Teräs1-1/+1
Depending how the directory entries are ordered, the cached dir instance might not have been updated correctly. This has not been a problem as the entries have been ordered, but is now triggered on ppc.
2017-06-26database: mark error on renameat failureA. Wilcox1-2/+6
2017-06-23io: make io vtables const struct, and add accessors for themTimo Teräs1-26/+26
This reduces function pointers in heap, and unifies how the io functions are called.
2017-05-25db: fix regression preventing remounting apk cache r/wTimo Teräs1-1/+2
Introduced in commit c0f2d88f342f4d185f3991f98b79ab61a03896e4. fstatfs is needed to inspect the mount flags.
2017-04-28db: separate init from openKaarle Ritvanen1-11/+15
2017-03-13db: catch asprintf failureNatanael Copa1-1/+2
2017-03-13db: prevent umount /proc when it was mounted by someone elseNatanael Copa1-1/+6
This fixes regression introduced by commit 72b878e655
2017-02-27db: allow overriding cache locationTimo Teräs1-7/+7
2017-02-27db: allow caching packages on tmpfsTimo Teräs1-3/+1
fixes #5616 The original intention was not use unnecessary space on tmpfs e.g. if the cache directory is a mount point, but accidentally left unmounted. But there are valid cases when packages are intentionally wanted to be cached on tmpfs. If caching is not desired, the user can just remove the cache directory.
2017-02-27db: mount /proc for --root if it's not mounted, use mount syscallTimo Teräs1-34/+46
musl c-library does not work properly without /proc, and potentially running the scripts need this.
2017-02-15add support for pre and post commit hooksHenrik Riomar1-0/+29
This allows for instance integration of etckeeper [TT: Reorganized code a bit, and modified to use single directory commit_hooks.d with argument for script of stage.]
2015-12-07db: add support for --no-cacheNatanael Copa1-1/+7
Implement --no-cache. The index is read directly from network and not cached. This is useful for docker, where you install a set of packages and directly after purge the cache. (see https://github.com/gliderlabs/docker-alpine/blob/1fc9e59d1689fc4eaf930ec66389fe58062fccec/builder/scripts/apk-install) fixes #4905
2015-11-09io, database: preserve [am]time for cached and fetched filesTimo Teräs1-0/+3
preserve [am]time for all packages and indexes. this fixes the caching error that 'apk update' is after new index is generated, but before the used mirror is synchronized. this caused local apkindex timestamp to be newer than file in mirror, when in fact it was outdated index. this also fixes fetched files to have build timestamp so that files going to .iso or custom images have proper timestamps (rsync with appropriate --modify-window now works)
2015-09-03db: stop extract more files if disk is fullTimo Teräs1-2/+4
2015-07-02relocate lock file to /lib/apk/dbTimo Teräs1-3/+2
the problem is that var/lock is on root installs symlink to /run/lock (on tmpfs) and does not exist if doing chroot() to that root. fixes apk to work when chrooted to existing rootfs install.
2015-06-26remove db dir entry properly, so it can be recreated properly if neededTimo Teräs1-7/+7
fixes #4261
2015-06-12for completeness free all arrays before exitTimo Teräs1-0/+1
so valgrind does not report any leaks
2015-06-11speed improvements for database openingTimo Teräs1-4/+43
resolve reverse dependencies after all packages have been loaded, and avoid traversing the reverse name lists. now that we use automatic virtual packages (soname, pkg-config, etc.) the reverse dependency chains can become considerable longer than what it was when the rdependency construction code was originally written.
2015-06-01fix directory permissions loadingTimo Teräs1-1/+4
commit 941fc1b1 uncovered a bug that directory permissions are not updated properly at db load time if it's the default acl.
2015-04-24do not extract files with malicious nameTimo Teräs1-1/+14
the security implications are not as high as compared to regular tar/unzip archiver. this is because you are anyway trusting the package to install files anywhere in the filesystem. this serves rather as a sanity to check against errors in created package.
2015-04-24modifications for the previous commit in error message handlingTimo Teräs1-0/+2
forgot to --amend my changes
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2025-08-16 09:44:01 +0000