summaryrefslogtreecommitdiff
path: root/src/database.c
AgeCommit message (Collapse)AuthorFilesLines
2021-02-07db: consider control characters in filename as maliciousTimo Teräs1-11/+19
Especially a newline can produce havoc in the database file as the filename is written there as-is. This hardenes the extraction to consider any control character as malicious. Additional hardening is added to database loading to better detect corrupt state and return proper error code about it. Reported-by: Luca Weiss <luca@z3ntu.xyz>
2021-01-14database.c: Fixed package DESCRIPTION parsingthibault.ferrante1-0/+1
Regression introduced by 0fb0d30 which makes parsing a description a critical failure. [TT: Minor stylistic change. Fix also missing final line change from the earlier commit]
2021-01-11database: Propagate errors when loading an APKINDEXthibault.ferrante1-6/+7
In case of failure when loading an APKINDEX, no errors are propagated to the user which may uncorrectly interpret the current problem.
2020-10-07various changes to make clang not give warningsTimo Teräs1-4/+4
2020-10-06db: make the --repositories-file change more announcedTimo Teräs1-3/+7
Document the version when changed. And print error with similar note if the given repositories-file cannot be read.
2020-10-06database: automatically create missing cache dirPaul Spooren1-0/+6
On some systems the `/var/` dir is mounted in a tmpfs which is reseted after each reboot. For that reason no post-install script can handle the creation of the cache dir at `/var/cache/apk`. Check on database opnening if the folder is available, if not create it. Fixes #10715 Signed-off-by: Paul Spooren <mail@aparcar.org>
2020-10-05db: make --repositories-file relative to host rootTimo Teräs1-1/+1
It used to be relative to the --root specified root, but that causes issues with relative command line filenames and is unintuitive. Update documentation accordingly. Fixes #10702.
2020-10-05db: mask password component of printed URLsTimo Teräs1-12/+19
fixes #10710
2020-10-01db: check cache only if some repositories are enabledTimo Teräs1-1/+1
2020-08-29database: clarify the deprecation notice for checksum-less packagesAriadne Conill1-3/+7
Closes #10708.
2020-05-27database: create additional device nodes when initializing root fsAriadne Conill1-0/+4
Some triggers and maintainer scripts depend on /dev/random, /dev/urandom, /dev/zero and /dev/console.
2020-05-19make the atom functions not use global stateTimo Teräs1-17/+19
This greatly helps with memory management on applications that may want to daemonize and open/close database several times. Also the lifetime and "owner" of memory for all data is now explicitly bound to owning struct apk_database, which might be helpful when writing language bindings. As side effect, the interned "atoms" are unique only within what apk_database, so comparing packages from different apk_database may not work as expected. Fixes #10697
2020-05-07use SPDX-License-Identifier in source filesTBK1-3/+1
2020-04-28apk: do not manage file ownership as non-root or when asked soFredrik Gustafsson1-1/+5
If apk is run as a non-root user, it's not possible to chown files. Maintainers note: minor wording changes on commit log and man page. Signed-off-by: Fredrik Gustafsson <fredrigu@axis.com>
2020-04-01db: fix database reading without scripts or triggersTimo Teräs1-6/+10
Most notably this happens after blank database is initialized with --initdb, but can happen also in other conditions. The error checking changes modified behaviour if the file does not exist. Explicitly check for ENOENT and ignore it. But the behaviour is improved from earlier as now e.g. EPERM will be detected and reported correctly. Fixes #10679 Fixes: 6da3e8eb15 "istream, archive, db: convert db and tar function to use istream"
2020-02-21db: fix unaligned memory access in csum_hash()Timo Teräs1-1/+3
2020-02-14io: add stream copy helperTimo Teräs1-1/+1
2020-02-04remove apk_time() as it is causing problems with shared objectsTimo Teräs1-2/+2
Instead, to make sure test mode produces same output, redefine time() for the test mode binary. Reverts parts of 0b82bcc53e60.
2020-01-25document mysterious SHA-1 blob in database.cReid Rankin1-0/+2
2020-01-24db: additional clean up and hardening for apk extractionTimo Teräs1-15/+16
This enforces all scripts to be in the control block, and all data files to be in data block. Ignoring of dot files in root is added back: packages without any real files will ship one ".dummy" item in the data block to trigger processing and validation to work.
2020-01-24Harden signature verification processReid Rankin1-15/+13
This mostly boils down to making sure control_started and data_started are consistently used to gate actions, instead of relying whether on file names start with a '.'. None of the weaknesses this fixes are exploitable, but they might have become so after changes to seemingly-unrelated code, so it's good to clean them up.
2020-01-11archive: make apk_tar_parse check and close input streamTimo Teräs1-19/+7
simplifies other code quite a bit
2020-01-11convert remaining locations to use istream instead of bstreamTimo Teräs1-25/+17
2020-01-11istream, archive, db: convert db and tar function to use istreamTimo Teräs1-51/+34
2020-01-11archive: remove support for old packages without xattr checksumsTimo Teräs1-4/+9
2020-01-09database.c: drop GNU extension for fnmatchDrew DeVault1-1/+1
The non-wildcard version of the function is case-sensitive anyway.
2020-01-06io: remove unused size parameter from bstream closeTimo Teräs1-5/+5
2019-12-27db: parse tabulator as repository separator charTimo Teräs1-0/+1
Fixes #10662
2019-11-22Don't unpack files to system rootFredrik Gustafsson1-1/+5
When unpacking a file that is in root, it got a temporary file name /.apk... however if the --root option was used it should have the name root/.apk... otherwise unpacking will fail if the user does not have write access to /. Signed-off-by: Fredrik Gustafsson <fredrigu@axis.com>
2019-06-03use fixed system time in test mode to have fixed test outputTimo Teräs1-2/+2
fixes test suite regression from previous commit
2019-02-13fix strncpy bounds errorsTimo Teräs1-1/+4
error: 'strncpy' specified bound 4096 equals destination size [-Werror=stringop-truncation] Based on patch by Elan Ruusamäe <glen@delfi.ee>
2019-02-13include sys/sysmacros.h for makedev definitionElan Ruusamäe1-0/+1
2018-11-12prefer selecting packages by their primary nameTimo Teräs1-0/+8
2018-10-26add support for openssl 1.1Timo Teräs1-7/+12
2018-09-10rework unpacking of packages and harden package file format requirementsTimo Teräs1-53/+107
A crafted .apk file could to trick apk writing unverified data to an unexpected file during temporary file creation due to bugs in handling long link target name and the way a regular file is extracted. Several hardening steps are implemented to avoid this: - the temporary file is now always first unlinked (apk thus reserved all filenames .apk.* to be it's working files) - the temporary file is after that created with O_EXCL to avoid races - the temporary file is no longer directly the archive entry name and thus directly controlled by potentially untrusted data - long file names and link target names are now rejected - hard link targets are now more rigorously checked - various additional checks added for the extraction process to error out early in case of malformed (or old legacy) file Reported-by: Max Justicz <max@justi.cz>
2018-08-21prevent automatic repository index update with --no-networkNatanael Copa1-1/+2
We should not update repository index when --no-network is specified. ref #9126
2018-07-18prevent automatic repository index update for 'apk del'Timo Teräs1-2/+4
ref #9063
2018-04-05db: fix refreshing index if time is zeroTimo Teräs1-3/+5
During netboot on systems without RTC, time() will be near zero, and the index fill not exist. Thus the plain test of st.st_mtime against system time failed. Verify that fstatat() succeeds.
2018-01-08auto-update index only when database is opened for writingTimo Teräs1-1/+2
2018-01-04enable automatic update of indexes controlled by --cache-max-ageTimo Teräs1-18/+25
This modifies apk cache for indexes to be automatically refreshed periodically without explicit 'update' or '--update-cache' usage. The default is to do if-modified-since request if the local copy is older than 4 hours. This age can be changed with --cache-max-age. Using --update-cache will change this age to 60 seconds to make sure the cached copy is relatively new. The small age is in order to try to avoid downloading indexes second time when apk-tools is upgraded and apk re-execs after self-upgrade. Accordingly using explicitly 'apk update' will now enforce --force-refresh and request the very latest index by requesting any potential http proxy to do refresh too.
2018-01-03split --force to several --force-[type] optionsTimo Teräs1-6/+6
This unloads --force as several of the things are really not wanted together. E.g. --force-refresh is a lot different from --force-broken-world and doing --force to get the other might introduce unwanted behaviour. --force is still kept for backwards compatibility and it enables most things --force was used for.
2018-01-03db: fix triggers to report deleted directoriesTimo Teräs1-16/+19
This change just changes to keep deleted directory items in the hash with ref count zero and modified flag set. Those entries are reused when needed. The side effect is that fire_triggers() will now see those removed direcotries and reports them. Other enumerators of the directories hash are protected to skip removed directories when appropriate.
2017-10-10db: handle default root correctly for /procTimo Teräs1-1/+1
dbopts->root may be null; use db->root instead fixes #7162
2017-07-29database: include POSIX header for ST_* definesA. Wilcox1-0/+1
2017-06-26db: fix current directory instance caching in tar extractionTimo Teräs1-1/+1
Depending how the directory entries are ordered, the cached dir instance might not have been updated correctly. This has not been a problem as the entries have been ordered, but is now triggered on ppc.
2017-06-26database: mark error on renameat failureA. Wilcox1-2/+6
2017-06-23io: make io vtables const struct, and add accessors for themTimo Teräs1-26/+26
This reduces function pointers in heap, and unifies how the io functions are called.
2017-05-25db: fix regression preventing remounting apk cache r/wTimo Teräs1-1/+2
Introduced in commit c0f2d88f342f4d185f3991f98b79ab61a03896e4. fstatfs is needed to inspect the mount flags.
2017-04-28db: separate init from openKaarle Ritvanen1-11/+15
2017-03-13db: catch asprintf failureNatanael Copa1-1/+2
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-11-19 15:23:54 +0000