summaryrefslogtreecommitdiff
path: root/src/database.c
AgeCommit message (Collapse)AuthorFilesLines
2020-01-24Harden signature verification processReid Rankin1-15/+13
This mostly boils down to making sure control_started and data_started are consistently used to gate actions, instead of relying whether on file names start with a '.'. None of the weaknesses this fixes are exploitable, but they might have become so after changes to seemingly-unrelated code, so it's good to clean them up.
2020-01-11archive: make apk_tar_parse check and close input streamTimo Teräs1-19/+7
simplifies other code quite a bit
2020-01-11convert remaining locations to use istream instead of bstreamTimo Teräs1-25/+17
2020-01-11istream, archive, db: convert db and tar function to use istreamTimo Teräs1-51/+34
2020-01-11archive: remove support for old packages without xattr checksumsTimo Teräs1-4/+9
2020-01-09database.c: drop GNU extension for fnmatchDrew DeVault1-1/+1
The non-wildcard version of the function is case-sensitive anyway.
2020-01-06io: remove unused size parameter from bstream closeTimo Teräs1-5/+5
2019-12-27db: parse tabulator as repository separator charTimo Teräs1-0/+1
Fixes #10662
2019-11-22Don't unpack files to system rootFredrik Gustafsson1-1/+5
When unpacking a file that is in root, it got a temporary file name /.apk... however if the --root option was used it should have the name root/.apk... otherwise unpacking will fail if the user does not have write access to /. Signed-off-by: Fredrik Gustafsson <fredrigu@axis.com>
2019-06-03use fixed system time in test mode to have fixed test outputTimo Teräs1-2/+2
fixes test suite regression from previous commit
2019-02-13fix strncpy bounds errorsTimo Teräs1-1/+4
error: 'strncpy' specified bound 4096 equals destination size [-Werror=stringop-truncation] Based on patch by Elan Ruusamäe <glen@delfi.ee>
2019-02-13include sys/sysmacros.h for makedev definitionElan Ruusamäe1-0/+1
2018-11-12prefer selecting packages by their primary nameTimo Teräs1-0/+8
2018-10-26add support for openssl 1.1Timo Teräs1-7/+12
2018-09-10rework unpacking of packages and harden package file format requirementsTimo Teräs1-53/+107
A crafted .apk file could to trick apk writing unverified data to an unexpected file during temporary file creation due to bugs in handling long link target name and the way a regular file is extracted. Several hardening steps are implemented to avoid this: - the temporary file is now always first unlinked (apk thus reserved all filenames .apk.* to be it's working files) - the temporary file is after that created with O_EXCL to avoid races - the temporary file is no longer directly the archive entry name and thus directly controlled by potentially untrusted data - long file names and link target names are now rejected - hard link targets are now more rigorously checked - various additional checks added for the extraction process to error out early in case of malformed (or old legacy) file Reported-by: Max Justicz <max@justi.cz>
2018-08-21prevent automatic repository index update with --no-networkNatanael Copa1-1/+2
We should not update repository index when --no-network is specified. ref #9126
2018-07-18prevent automatic repository index update for 'apk del'Timo Teräs1-2/+4
ref #9063
2018-04-05db: fix refreshing index if time is zeroTimo Teräs1-3/+5
During netboot on systems without RTC, time() will be near zero, and the index fill not exist. Thus the plain test of st.st_mtime against system time failed. Verify that fstatat() succeeds.
2018-01-08auto-update index only when database is opened for writingTimo Teräs1-1/+2
2018-01-04enable automatic update of indexes controlled by --cache-max-ageTimo Teräs1-18/+25
This modifies apk cache for indexes to be automatically refreshed periodically without explicit 'update' or '--update-cache' usage. The default is to do if-modified-since request if the local copy is older than 4 hours. This age can be changed with --cache-max-age. Using --update-cache will change this age to 60 seconds to make sure the cached copy is relatively new. The small age is in order to try to avoid downloading indexes second time when apk-tools is upgraded and apk re-execs after self-upgrade. Accordingly using explicitly 'apk update' will now enforce --force-refresh and request the very latest index by requesting any potential http proxy to do refresh too.
2018-01-03split --force to several --force-[type] optionsTimo Teräs1-6/+6
This unloads --force as several of the things are really not wanted together. E.g. --force-refresh is a lot different from --force-broken-world and doing --force to get the other might introduce unwanted behaviour. --force is still kept for backwards compatibility and it enables most things --force was used for.
2018-01-03db: fix triggers to report deleted directoriesTimo Teräs1-16/+19
This change just changes to keep deleted directory items in the hash with ref count zero and modified flag set. Those entries are reused when needed. The side effect is that fire_triggers() will now see those removed direcotries and reports them. Other enumerators of the directories hash are protected to skip removed directories when appropriate.
2017-10-10db: handle default root correctly for /procTimo Teräs1-1/+1
dbopts->root may be null; use db->root instead fixes #7162
2017-07-29database: include POSIX header for ST_* definesA. Wilcox1-0/+1
2017-06-26db: fix current directory instance caching in tar extractionTimo Teräs1-1/+1
Depending how the directory entries are ordered, the cached dir instance might not have been updated correctly. This has not been a problem as the entries have been ordered, but is now triggered on ppc.
2017-06-26database: mark error on renameat failureA. Wilcox1-2/+6
2017-06-23io: make io vtables const struct, and add accessors for themTimo Teräs1-26/+26
This reduces function pointers in heap, and unifies how the io functions are called.
2017-05-25db: fix regression preventing remounting apk cache r/wTimo Teräs1-1/+2
Introduced in commit c0f2d88f342f4d185f3991f98b79ab61a03896e4. fstatfs is needed to inspect the mount flags.
2017-04-28db: separate init from openKaarle Ritvanen1-11/+15
2017-03-13db: catch asprintf failureNatanael Copa1-1/+2
2017-03-13db: prevent umount /proc when it was mounted by someone elseNatanael Copa1-1/+6
This fixes regression introduced by commit 72b878e655
2017-02-27db: allow overriding cache locationTimo Teräs1-7/+7
2017-02-27db: allow caching packages on tmpfsTimo Teräs1-3/+1
fixes #5616 The original intention was not use unnecessary space on tmpfs e.g. if the cache directory is a mount point, but accidentally left unmounted. But there are valid cases when packages are intentionally wanted to be cached on tmpfs. If caching is not desired, the user can just remove the cache directory.
2017-02-27db: mount /proc for --root if it's not mounted, use mount syscallTimo Teräs1-34/+46
musl c-library does not work properly without /proc, and potentially running the scripts need this.
2017-02-15add support for pre and post commit hooksHenrik Riomar1-0/+29
This allows for instance integration of etckeeper [TT: Reorganized code a bit, and modified to use single directory commit_hooks.d with argument for script of stage.]
2015-12-07db: add support for --no-cacheNatanael Copa1-1/+7
Implement --no-cache. The index is read directly from network and not cached. This is useful for docker, where you install a set of packages and directly after purge the cache. (see https://github.com/gliderlabs/docker-alpine/blob/1fc9e59d1689fc4eaf930ec66389fe58062fccec/builder/scripts/apk-install) fixes #4905
2015-11-09io, database: preserve [am]time for cached and fetched filesTimo Teräs1-0/+3
preserve [am]time for all packages and indexes. this fixes the caching error that 'apk update' is after new index is generated, but before the used mirror is synchronized. this caused local apkindex timestamp to be newer than file in mirror, when in fact it was outdated index. this also fixes fetched files to have build timestamp so that files going to .iso or custom images have proper timestamps (rsync with appropriate --modify-window now works)
2015-09-03db: stop extract more files if disk is fullTimo Teräs1-2/+4
2015-07-02relocate lock file to /lib/apk/dbTimo Teräs1-3/+2
the problem is that var/lock is on root installs symlink to /run/lock (on tmpfs) and does not exist if doing chroot() to that root. fixes apk to work when chrooted to existing rootfs install.
2015-06-26remove db dir entry properly, so it can be recreated properly if neededTimo Teräs1-7/+7
fixes #4261
2015-06-12for completeness free all arrays before exitTimo Teräs1-0/+1
so valgrind does not report any leaks
2015-06-11speed improvements for database openingTimo Teräs1-4/+43
resolve reverse dependencies after all packages have been loaded, and avoid traversing the reverse name lists. now that we use automatic virtual packages (soname, pkg-config, etc.) the reverse dependency chains can become considerable longer than what it was when the rdependency construction code was originally written.
2015-06-01fix directory permissions loadingTimo Teräs1-1/+4
commit 941fc1b1 uncovered a bug that directory permissions are not updated properly at db load time if it's the default acl.
2015-04-24do not extract files with malicious nameTimo Teräs1-1/+14
the security implications are not as high as compared to regular tar/unzip archiver. this is because you are anyway trusting the package to install files anywhere in the filesystem. this serves rather as a sanity to check against errors in created package.
2015-04-24modifications for the previous commit in error message handlingTimo Teräs1-0/+2
forgot to --amend my changes
2015-04-17make file install errors non-fatal, and xattr errors hiddenTimo Teräs1-28/+41
user xattrs on tmpfs are not supported no non-grsec kernels, and many times root fs is mounted without user_xattr. Thus to allow things to go smoothly on non-grsec kernels xattr unsupported errors are now hidden. xattrs can be fixed still now with "apk fix --xattrs"
2015-04-13fix tee io error handlingTimo Teräs1-1/+1
use ERR_PTR mechanism, and handle it at all places.
2015-04-08make default dir/file acl implicitTimo Teräs1-2/+2
apk in alpine 3.1 already supports this optimization, but kept the database format. now is time to start using this feature.
2015-04-07update: return failure if any mirror update failedNatanael Copa1-1/+3
fixes #4040
2015-03-11calculate and store checksum of xattrsTimo Teräs1-6/+20
ref #3027
generated by cgit v1.2.3-60-g2f50 (git 2.42.0) at 2024-07-01 12:51:34 +0000