summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)AuthorFilesLines
2018-09-10rework unpacking of packages and harden package file format requirementsTimo Teräs5-103/+140
A crafted .apk file could to trick apk writing unverified data to an unexpected file during temporary file creation due to bugs in handling long link target name and the way a regular file is extracted. Several hardening steps are implemented to avoid this: - the temporary file is now always first unlinked (apk thus reserved all filenames .apk.* to be it's working files) - the temporary file is after that created with O_EXCL to avoid races - the temporary file is no longer directly the archive entry name and thus directly controlled by potentially untrusted data - long file names and link target names are now rejected - hard link targets are now more rigorously checked - various additional checks added for the extraction process to error out early in case of malformed (or old legacy) file Reported-by: Max Justicz <max@justi.cz> (cherry picked from commit 6484ed9849f03971eb48ee1fdc21a2f128247eb1)
2018-09-06apk: sanitize return valueTimo Teräs1-0/+3
Most applets return whatever apk_solver_commit() returns. It is the number of errors found (or negative for hard error). Sanitize the error value to not give false success exit code in the unlikely case of errors % 256 == 0. Reported-by: Max Justicz <max@justi.cz> (cherry picked from commit 7b654e125461b00bc26e52b25e6a7be3a32c11b9) (cherry picked from commit 7c90fd0529c0358dd04cab0fce506e8a8b191506)
2018-09-06archive: enable FIFO extractionJesse Young1-2/+4
(cherry picked from commit 1d55b9488f2d9c6d367fa7f21b058466c24f3ad1)
2018-09-06io: fix skip and splice to detect unexpected end-of-fileTimo Teräs2-31/+22
(cherry picked from commit 2f3c8420493a731556909eb3ebd6d50478fb7b24)
2018-09-06tar: return correct error for short read of tar archiveTimo Teräs1-3/+8
(cherry picked from commit ca368916e0333bf24cdcbdbe42130ec6a92c3f6e)
2017-06-23archive: validate reading of pax and gnu long filename extensionsTimo Teräs1-14/+14
Detect properly if the file stream gets an error during these read operations. Reported-by: Ariel Zelivansky from Twistlock (cherry picked from commit cd531aef3033475c26f29a1f650a3bf392cc2daa)
2017-06-23archive: fix incorrect bounds checking for memory allocationTimo Teräs1-2/+4
The value from tar header is unsigned int; keep it casted to unsigned int and size_t instead of (signed) int, otherwise the comparisons fail to do their job properly. Additionally check entry.size against SSIZE_MAX so the rounding up later on is guaranteed to not overflow. Fixes CVE-2017-9669 and CVE-2017-9671. Reported-by: Ariel Zelivansky from Twistlock (cherry picked from commit 286aa77ef1811e477895713df162c92b2ffc6df8)
2016-08-23pkg: reset umask for package scriptsTimo Teräs1-0/+1
It is unreasonable to assume that all package writers would except to reset umask themselves. It's done currently in most packages, but we had first issue of this kind recently, so better just reset umask.
2016-07-22upgrade: improve self upgrade functionality a bitTimo Teräs4-14/+45
trigger it only if apk-tools can be upgrade, add test cases
2016-07-22lua: remove unused reg_apk_db_meta_methodsTimo Teräs1-5/+0
2016-07-08detect aarch64 architecture and assign default name for itTimo Teräs1-2/+3
2016-07-06fix cross-compiling to pick right libfetch.aTimo Teräs1-1/+1
2016-06-13info: add support for --licenseNatanael Copa1-0/+16
print license with the --license option.
2016-06-13build: allow override compiler/linker flags for external libsNatanael Copa1-9/+11
Make it possible to individually override openssl, zlib and libfetch cflags and linker flags. This makes it possible to build apk-tools without having pkg-config installed.
2016-05-31fix info --who-owns to work with relative filenamesTimo Teräs1-5/+12
fixes #5656
2016-05-27index: don't return error if --index does not existsTimo Teräs1-2/+2
it's only used to speed up things, and having it non-existant is not a fatal error - all included things in index will be passed in command line anyway
2016-04-19apk: don't exit with error code for -V and --print-archTimo Teräs1-0/+2
2016-04-03blob: fix sign extension in test_bitTimo Teräs1-1/+1
2016-02-16fetch: allow enabling --simulateTimo Teräs2-2/+6
2016-02-16implement fetch --purgeTimo Teräs1-0/+36
which will delete any .apk package on output directory that were not downloaded by fetch this allows apk fetch to incrementally build repositories for binary images
2016-02-09archive: fix long symlink target namesTimo Teräs1-2/+2
don't overwrite the link_target if it was found from pax header. ref #5076
2015-12-10commit: self-conflict error and satisfies printingTimo Teräs3-11/+20
- self-conflicts when the exact same version of a name is provided twice is now properly detected and diagnozed - don't print redundant satisfies diagnostic
2015-12-10solver: more debug output for package errorsTimo Teräs1-7/+11
2015-12-07db: add support for --no-cacheNatanael Copa3-1/+12
Implement --no-cache. The index is read directly from network and not cached. This is useful for docker, where you install a set of packages and directly after purge the cache. (see https://github.com/gliderlabs/docker-alpine/blob/1fc9e59d1689fc4eaf930ec66389fe58062fccec/builder/scripts/apk-install) fixes #4905
2015-11-12info: fix --installed test of conflictsTimo Teräs1-5/+5
2015-11-12add armv7 targetTimo Teräs1-0/+2
2015-11-09io, database: preserve [am]time for cached and fetched filesTimo Teräs7-11/+122
preserve [am]time for all packages and indexes. this fixes the caching error that 'apk update' is after new index is generated, but before the used mirror is synchronized. this caused local apkindex timestamp to be newer than file in mirror, when in fact it was outdated index. this also fixes fetched files to have build timestamp so that files going to .iso or custom images have proper timestamps (rsync with appropriate --modify-window now works)
2015-11-09search: match packages only onceTimo Teräs1-0/+9
fixes #4770 apk_name_foreach_matching() can matches each package via it's main name and all it's provides. Print matched packages only once.
2015-10-08io: fix posix_fallocate failure handlingNatanael Copa1-1/+1
We need fall back to a splice buffer if posix_fallocate call fails due to file being a device (eg tty) or a pipe. This fixes apk fetch --stdout.
2015-10-08blob: Add missing headerAndrew Wilcox1-0/+1
2015-09-03db: stop extract more files if disk is fullTimo Teräs1-2/+4
2015-09-03io: use posix_fallocate to allocate disk spaceTimo Teräs1-3/+8
ftruncate does not allocate it, and subsequent access to mmaped file will result in SIGBUS. this fixes to properly report disk full errors.
2015-07-02relocate lock file to /lib/apk/dbTimo Teräs1-3/+2
the problem is that var/lock is on root installs symlink to /run/lock (on tmpfs) and does not exist if doing chroot() to that root. fixes apk to work when chrooted to existing rootfs install.
2015-06-26remove db dir entry properly, so it can be recreated properly if neededTimo Teräs1-7/+7
fixes #4261
2015-06-12add simple stats appletTimo Teräs3-2/+67
2015-06-12free atoms when VALGRIND is definedTimo Teräs1-0/+10
2015-06-12for completeness free all arrays before exitTimo Teräs2-0/+2
so valgrind does not report any leaks
2015-06-12fix bstream_from_fd to use mmap when availableTimo Teräs1-1/+2
2015-06-12fix search --has-origin to not leak memoryTimo Teräs1-1/+1
2015-06-12optimize base64 decoding a bitTimo Teräs1-20/+16
it's a hot path for decoding checksums in fdb
2015-06-11use murmur3_32 hashTimo Teräs1-6/+45
it is more efficient than the previously used djb hash
2015-06-11speed improvements for database openingTimo Teräs2-4/+44
resolve reverse dependencies after all packages have been loaded, and avoid traversing the reverse name lists. now that we use automatic virtual packages (soname, pkg-config, etc.) the reverse dependency chains can become considerable longer than what it was when the rdependency construction code was originally written.
2015-06-10search: fix swapped needle and haystackBobby Bingham1-2/+2
2015-06-01fix directory permissions loadingTimo Teräs2-2/+5
commit 941fc1b1 uncovered a bug that directory permissions are not updated properly at db load time if it's the default acl.
2015-05-26detect failures in writing to file during final flush of buffersAlex Dowad1-1/+3
In practice this should fix to e.g. not wipe out /etc/apk/world if final flush to /etc/apk/world.new fails. This was prompted by an incident the other day where I ran the root partition of an Alpine box out of space using 'apk add', and apk helpfully wiped the contents of /etc/apk/world at the same time. It might be tricky to try to reproduce exactly the same failure, but from an examination of the code, setting 'rc' before the final call to fdo_flush rather than after is one possible cause of this behavior. (If the entire contents of /etc/apk/world.new are buffered, and all get written out in the final fdo_flush call, and that call fails, fdo_close will still happily rename /etc/apk/world.new to /etc/apk/world.)
2015-04-24do not extract files with malicious nameTimo Teräs1-1/+14
the security implications are not as high as compared to regular tar/unzip archiver. this is because you are anyway trusting the package to install files anywhere in the filesystem. this serves rather as a sanity to check against errors in created package.
2015-04-24allow virtual packages beginning with dot by default on tmpfs installsTimo Teräs1-3/+3
the allows update-kernel script to work on tmpfs install before cache is configured.
2015-04-24modifications for the previous commit in error message handlingTimo Teräs4-5/+8
forgot to --amend my changes
2015-04-22print.c: provide more detailed error messages if retrieving a package failsAlex Dowad2-1/+21
fetch_maperror() translates error codes returned by libfetch to our error codes. Handle those in apk_error_str(), returning error messages which advise the user of the most likely fix. A custom error code, EAPKSTALEINDEX, has been added for cases where retrieving a package fails due to a HTTP error 404 or similar. [TimoT: add also EAPKBADURL, as well as organize a bit better where the EAPKSTALEINDEX is generated]
2015-04-22io: fix compiler error by including stdint.hAlex Dowad1-0/+1
According to the C standards, uint32_t is defined in stdint.h. Presumably apk is usually built against C libraries where stdint.h is indirectly included through another header file, but this isn't the case with the version of glibc which I am using.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2025-04-05 00:42:26 +0000