summaryrefslogtreecommitdiff
path: root/bin/pax
AgeCommit message (Collapse)Author
2016-01-01don't declar main. from Michal MazurekTed Unangst
2015-12-24More adress -> addressmmcc
2015-12-16Replace "tame" by "pledge" in a comment.tb
2015-12-06pledge "dpath" to allow creation of nodes via mkfifo(2) and mknod(2)Theo de Raadt
NOTE: dpath requires a fairly new kernel ok semarie
2015-12-06Use __progname instead of manually handling argv[0].Tobias Stoeckmann
ok deraadt, mmcc, tedu
2015-11-17int -> size_t for a len fieldmmcc
ok guenther@, deraadt@
2015-10-14Use a strict $PATH of "/usr/bin:/usr/local/bin" to run the (de)compressorsTheo de Raadt
(gzip, compress, bzip2) rather than following the user's path. This seems easier than hardcoding the paths elsewhere and using basename(). pax/tar is pledged itself, but it can spawn one of these programs if asked. The three found at the strict path use pledge "stdio" very early during startup, providing a warm fuzzy pledge->exec->no-pledge->pledge interlock. For bzip2, this assumes use of the ports/packages version installed to /usr/local/bin, which has been pledged by sthen@. Doing a 'tar tvfz hostile.tgz' becomes a bit safer, since an attacker finding a buffer overflow or use after free has significantly fewer system calls available (only pledge "stdio" in the decompressor). ok millert sthen
2015-10-12reenable pledge(2) on pax, but only if pmode isn't in use or if actionSebastien Marie
shouldn't do things with filesystem. ok deraadt@ millert@
2015-10-12Revert the pledge() call on pax/ar_io.c for now.Sebastien Marie
A pledged program is not allowed to change user/group for others. "I think that makes the most sense" @sthen
2015-10-12preservation modes can adjust setugid bits, so no pledge is possible.Theo de Raadt
Otherwise, lay the groundwork for whether a gzip program may be run or not. After such a gzip program is started, pledge the program will not exec again. Took a few iterations to get this going... it is looking good. with guenther.
2015-09-13Describe tar's -p option correctlyPhilip Guenther
noted by trondd(at)kagu-tsuchi.com ok deraadt@
2015-05-18Make TAPE=- mean stdout in tarczarkoff
Some scripts and GUI ssh clients assume that tar writes to standard output by default. This changes allows enforcing such behavior by setting TAPE="-" in user profile. Also, this makes parsing argument to "-f" option and contents of TAPE environment variable consistent. OK guenther@, jmc@ and sthen@
2015-04-18Convert many atoi() calls to strtonum(), adding range checks and failureTheo de Raadt
handling along the way. Reviews by Brendan MacDonell, Jeremy Devenport, florian, doug, millert
2015-03-22rev 1.44 accidentally changed ar_close() to give cpio the same output as pax.Philip Guenther
Adjust the conditions to correct that. ok millert@
2015-03-19Use struct timespec internally. This gives nanosecond precision to pax -rwPhilip Guenther
and a basis for support of mtime and atime values in pax-format extended header records. ok millert@
2015-03-17Add PAX_IS_{REG,HARDLINK,LINK} macros to simply many file type testsPhilip Guenther
ok millert@
2015-03-15Define chdname once in a .c and make it extern in the .hPhilip Guenther
2015-03-15Handle tar -o by setting the tar_nodir directly instead of faking up aPhilip Guenther
pax-like -o write_opt=nodir. ok millert@ otto@
2015-03-15Using O_TRUNC with O_CREAT|O_EXCL is just confusing: fail if it exists,Philip Guenther
but if you *did* succeed anyway, truncate it?
2015-03-15pax -o only accepts 'write_opt=nodir' and not bare 'nodir'Philip Guenther
2015-03-15tzfile.h is an internal header that should never have been installed.Todd C. Miller
What's worse, the tzfile.h that gets installed is over 20 years old and doesn't match the real tzfile.h in libc/time. This makes the tree safe for /usr/include/tzfile.h removal. The TM_YEAR_BASE define has been moved to time.h temporarily until its usage is replaced by 1900 in the tree. Actual removal of tzfile.h is pending a ports build. Based on a diff from deraadt@
2015-03-12If an archive isn't a recognized type, then check whether it looksPhilip Guenther
like compress, gzip, bzip2, or xz output. If so then error out with a useful message directing the user to the correct option and error out instead of scanning forward for an embedded tar/cpio header. wording help from sobrado@ ok millert@ deraadt@
2015-03-09Fix comment grammarPhilip Guenther
2015-03-09Unrevert post-unlock:Philip Guenther
* Prevent an archive from esacaping the current directory by itself: when extracting a symlink whose value is absolute or contains ".." components, just create a zero-length normal file (with additional tracking of the mode and hardlinks to the symlink) until everything else is extracted, then go back and replace it with the requested link (if it's still that zero-length placeholder). * For tar without -P, if a path in the archive has any ".." components then strip everything up to and including the last of them (if it ends in ".." then it becomes ".") This mostly follows GNU tar's behavior, except for 'tar tf' and 'tar xvf' we report the modified path that would be/was actually created instead of the raw path from the archive Above two fixes prompted by a report from Daniel Cegielka (daniel.cegielka (at) gmail.com) * For directories whose times or mode will be fixed up in the clean-up pass, record their dev+ino and then use open(O_DIRECTORY)+fstat() to verify that we're updating the correct directory before using futimens() and fchmod(). * Correct buffer overflow in handling of pax extension headers, caught by the memcpy() overlap check. previously ok millert@ deraadt@
2015-02-21Recent changes haven't been completely stable, so revert for the 5.7 releasePhilip Guenther
requested by deraadt@
2015-02-15Fix two bugs. The first affected tar files with the sameTodd C. Miller
directory listed twice with nothing created inside the directory in between the two instances of the directory. The other fixes extracting symlinks when the -C option is used. From guenther@ OK krw@
2015-02-12Prevent an archive from esacaping the current directory by itself:Philip Guenther
when extracting a symlink whose value is absolute or contains ".." components, just create a zero-length normal file (with additional tracking of the mode and hardlinks to the symlink) until everything else is extracted, then go back and replace it with the requested link (if its still that zero-length placeholder). This and previous symlink and ".." path fixes prompted by a report from Daniel Cegielka (daniel.cegielka (at) gmail.com) ok millert@
2015-02-12For tar without -P, if a path in the archive has any ".." components thenPhilip Guenther
strip everything up to and including the last of them (if it ends in ".." then it becomes ".") This mostly follows GNU tar's behavior, except for 'tar tf' and 'tar xvf' we report the modified path that was actually created instead of the raw path from the archive ok w/tweak millert@, deraadt@
2015-02-12Put the dev+ino table for cpio hardlink matching behind #ifndef NOCPIOPhilip Guenther
ok millert@ deraadt@
2015-02-11Take II, this time without an incorrect mode test.Philip Guenther
For directories whose times or mode will be fixed up in the clean-up pass, record their dev+ino and then use open(O_DIRECTORY)+fstat() to verify that we're updating the correct directory before using futimens() and fchmod(). ok sthen@ millert@
2015-02-05backout previous for now; issues seen with "tar: Directory vanished beforeStuart Henderson
restoring mode and times: ..." (and an error exit code, which breaks at least building ports). krw@ agrees.
2015-02-05For directories whose times or mode will be fixed up in the clean-up pass,Philip Guenther
record their dev+ino and then use open(O_DIRECTORY)+fstat() to verify that we're updating the correct directory before using futimens() and fchmod(). ok millert@
2015-01-29Correct buffer overflow in handling of pax extension headers, caughtPhilip Guenther
by the memcpy() overlap check. ok millert@ deraadt@
2015-01-16Replace <sys/param.h> with <limits.h> and other less dirty headers whereTheo de Raadt
possible. Annotate <sys/param.h> lines with their current reasons. Switch to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where sensible to avoid pulling in the pollution. These are the files confirmed through binary verification. ok guenther, millert, doug (helped with the verification protocol)
2015-01-15remove .Tn; from Jan Stary <hans at stare dot cz>Ingo Schwarze
2014-12-13Sort members by size to reduce structure paddingPhilip Guenther
2014-11-23Don't pull in <tzfile.h> just for a number that's hardcoded in the C standardPhilip Guenther
2014-11-23Use PATH_MAX from <limits.h> instead of MAXPATHLEN from <sys/param.h>Philip Guenther
Eliminate a couple unneeded #includes
2014-11-23Don't leak the fds for "." and the tty to the compression processPhilip Guenther
2014-09-08obvious cases of missing .An;Ingo Schwarze
found with the new mandoc(1) MANDOCERR_AN_MISSING warning; no text changes
2014-07-14Constipate st_hash()Philip Guenther
2014-07-14Oops: resurrect cached file that wasn't ripe for deletionPhilip Guenther
2014-07-14Delete pointless 'return;' at end of functionPhilip Guenther
2014-07-11clarify a comment about readlink. from Doug HoganTed Unangst
2014-06-04undo my "no TZ support" notes; guenther says they're wrongJason McIntyre
ok guenther
2014-05-24Delete pointless casts: free() return value to (void), free()'sPhilip Guenther
argument to (char *), and malloc/calloc's return value to the type of the variable it's being assigned to. Convert the one calloc() where the zeroing isn't needed to a reallocarray(). ok millert@
2014-05-24Missed #include <signal.h>Philip Guenther
2014-05-24Make signal setup clearer via helper function, eliminating a gap inPhilip Guenther
ignoring signals when they were already ignored ok millert@
2014-05-23Archives written with a non-standard blocksize currently show up asPhilip Guenther
truncated reads. Until better detection of that case can is implemented, back out that part of rev 1.45 problem noted by sthen@
2014-05-23Make the signal handler safe: block signals when updating data-structuresPhilip Guenther
that are walked by routines called from the signal handler and use dprintf() instead fprintf() in ar_close(). ok millert@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 03:48:05 +0000