diff options
Diffstat (limited to 'recipes-core/swupd-client/swupd-client')
6 files changed, 80 insertions, 647 deletions
diff --git a/recipes-core/swupd-client/swupd-client/0001-Add-configure-option-to-re-enable-updating-of-config.patch b/recipes-core/swupd-client/swupd-client/0001-Add-configure-option-to-re-enable-updating-of-config.patch index 649f7da..06f138c 100644 --- a/recipes-core/swupd-client/swupd-client/0001-Add-configure-option-to-re-enable-updating-of-config.patch +++ b/recipes-core/swupd-client/swupd-client/0001-Add-configure-option-to-re-enable-updating-of-config.patch @@ -1,22 +1,24 @@ -From d648898c8f9823a8d511507f93390079954bc24a Mon Sep 17 00:00:00 2001 +From 72bcbe256a6612954ea24175538660864e65e26d Mon Sep 17 00:00:00 2001 From: Joshua Lock <joshua.g.lock@intel.com> Date: Mon, 18 Apr 2016 13:30:18 +0100 -Subject: [PATCH] Add configure option to re-enable updating of config files +Subject: [PATCH 2/4] Add configure option to re-enable updating of config + files Upstream-Status: Pending Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> + --- configure.ac | 7 +++++++ src/heuristics.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac -index b1905f0..4a5c029 100644 +index ee05258..5cbc450 100644 --- a/configure.ac +++ b/configure.ac -@@ -63,6 +63,13 @@ AS_IF([test "x$enable_bsdtar" = "xyes" ], - [AC_DEFINE(SWUPD_WITHOUT_BSDTAR, 1, [Use default tar])] +@@ -153,6 +153,13 @@ AS_IF([test "x$enable_tar_selinux" = "xyes"], + [TARSELINUX=no] ) +AC_ARG_ENABLE( @@ -30,7 +32,7 @@ index b1905f0..4a5c029 100644 [path to systemd system service dir @<:@default=/usr/lib/systemd/system@:>@]), [unitpath=${withval}], [unitpath="$($PKG_CONFIG --variable=systemdsystemunitdir systemd)"]) diff --git a/src/heuristics.c b/src/heuristics.c -index e7c0632..c488e17 100644 +index 1b5d6c9..a2615f3 100644 --- a/src/heuristics.c +++ b/src/heuristics.c @@ -27,6 +27,7 @@ @@ -53,5 +55,5 @@ index e7c0632..c488e17 100644 is_state(file->filename) || // ideally we trust the manifest but short term reapply check here (file->is_boot && file->is_deleted) || -- -2.5.5 +2.1.4 diff --git a/recipes-core/swupd-client/swupd-client/0001-downloads-minimize-syscalls-to-improve-performance.patch b/recipes-core/swupd-client/swupd-client/0001-downloads-minimize-syscalls-to-improve-performance.patch deleted file mode 100644 index 59875b7..0000000 --- a/recipes-core/swupd-client/swupd-client/0001-downloads-minimize-syscalls-to-improve-performance.patch +++ /dev/null @@ -1,186 +0,0 @@ -From 9bc713b7ed0dba91304c5d7ed4905f5924ad8e42 Mon Sep 17 00:00:00 2001 -From: Patrick Ohly <patrick.ohly@intel.com> -Date: Thu, 14 Apr 2016 11:03:31 +0200 -Subject: [PATCH 1/3] downloads: minimize syscalls to improve performance - -The previous approach was to open/fdopen/fclose the file for each -chunk that gets passed from curl. This incurrs a huge performance hit -when close() triggers a hashing of the file content on systems where -integrity protection via IMA is enabled. - -Now the file is opened only once and kept open until the download is -complete. In addition, the unnecessary usage of C file IO is avoided. - -The semantic is changed as little as possible: -- file gets created only after the first chunk of data arrived -- file descriptors do not leak to child processes (O_CLOEXEC) -- data gets appended to existing files (via O_APPEND, used - to keep the code simple and avoid an additional lseek) -- data gets flushed explicitly for each chunk (via fdatasync(), - which somewhat approximates the effect that an explicit - close() may have had) - -As an additional improvement, failures during close() are checked. To -keep error handling as much as before, the completion function which has -the close() takes the current curl error code and replaces it if it -encounters a write error. - -[v2 of the patch with fixes by Dmitry Rozhkov, see https://github.com/pohly/swupd-client/pull/1] - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> ---- - include/swupd.h | 3 +++ - src/curl.c | 63 ++++++++++++++++++++++++++++++++++++++++----------------- - src/download.c | 8 +++++++- - 3 files changed, 54 insertions(+), 20 deletions(-) - -diff --git a/include/swupd.h b/include/swupd.h -index 14e65ab..3bac8b2 100644 ---- a/include/swupd.h -+++ b/include/swupd.h -@@ -89,6 +89,7 @@ struct file { - int last_change; - struct update_stat stat; - -+ unsigned int fd_valid : 1; - unsigned int is_dir : 1; - unsigned int is_file : 1; - unsigned int is_link : 1; -@@ -109,6 +110,7 @@ struct file { - - char *staging; /* output name used during download & staging */ - CURL *curl; /* curl handle if downloading */ -+ int fd; /* file written into during downloading, unset when fd_valid is false */ - }; - - extern bool download_only; -@@ -199,6 +201,7 @@ extern void swupd_curl_set_current_version(int v); - extern void swupd_curl_set_requested_version(int v); - extern double swupd_query_url_content_size(char *url); - extern size_t swupd_download_file(void *ptr, size_t size, size_t nmemb, void *userdata); -+extern CURLcode swupd_download_file_complete(CURLcode curl_ret, struct file *file); - extern int swupd_curl_get_file(const char *url, char *filename, struct file *file, - struct version_container *tmp_version, bool pack); - #define SWUPD_CURL_LOW_SPEED_LIMIT 1 -diff --git a/src/curl.c b/src/curl.c -index b14193b..cab1ef2 100644 ---- a/src/curl.c -+++ b/src/curl.c -@@ -165,35 +165,57 @@ size_t swupd_download_file(void *ptr, size_t size, size_t nmemb, void *userdata) - const char *outfile; - int fd; - FILE *f; -- size_t written; -+ size_t written, remaining; - - outfile = file->staging; -+ if (file->fd_valid) { -+ fd = file->fd; -+ } else { -+ fd = open(outfile, O_CREAT | O_RDWR | O_CLOEXEC | O_APPEND, 00600); -+ if (fd < 0) { -+ fprintf(stderr, "Cannot open file for write \\*outfile=\"%s\",strerror=\"%s\"*\\\n", -+ outfile, strerror(errno)); -+ return -1; -+ } -+ file->fd = fd; -+ file->fd_valid = 1; -+ } - -- fd = open(outfile, O_CREAT | O_RDWR, 00600); -- if (fd < 0) { -- printf("Error: Cannot open %s for write: %s\n", -- outfile, strerror(errno)); -- return -1; -+ /* handle short writes with repeated write() calls */ -+ for (remaining = size * nmemb; remaining; remaining -= written) { -+ written = write(fd, ptr, size*nmemb); -+ if (written < 0) { -+ if (errno == EINTR) { -+ written = 0; -+ continue; -+ } -+ fprintf(stderr, "write error \\*outfile=\"%s\",strerror=\"%s\"*\\\n", -+ outfile, strerror(errno)); -+ return -1; -+ } - } - -- f = fdopen(fd, "a"); -- if (!f) { -- printf("Error: Cannot fdopen %s for write: %s\n", -- outfile, strerror(errno)); -- close(fd); -+ if (fdatasync(fd)) { -+ fprintf(stderr, "fdatasync \\*outfile=\"%s\",strerror=\"%s\"*\\\n", outfile, strerror(errno)); - return -1; - } - -- written = fwrite(ptr, size * nmemb, 1, f); -- -- fflush(f); -- fclose(f); -+ return size*nmemb; -+} - -- if (written != 1) { -- return -1; -+CURLcode swupd_download_file_complete(CURLcode curl_ret, struct file *file) -+{ -+ if (file->fd_valid) { -+ if (close(file->fd)) { -+ fprintf(stderr, "Cannot close file after write \\*outfile=\"%s\",strerror=\"%s\"*\\\n", -+ file->staging, strerror(errno)); -+ if (curl_ret == CURLE_OK) { -+ curl_ret = CURLE_WRITE_ERROR; -+ } -+ } -+ file->fd_valid = 0; - } -- -- return size * nmemb; -+ return curl_ret; - } - - /* Download a single file SYNCHRONOUSLY -@@ -281,6 +303,9 @@ int swupd_curl_get_file(const char *url, char *filename, struct file *file, - } - - exit: -+ if (local) { -+ curl_ret = swupd_download_file_complete(curl_ret, local); -+ } - if (curl_ret == CURLE_OK) { - /* curl command succeeded, download might've failed, let our caller handle */ - switch (ret) { -diff --git a/src/download.c b/src/download.c -index 6d81d81..c4a7a07 100644 ---- a/src/download.c -+++ b/src/download.c -@@ -164,6 +164,7 @@ static void free_curl_list_data(void *data) - { - struct file *file = (struct file *)data; - CURL *curl = file->curl; -+ (void) swupd_download_file_complete(CURLE_OK, file); - if (curl != NULL) { - curl_multi_remove_handle(mcurl, curl); - curl_easy_cleanup(curl); -@@ -368,9 +369,14 @@ static int perform_curl_io_and_complete(int *left) - continue; - } - -+ /* Get error code from easy handle and augment it if -+ * completing the download encounters further problems. */ -+ curl_ret = msg->data.result; -+ curl_ret = swupd_download_file_complete(curl_ret, file); -+ - /* The easy handle may have an error set, even if the server returns - * HTTP 200, so retry the download for this case. */ -- if (ret == 200 && msg->data.result != CURLE_OK) { -+ if (ret == 200 && curl_ret != CURLE_OK) { - printf("Error for %s download: %s\n", file->hash, - curl_easy_strerror(msg->data.result)); - failed = list_prepend_data(failed, file); --- -2.1.4 - diff --git a/recipes-core/swupd-client/swupd-client/0001-fix-enable-xattr.patch b/recipes-core/swupd-client/swupd-client/0001-fix-enable-xattr.patch new file mode 100644 index 0000000..b3539df --- /dev/null +++ b/recipes-core/swupd-client/swupd-client/0001-fix-enable-xattr.patch @@ -0,0 +1,56 @@ +From a8c7a7a93e19b328a1a6e8114f21b2bff9ad4f69 Mon Sep 17 00:00:00 2001 +From: Patrick Ohly <patrick.ohly@intel.com> +Date: Thu, 17 Nov 2016 18:00:46 +0100 +Subject: [PATCH] fix --enable-xattr + +Commit fc0f570d added a check that prevents using --enable-xattr +together with --enable-bsdtar, perhaps because it was assumed that this +wouldn't work because there is no special tar option as in the GNU tar +case. + +But that combination works fine for (and is needed by) Ostro OS with +IMA and Smack xattrs, so the check needs to be removed. + +Besides that, enabling xattrs also had no effect because xattrs.c +never got to see the SWUPD_WITH_XATTRS define due to not including +config.h. + +Upstream-Status: Backported [https://github.com/clearlinux/swupd-client/commit/a2b80dc6958b78885ec395f22d34996e71a5f58a] + +Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> +--- + configure.ac | 5 +---- + src/xattrs.c | 1 + + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 5cbc450..2166fd0 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -135,10 +135,7 @@ AC_ARG_ENABLE( + AS_HELP_STRING([--enable-xattr],[Use extended file attributes (unused by default)]) + ) + AS_IF([test "x$enable_xattr" = "xyes"], +- [AC_DEFINE(SWUPD_WITH_XATTRS,1,[Use extended file attributes]) +- AS_IF(test "x$enable_bsdtar" = "xyes", +- echo "Options --enable-bsdtar and --enable-xattr are incompatible" >&2 +- AS_EXIT(1))], ++ [AC_DEFINE(SWUPD_WITH_XATTRS,1,[Use extended file attributes])], + [XATTR=no] + ) + TARSELINUX="yes" +diff --git a/src/xattrs.c b/src/xattrs.c +index 36d4241..bbca237 100644 +--- a/src/xattrs.c ++++ b/src/xattrs.c +@@ -27,6 +27,7 @@ + #include <string.h> + #include <sys/xattr.h> + ++#include "config.h" + #include "swupd.h" + #include "xattrs.h" + +-- +2.1.4 + diff --git a/recipes-core/swupd-client/swupd-client/0002-downloads-open-FILE-in-advance-and-use-default-write.patch b/recipes-core/swupd-client/swupd-client/0002-downloads-open-FILE-in-advance-and-use-default-write.patch deleted file mode 100644 index 4d8339a..0000000 --- a/recipes-core/swupd-client/swupd-client/0002-downloads-open-FILE-in-advance-and-use-default-write.patch +++ /dev/null @@ -1,184 +0,0 @@ -From 26c603ad25469d3e37fc00b78ad161b34093f5fa Mon Sep 17 00:00:00 2001 -From: Patrick Ohly <patrick.ohly@intel.com> -Date: Tue, 15 Nov 2016 15:01:38 +0100 -Subject: [PATCH 2/3] downloads: open FILE in advance and use default write - handler - -Now that the number of pending downloads is kept below a certain limit -(see poll_fewer_than()) it is possible to open files before starting -the transfer. Using the default curl write handler and explicit -open/close of the file makes the code simpler. - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> ---- - include/swupd.h | 5 ++--- - src/curl.c | 59 +++++++++++++-------------------------------------------- - src/download.c | 6 ++++-- - 3 files changed, 19 insertions(+), 51 deletions(-) - -diff --git a/include/swupd.h b/include/swupd.h -index 3bac8b2..ed4b82c 100644 ---- a/include/swupd.h -+++ b/include/swupd.h -@@ -89,7 +89,6 @@ struct file { - int last_change; - struct update_stat stat; - -- unsigned int fd_valid : 1; - unsigned int is_dir : 1; - unsigned int is_file : 1; - unsigned int is_link : 1; -@@ -110,7 +109,7 @@ struct file { - - char *staging; /* output name used during download & staging */ - CURL *curl; /* curl handle if downloading */ -- int fd; /* file written into during downloading, unset when fd_valid is false */ -+ FILE *fh; /* file written into during downloading */ - }; - - extern bool download_only; -@@ -200,7 +199,7 @@ extern void swupd_curl_cleanup(void); - extern void swupd_curl_set_current_version(int v); - extern void swupd_curl_set_requested_version(int v); - extern double swupd_query_url_content_size(char *url); --extern size_t swupd_download_file(void *ptr, size_t size, size_t nmemb, void *userdata); -+extern CURLcode swupd_download_file_start(struct file *file); - extern CURLcode swupd_download_file_complete(CURLcode curl_ret, struct file *file); - extern int swupd_curl_get_file(const char *url, char *filename, struct file *file, - struct version_container *tmp_version, bool pack); -diff --git a/src/curl.c b/src/curl.c -index cab1ef2..009fdd5 100644 ---- a/src/curl.c -+++ b/src/curl.c -@@ -158,62 +158,28 @@ static size_t swupd_download_version_to_memory(void *ptr, size_t size, size_t nm - return data_len; - } - --/* curl easy CURLOPT_WRITEFUNCTION callback */ --size_t swupd_download_file(void *ptr, size_t size, size_t nmemb, void *userdata) -+CURLcode swupd_download_file_start(struct file *file) - { -- struct file *file = (struct file *)userdata; -- const char *outfile; -- int fd; -- FILE *f; -- size_t written, remaining; -- -- outfile = file->staging; -- if (file->fd_valid) { -- fd = file->fd; -- } else { -- fd = open(outfile, O_CREAT | O_RDWR | O_CLOEXEC | O_APPEND, 00600); -- if (fd < 0) { -- fprintf(stderr, "Cannot open file for write \\*outfile=\"%s\",strerror=\"%s\"*\\\n", -- outfile, strerror(errno)); -- return -1; -- } -- file->fd = fd; -- file->fd_valid = 1; -- } -- -- /* handle short writes with repeated write() calls */ -- for (remaining = size * nmemb; remaining; remaining -= written) { -- written = write(fd, ptr, size*nmemb); -- if (written < 0) { -- if (errno == EINTR) { -- written = 0; -- continue; -- } -- fprintf(stderr, "write error \\*outfile=\"%s\",strerror=\"%s\"*\\\n", -- outfile, strerror(errno)); -- return -1; -- } -+ file->fh = fopen(file->staging, "w"); -+ if (!file->fh) { -+ fprintf(stderr, "Cannot open file for write \\*outfile=\"%s\",strerror=\"%s\"*\\\n", -+ file->staging, strerror(errno)); -+ return CURLE_WRITE_ERROR; - } -- -- if (fdatasync(fd)) { -- fprintf(stderr, "fdatasync \\*outfile=\"%s\",strerror=\"%s\"*\\\n", outfile, strerror(errno)); -- return -1; -- } -- -- return size*nmemb; -+ return CURLE_OK; - } - - CURLcode swupd_download_file_complete(CURLcode curl_ret, struct file *file) - { -- if (file->fd_valid) { -- if (close(file->fd)) { -+ if (file->fh) { -+ if (fclose(file->fh)) { - fprintf(stderr, "Cannot close file after write \\*outfile=\"%s\",strerror=\"%s\"*\\\n", - file->staging, strerror(errno)); - if (curl_ret == CURLE_OK) { - curl_ret = CURLE_WRITE_ERROR; - } - } -- file->fd_valid = 0; -+ file->fh = NULL; - } - return curl_ret; - } -@@ -246,6 +212,7 @@ int swupd_curl_get_file(const char *url, char *filename, struct file *file, - - if (file) { - local = file; -+ local->fh = NULL; - } else { - local = calloc(1, sizeof(struct file)); - if (!local) { -@@ -266,11 +233,11 @@ int swupd_curl_get_file(const char *url, char *filename, struct file *file, - if (curl_ret != CURLE_OK) { - goto exit; - } -- curl_ret = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, swupd_download_file); -+ curl_ret = swupd_download_file_start(local); - if (curl_ret != CURLE_OK) { - goto exit; - } -- curl_ret = curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)local); -+ curl_ret = curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)local->fh); - if (curl_ret != CURLE_OK) { - goto exit; - } -diff --git a/src/download.c b/src/download.c -index c4a7a07..397d56c 100644 ---- a/src/download.c -+++ b/src/download.c -@@ -475,6 +475,7 @@ void full_download(struct file *file) - CURLMcode curlm_ret = CURLM_OK; - CURLcode curl_ret = CURLE_OK; - -+ file->fh = NULL; - ret = swupd_curl_hashmap_insert(file); - if (ret > 0) { /* no download needed */ - /* File already exists - report success */ -@@ -510,11 +511,11 @@ void full_download(struct file *file) - if (curl_ret != CURLE_OK) { - goto out_bad; - } -- curl_ret = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, swupd_download_file); -+ curl_ret = swupd_download_file_start(file); - if (curl_ret != CURLE_OK) { - goto out_bad; - } -- curl_ret = curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)file); -+ curl_ret = curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)file->fh); - if (curl_ret != CURLE_OK) { - goto out_bad; - } -@@ -536,6 +537,7 @@ void full_download(struct file *file) - goto out_good; - - out_bad: -+ (void) swupd_download_file_complete(CURLE_OK, file); - failed = list_prepend_data(failed, file); - if (curl != NULL) { - /* Must remove handle out of multi queue first!*/ --- -2.1.4 - diff --git a/recipes-core/swupd-client/swupd-client/Make-pinned-pubkey-configurable.patch b/recipes-core/swupd-client/swupd-client/Make-pinned-pubkey-configurable.patch deleted file mode 100644 index 4326a58..0000000 --- a/recipes-core/swupd-client/swupd-client/Make-pinned-pubkey-configurable.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 6792cfef0ebfbe83e41bc81df6bc675604d7c943 Mon Sep 17 00:00:00 2001 -From: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com> -Date: Tue, 16 Aug 2016 10:55:15 +0300 -Subject: [PATCH] Make pinned pubkey configurable - -The server may move to a new location where a different pubkey -needs to be used and the hardcoded one won't work. - -This patch makes pinned pubkey configurable. - -Upstream-Status: Submitted [https://github.com/clearlinux/swupd-client/pull/110] - -Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com> ---- - configure.ac | 2 ++ - include/swupd.h | 1 + - src/curl.c | 2 +- - src/globals.c | 14 ++++++++++++++ - 4 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index 83007aa..883553a 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -114,6 +114,7 @@ AH_TEMPLATE([LOCK_DIR],[Directory for lock file]) - AH_TEMPLATE([BUNDLES_DIR],[Directory to use for bundles]) - AH_TEMPLATE([UPDATE_CA_CERTS_PATH],[Location of CA certificates]) - AH_TEMPLATE([MOTD_FILE],[motd file path]) -+AH_TEMPLATE([PINNED_PUBKEY_PATH],[Path to pinned public key]) - - if test "$enable_linux_rootfs_build" = "yes"; then - AC_DEFINE([SWUPD_LINUX_ROOTFS],1) -@@ -124,6 +125,7 @@ if test "$enable_linux_rootfs_build" = "yes"; then - AC_DEFINE([BUNDLES_DIR],["/usr/share/clear/bundles"]) - AC_DEFINE_UNQUOTED([UPDATE_CA_CERTS_PATH],["$certs_path"]) - AC_DEFINE([MOTD_FILE],["/usr/lib/motd.d/001-new-release"]) -+ AC_DEFINE_UNQUOTED([PINNED_PUBKEY_PATH],["${certs_path}/425b0f6b.key"]) - else - AC_MSG_ERROR([Unknown build variant]) - fi -diff --git a/include/swupd.h b/include/swupd.h -index 5c722d3..3658dc8 100644 ---- a/include/swupd.h -+++ b/include/swupd.h -@@ -132,6 +132,7 @@ extern void *tm_dlhandle; - extern char *bundle_to_add; - extern struct timeval start_time; - extern char *state_dir; -+extern char *pinned_pubkey_path; - - extern char *version_url; - extern char *content_url; -diff --git a/src/curl.c b/src/curl.c -index 6b6099f..b14193b 100644 ---- a/src/curl.c -+++ b/src/curl.c -@@ -447,7 +447,7 @@ static CURLcode swupd_curl_set_security_opts(CURL *curl) - goto exit; - } - -- curl_ret = curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "/usr/share/clear/update-ca/425b0f6b.key"); -+ curl_ret = curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, pinned_pubkey_path); - if (curl_ret != CURLE_OK) { - goto exit; - } -diff --git a/src/globals.c b/src/globals.c -index f2f1200..d0858df 100644 ---- a/src/globals.c -+++ b/src/globals.c -@@ -51,6 +51,7 @@ char *mounted_dirs = NULL; - char *bundle_to_add = NULL; - struct timeval start_time; - char *state_dir = NULL; -+char *pinned_pubkey_path = NULL; - - /* NOTE: Today the content and version server urls are the same in - * all cases. It is highly likely these will eventually differ, eg: -@@ -68,6 +69,7 @@ long update_server_port = -1; - static const char *default_version_url_path = "/usr/share/defaults/swupd/versionurl"; - static const char *default_content_url_path = "/usr/share/defaults/swupd/contenturl"; - static const char *default_format_path = "/usr/share/defaults/swupd/format"; -+static const char *default_pinnedpubkey_path = "/usr/share/defaults/swupd/pinnedpubkey"; - - static int set_default_value(char **global, const char *path) - { -@@ -194,6 +196,16 @@ bool set_state_dir(char *path) - return true; - } - -+void set_pinned_pubkey_path() -+{ -+ int ret; -+ -+ ret = set_default_value(&pinned_pubkey_path, default_pinnedpubkey_path); -+ if (ret < 0) { -+ string_or_die(&pinned_pubkey_path, "%s", PINNED_PUBKEY_PATH); -+ } -+} -+ - bool set_format_string(char *userinput) - { - int ret; -@@ -322,6 +334,7 @@ bool init_globals(void) - (void)set_format_string(NULL); - set_version_url(NULL); - set_content_url(NULL); -+ set_pinned_pubkey_path(); - - /* must set this global after version_url and content_url */ - set_local_download(); -@@ -337,6 +350,7 @@ void free_globals(void) - free(format_string); - free(mounted_dirs); - free(state_dir); -+ free(pinned_pubkey_path); - if (bundle_to_add != NULL) { - free(bundle_to_add); - } diff --git a/recipes-core/swupd-client/swupd-client/ignore-xattrs-when-verifying-Manifest-files.patch b/recipes-core/swupd-client/swupd-client/ignore-xattrs-when-verifying-Manifest-files.patch index 7410b1d..b3dd47b 100644 --- a/recipes-core/swupd-client/swupd-client/ignore-xattrs-when-verifying-Manifest-files.patch +++ b/recipes-core/swupd-client/swupd-client/ignore-xattrs-when-verifying-Manifest-files.patch @@ -1,7 +1,7 @@ -From c16e1e7fc16933669ed4be63858edd4082509183 Mon Sep 17 00:00:00 2001 +From cc44bbfb2eaa90284a67ad6d42706e6433abd7ff Mon Sep 17 00:00:00 2001 From: Patrick Ohly <patrick.ohly@intel.com> Date: Thu, 3 Nov 2016 11:47:53 +0100 -Subject: [PATCH] ignore xattrs when verifying Manifest files +Subject: [PATCH 1/3] verify_file: ignore xattrs when verifying Manifest files When IMA or Smack are active on the client, the downloaded Manifest files will be assigned certain xattrs (security.ima @@ -12,170 +12,33 @@ Manifest hashes even if they existed (see write_manifest_plain() in src/manifest.c). Therefore the client must ignore xattrs when verifying Manifest files. -This is the only place where verification gets relaxed. All other locations -still use xattrs, just as before. + +Upstream-Status: Backported [https://github.com/clearlinux/swupd-client/commit/09c26658d346cdd80ea54188d991db3493983176] Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> --- - include/swupd.h | 2 +- - src/delta.c | 2 +- - src/download.c | 6 +++--- - src/hash.c | 6 +++--- - src/helpers.c | 2 +- - src/manifest.c | 2 +- - src/scripts.c | 2 +- - src/verify.c | 4 ++-- - 8 files changed, 13 insertions(+), 13 deletions(-) + src/hash.c | 9 ++++++++- -diff --git a/include/swupd.h b/include/swupd.h -index e1e1f3d..14e65ab 100644 ---- a/include/swupd.h -+++ b/include/swupd.h -@@ -225,7 +225,7 @@ extern struct list *recurse_manifest(struct manifest *manifest, const char *comp - extern struct list *consolidate_files(struct list *files); - extern void debug_write_manifest(struct manifest *manifest, char *filename); - extern void populate_file_struct(struct file *file, char *filename); --extern bool verify_file(struct file *file, char *filename); -+extern bool verify_file(struct file *file, char *filename, bool use_xattrs); - extern int verify_bundle_hash(struct manifest *manifest, struct file *bundle); - extern void unlink_all_staged_content(struct file *file); - extern void link_renames(struct list *newfiles, struct manifest *from_manifest); -diff --git a/src/delta.c b/src/delta.c -index 8172b67..317adde 100644 ---- a/src/delta.c -+++ b/src/delta.c -@@ -109,7 +109,7 @@ static void do_delta(struct file *file) - } - xattrs_copy(origin, filename); - -- if (!verify_file(file, filename)) { -+ if (!verify_file(file, filename, true)) { - unlink_all_staged_content(file); - goto out; - } -diff --git a/src/download.c b/src/download.c -index 9ea957d..6d81d81 100644 ---- a/src/download.c -+++ b/src/download.c -@@ -98,7 +98,7 @@ static int swupd_curl_hashmap_insert(struct file *file) - string_or_die(&targetfile, "%s/staged/%s", state_dir, file->hash); - - if (lstat(targetfile, &stat) == 0) { -- if (verify_file(file, targetfile)) { -+ if (verify_file(file, targetfile, true)) { - free(targetfile); - pthread_mutex_unlock(&bucket->mutex); - return 1; -@@ -260,7 +260,7 @@ int untar_full_download(void *data) - * NOTE: this should NEVER happen given the checking that happens - * ahead of queueing a download. But... */ - if (lstat(targetfile, &stat) == 0) { -- if (verify_file(file, targetfile)) { -+ if (verify_file(file, targetfile, true)) { - unlink(tar_dotfile); - unlink(tarfile); - free(tar_dotfile); -@@ -316,7 +316,7 @@ int untar_full_download(void *data) - } - - err = lstat(targetfile, &stat); -- if (!err && !verify_file(file, targetfile)) { -+ if (!err && !verify_file(file, targetfile, true)) { - /* Download was successful but the hash was bad. This is fatal*/ - printf("Error: File content hash mismatch for %s (bad server data?)\n", targetfile); - exit(EXIT_FAILURE); diff --git a/src/hash.c b/src/hash.c -index 34da6eb..00a6802 100644 +index 1e61454..9553644 100644 --- a/src/hash.c +++ b/src/hash.c -@@ -226,7 +226,7 @@ int compute_hash(struct file *file, char *filename) - return 0; - } - --bool verify_file(struct file *file, char *filename) -+bool verify_file(struct file *file, char *filename, bool use_xattrs) - { - struct file *local = calloc(1, sizeof(struct file)); - -@@ -235,7 +235,7 @@ bool verify_file(struct file *file, char *filename) +@@ -236,7 +236,14 @@ bool verify_file(struct file *file, char *filename) } local->filename = file->filename; - local->use_xattrs = true; -+ local->use_xattrs = use_xattrs; ++ /* ++ * xattrs are currently not supported for manifest files. ++ * They are data files produced by the swupd-server and ++ * therefore do not have any of the xattrs normally ++ * set for the actual system files (like security.ima ++ * when using IMA or security.SMACK64 when using Smack). ++ */ ++ local->use_xattrs = !file->is_manifest; populate_file_struct(local, filename); if (compute_hash(local, filename) != 0) { -@@ -275,7 +275,7 @@ int verify_bundle_hash(struct manifest *manifest, struct file *bundle) - string_or_die(&local, "%s/%i/Manifest.%s", state_dir, - current->last_change, current->filename); - -- if (!verify_file(bundle, local)) { -+ if (!verify_file(bundle, local, false)) { - printf("Warning: hash check failed for Manifest.%s\n", - current->filename); - ret = 0; -diff --git a/src/helpers.c b/src/helpers.c -index e71688c..01fd4a3 100644 ---- a/src/helpers.c -+++ b/src/helpers.c -@@ -787,7 +787,7 @@ int verify_fix_path(char *targetpath, struct manifest *target_MoM) - - ret = stat(target, &sb); - if (ret == 0) { -- if (verify_file(file, target)) { -+ if (verify_file(file, target, true)) { - continue; - } - printf("Hash did not match for path : %s\n", path); -diff --git a/src/manifest.c b/src/manifest.c -index 2b57d3d..ee6d29a 100644 ---- a/src/manifest.c -+++ b/src/manifest.c -@@ -674,7 +674,7 @@ struct list *create_update_list(struct manifest *current, struct manifest *serve - if (fullname == NULL) { - abort(); - } -- if (verify_file(file, fullname)) { -+ if (verify_file(file, fullname, true)) { - free(fullname); - continue; - } -diff --git a/src/scripts.c b/src/scripts.c -index 59417af..c2157f7 100644 ---- a/src/scripts.c -+++ b/src/scripts.c -@@ -127,7 +127,7 @@ void run_preupdate_scripts(struct manifest *manifest) - } - - /* Check that system file matches file in manifest */ -- if (verify_file(file, script)) { -+ if (verify_file(file, script, true)) { - system(script); - break; - } -diff --git a/src/verify.c b/src/verify.c -index 1514988..eaf9dd8 100644 ---- a/src/verify.c -+++ b/src/verify.c -@@ -462,7 +462,7 @@ static void deal_with_hash_mismatches(struct manifest *official_manifest, bool r - if (fullname == NULL) { - abort(); - } -- if (verify_file(file, fullname)) { -+ if (verify_file(file, fullname, true)) { - free(fullname); - continue; - } else { -@@ -483,7 +483,7 @@ static void deal_with_hash_mismatches(struct manifest *official_manifest, bool r - } - - /* at the end of all this, verify the hash again to judge success */ -- if (verify_file(file, fullname)) { -+ if (verify_file(file, fullname, true)) { - file_fixed_count++; - printf("\tfixed\n"); - } else { -- 2.1.4 |