From owner-freebsd-arch@FreeBSD.ORG Sat Oct 5 18:11:25 2013 Return-Path: Delivered-To: arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id AD786EAB for ; Sat, 5 Oct 2013 18:11:25 +0000 (UTC) (envelope-from des@des.no) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 096172EA2 for ; Sat, 5 Oct 2013 18:11:24 +0000 (UTC) Received: from nine.des.no (smtp.des.no [194.63.250.102]) by smtp-int.des.no (Postfix) with ESMTP id F37A967A2 for ; Sat, 5 Oct 2013 18:11:23 +0000 (UTC) Received: by nine.des.no (Postfix, from userid 1001) id 4BF295129D; Sat, 5 Oct 2013 20:11:27 +0200 (CEST) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: arch@freebsd.org Subject: Userland patch level Date: Sat, 05 Oct 2013 20:11:27 +0200 Message-ID: <8661tbsi40.fsf@nine.des.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (berkeley-unix) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Oct 2013 18:11:25 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable The attached patch adds a shell script, /libexec/freebsd-version, which has the current version patch level hardcoded and prints them when run. It can also be used to extract the version and patch level from the installed kernel, even before rebooting after an upgrade. The goal is to be able to correctly determine the userland version in situations where it does not match what the running kernel reports, which is commonly the case when using freebsd-update or when running inside a jail. In the long run, this will make it possible for `pkg audit` and similar tools to correctly report a vulnerable userland. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no --=-=-= Content-Type: text/x-patch; charset=utf-8 Content-Disposition: attachment; filename=freebsd-version.diff Content-Transfer-Encoding: quoted-printable Index: libexec/Makefile =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- libexec/Makefile (revision 256063) +++ libexec/Makefile (working copy) @@ -8,6 +8,7 @@ bootpd \ ${_comsat} \ fingerd \ + freebsd-version \ ftpd \ getty \ ${_mail.local} \ Index: libexec/freebsd-version/Makefile =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- libexec/freebsd-version/Makefile (revision 0) +++ libexec/freebsd-version/Makefile (working copy) @@ -0,0 +1,20 @@ +# $FreeBSD$ + +SCRIPTS =3D freebsd-version +MAN =3D freebsd-version.1 +CLEANFILES =3D freebsd-version.sh +NEWVERS =3D ${.CURDIR}/../../sys/conf/newvers.sh + +freebsd-version.sh.in: ${NEWVERS} +freebsd-version.sh: freebsd-version.sh.in + eval $$(egrep '^(TYPE|REVISION|BRANCH)=3D' ${NEWVERS}) ; \ + if ! sed -e "\ + s/@@TYPE@@/$${TYPE}/g; \ + s/@@REVISION@@/$${REVISION}/g; \ + s/@@BRANCH@@/$${BRANCH}/g; \ + " ${.ALLSRC} >${.TARGET} ; then \ + rm -f ${.TARGET} ; \ + exit 1 ; \ + fi + +.include Property changes on: libexec/freebsd-version/Makefile ___________________________________________________________________ Added: svn:keywords ## -0,0 +1 ## +Id \ No newline at end of property Index: libexec/freebsd-version/freebsd-version.1 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- libexec/freebsd-version/freebsd-version.1 (revision 0) +++ libexec/freebsd-version/freebsd-version.1 (working copy) @@ -0,0 +1,124 @@ +.\"- +.\" Copyright (c) 2013 Dag-Erling Sm=C3=B8rgrav +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PUR= POSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUEN= TIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, ST= RICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY = WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $FreeBSD$ +.\" +.Dd October 5, 2013 +.Dt FREEBSD-VERSION 1 +.Os +.Sh NAME +.Nm freebsd-version +.Nd print the version and patch level of the installed system +.Sh SYNOPSIS +.Nm +.Op Fl ku +.Sh DESCRIPTION +The +.Nm +utility makes a best effort to determine the version and patch level +of the installed kernel and / or userland. +.Pp +The following options are available: +.Bl -tag -width Fl +.It Fl k +Print the version and patch level of the installed kernel. +Unlike +.Xr uname 1 , +if a new kernel has been installed but the system has not yet +rebooted, +.Nm +will print the version and patch level of the new kernel. +.It Fl u +Print the version and patch level of the installed userland. +These are hardcoded into +.Nm +during the build. +.El +.Pp +If both +.Fl k +and +.Fl u +are specified, +.Nm +will print the kernel version first, then the userland version, on +separate lines. +If neither is specified, it will print the userland version only. +.Sh IMPLEMENTATION NOTES +The +.Nm +utility should provide the correct answer in the vast majority of +cases, including on systems kept up-to-date using +.Xr freebsd-update 8 , +which does not update the kernel version unless the kernel itself was +affected by the latest patch. +.Pp +To determine the name (and hence the location) of a custom kernel, the +.Nm +utility will attempt to parse +.Pa /boot/defaults/loader.conf +and +.Pa /boot/loader.conf , +looking for definitions of the +.Va kernel +and +.Va bootfile +variables, both with a default value of +.Dq kernel . +It may however fail to locate the correct kernel if either or both of +these variables are defined in a non-standard location, such as in +.Pa /boot/loader.rc . +.Sh ENVIRONMENT +.Bl -tag -width ROOT +.It Ev ROOT +Path to the root of the filesystem in which to look for +.Pa loader.conf +and the kernel. +.El +.Sh EXAMPLES +To determine the version of the currently running userland: +.Bd -literal -offset indent +/libexec/freebsd-version -u +.Ed +.Pp +To inspect a system being repaired using a live CD: +.Bd -literal -offset indent +mount -rt ufs /dev/ada0p2 /mnt +env ROOT=3D/mnt /mnt/libexec/freebsd-version -ku +.Ed +.Sh SEE ALSO +.Xr uname 1 , +.Xr loader.conf 5 , +.Xr freebsd-version 8 +.Sh HISTORY +The +.Nm +command appeared in +.Fx 10.0 . +.Sh AUTHORS +The +.Nm +utility and this manual page were written by +.An Dag-Erling Sm\(/orgrav Aq des@FreeBSD.org . Property changes on: libexec/freebsd-version/freebsd-version.1 ___________________________________________________________________ Added: svn:keywords ## -0,0 +1 ## +FreeBSD=3D%H \ No newline at end of property Index: libexec/freebsd-version/freebsd-version.sh.in =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- libexec/freebsd-version/freebsd-version.sh.in (revision 0) +++ libexec/freebsd-version/freebsd-version.sh.in (working copy) @@ -0,0 +1,126 @@ +#!/bin/sh +#- +# Copyright (c) 2013 Dag-Erling Sm=C3=B8rgrav +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPO= SE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTI= AL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRI= CT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ +# + +set -e + +USERLAND_VERSION=3D"@@REVISION@@-@@BRANCH@@" + +LOADER_DEFAULTS=3D"/boot/defaults/loader.conf" +LOADER_CONF=3D"/boot/loader.conf" +LOADER_RE1=3D'^\([A-Z_a-z][0-9A-Z_a-z]*=3D[-./0-9A-Z_a-z]\{1,\}\).*$' +LOADER_RE2=3D'^\([A-Z_a-z][0-9A-Z_a-z]*=3D"[-./0-9A-Z_a-z]\{1,\}"\).*$' +KERNEL_RE=3D'^@(#)@@TYPE@@ \([-.0-9A-Za-z]\{1,\}\) .*$' + +progname=3D$(basename $0) + +# +# Print an error message and exit. +# +error() { + echo "$progname: $*" >&2 + exit 1 +} + +# +# Try to get the name of the installed kernel from loader.conf and +# return the full path. If loader.conf does not exist or we could not +# read it, return the path to the default kernel. +# +kernel_file() { + eval $(sed -n "s/$LOADER_RE1/\\1;/p; s/$LOADER_RE2/\\1;/p" \ + $ROOT$LOADER_DEFAULTS $ROOT$LOADER_CONF \ + 2>/dev/null) + echo "$ROOT/boot/${kernel:-kernel}/${bootfile:-kernel}" +} + +# +# Extract the kernel version from the installed kernel. +# +kernel_version() { + kernfile=3D$(kernel_file) + if [ ! -f "$kernfile" -o ! -r "$kernfile" ] ; then + error "unable to locate kernel" + fi + strings "$kernfile" | sed -n "s/$KERNEL_RE/\\1/p" +} + +# +# Print the hardcoded userland version. +# +userland_version() { + echo $USERLAND_VERSION +} + +# +# Print a usage string and exit. +# +usage() { + echo "usage: $progname [-iku]\n" >&2 + exit 1 +} + +# +# Main program. +# +main() { + # parse command-line arguments + while getopts "ku" option ; do + case $option in + k) + opt_k=3D1 + ;; + u) + opt_u=3D1 + ;; + *) + usage + ;; + esac + done + if [ $OPTIND -le $# ] ; then + usage + fi + + # default is -u + if [ $((opt_k + opt_u)) -eq 0 ] ; then + opt_u=3D1 + fi + + # print kernel version + if [ $opt_k ] ; then + kernel_version + fi + + # print userland version + if [ $opt_u ] ; then + userland_version + fi +} + +main "$@" Property changes on: libexec/freebsd-version/freebsd-version.sh.in ___________________________________________________________________ Added: svn:keywords ## -0,0 +1 ## +FreeBSD=3D%H \ No newline at end of property --=-=-=-- From owner-freebsd-arch@FreeBSD.ORG Sat Oct 5 19:55:13 2013 Return-Path: Delivered-To: arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 63441EAA for ; Sat, 5 Oct 2013 19:55:13 +0000 (UTC) (envelope-from des@des.no) Received: from smtp.des.no (smtp.des.no [194.63.250.102]) by mx1.freebsd.org (Postfix) with ESMTP id 25F5B230D for ; Sat, 5 Oct 2013 19:55:12 +0000 (UTC) Received: from nine.des.no (smtp.des.no [194.63.250.102]) by smtp-int.des.no (Postfix) with ESMTP id F02FF69F7; Sat, 5 Oct 2013 19:55:11 +0000 (UTC) Received: by nine.des.no (Postfix, from userid 1001) id 51E1F51390; Sat, 5 Oct 2013 21:55:15 +0200 (CEST) From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= To: Alfred Perlstein Subject: Re: Userland patch level References: <8661tbsi40.fsf@nine.des.no> <52506076.2090803@mu.org> Date: Sat, 05 Oct 2013 21:55:15 +0200 In-Reply-To: <52506076.2090803@mu.org> (Alfred Perlstein's message of "Sat, 05 Oct 2013 11:54:46 -0700") Message-ID: <86siwfqyqk.fsf@nine.des.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Cc: arch@freebsd.org X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Oct 2013 19:55:13 -0000 Alfred Perlstein writes: > 1) Can we add it as a uname option as well? It was intentionally done as a shell script so it can be run from e.g. a live CD without having to worry about binary compatibility. > 2) FreeNAS uses /etc/version as just a file, any point in doing that > instead? No, /etc belongs to the user, and we can't trust that's it up to date; freebsd-update would update it, but make installworld probably wouldn't, and expecting the user to run mergemaster or etcupdate adds one more point of failure. > 3) This article has an example of a script that works on many flavors > of linux, any way to make it so that it works on FreeBSD as well? > http://unix.stackexchange.com/questions/6345/how-can-i-get-distribution-n= ame-and-version-number-in-a-simple-shell-script Same reason as above. Plus, I'm pretty sure this does not work; /etc/lsb-release on a RHEL 6 desktop looks like this: LSB_VERSION=3Dbase-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch= :graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noa= rch which is nothing like what that script expects. BTW, this grew out of a discussion in the security workgroup at the DevSummit (cf. https://wiki.freebsd.org/201309DevSummit/Security) during which we touched upon roughly the same points as you raised. This was initially meant to be little more than "echo X.Y-RELEASE-pZ" and to be used only by portaudit / pkg audit / what have you, which is why it's hidden away in /libexec, but considering how much it's grown from inception to implementation, it might make more sense to put it in a more accessible location. DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no From owner-freebsd-arch@FreeBSD.ORG Sat Oct 5 20:03:42 2013 Return-Path: Delivered-To: arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 0044B117 for ; Sat, 5 Oct 2013 20:03:41 +0000 (UTC) (envelope-from bright@mu.org) Received: from elvis.mu.org (elvis.mu.org [192.203.228.196]) by mx1.freebsd.org (Postfix) with ESMTP id E01D02367 for ; Sat, 5 Oct 2013 20:03:41 +0000 (UTC) Received: from Alfreds-MacBook-Pro-9.local (c-76-21-10-192.hsd1.ca.comcast.net [76.21.10.192]) by elvis.mu.org (Postfix) with ESMTPSA id 3D43D1A3DAD; Sat, 5 Oct 2013 13:03:35 -0700 (PDT) Message-ID: <52507093.7080004@mu.org> Date: Sat, 05 Oct 2013 13:03:31 -0700 From: Alfred Perlstein User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: =?UTF-8?B?RGFnLUVybGluZyBTbcO4cmdyYXY=?= Subject: Re: Userland patch level References: <8661tbsi40.fsf@nine.des.no> <52506076.2090803@mu.org> <86siwfqyqk.fsf@nine.des.no> In-Reply-To: <86siwfqyqk.fsf@nine.des.no> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Cc: arch@freebsd.org X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Oct 2013 20:03:42 -0000 On 10/5/13 12:55 PM, Dag-Erling Smørgrav wrote: > Alfred Perlstein writes: >> 1) Can we add it as a uname option as well? > It was intentionally done as a shell script so it can be run from e.g. a > live CD without having to worry about binary compatibility. > >> 2) FreeNAS uses /etc/version as just a file, any point in doing that >> instead? > No, /etc belongs to the user, and we can't trust that's it up to date; > freebsd-update would update it, but make installworld probably wouldn't, > and expecting the user to run mergemaster or etcupdate adds one more > point of failure. > >> 3) This article has an example of a script that works on many flavors >> of linux, any way to make it so that it works on FreeBSD as well? >> http://unix.stackexchange.com/questions/6345/how-can-i-get-distribution-name-and-version-number-in-a-simple-shell-script > Same reason as above. Plus, I'm pretty sure this does not work; > /etc/lsb-release on a RHEL 6 desktop looks like this: > > LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch > > which is nothing like what that script expects. > > BTW, this grew out of a discussion in the security workgroup at the > DevSummit (cf. https://wiki.freebsd.org/201309DevSummit/Security) during > which we touched upon roughly the same points as you raised. > > This was initially meant to be little more than "echo X.Y-RELEASE-pZ" > and to be used only by portaudit / pkg audit / what have you, which is > why it's hidden away in /libexec, but considering how much it's grown > from inception to implementation, it might make more sense to put it in > a more accessible location. > > DES Interesting points to which I can't really poke any holes in. Having the ability to determine userland is a good bonus. +1 to this idea and implementation. -Alfred -- Alfred Perlstein From owner-freebsd-arch@FreeBSD.ORG Sat Oct 5 21:06:27 2013 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 0E21771 for ; Sat, 5 Oct 2013 21:06:27 +0000 (UTC) (envelope-from peter@wemm.org) Received: from mail-pb0-x229.google.com (mail-pb0-x229.google.com [IPv6:2607:f8b0:400e:c01::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id D25DA2630 for ; Sat, 5 Oct 2013 21:06:26 +0000 (UTC) Received: by mail-pb0-f41.google.com with SMTP id rp2so5482638pbb.0 for ; Sat, 05 Oct 2013 14:06:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wemm.org; s=google; h=message-id:date:from:organization:user-agent:mime-version:to :subject:references:in-reply-to:content-type; bh=UinRF+W75mwcTzjwcbAsgk51BATmEHuKvA1wghhN4/0=; b=aS1fjapS+CzhUNjOeV1UXBwrxK9oJJrrfCN5cWtZWPcdPRrG+pVasQ9lxrVisljY2l k8SdU7ap+TEAKoquscHd/EiMnYwb/D3alPXv6XHr+PMd/LNHRkYZ2oo808fbf9XAZarB bBsVNSy3n4tiZDBqpJLhkzhmVhS9CuI1H6Tp8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:organization:user-agent :mime-version:to:subject:references:in-reply-to:content-type; bh=UinRF+W75mwcTzjwcbAsgk51BATmEHuKvA1wghhN4/0=; b=LprQosQorixityfiJY98SBx8AtDrB4k0G00oyFb0nuuX+P5QkG3A2aq+GtbTTfNp+/ H3Fc6kgalWvlbBG4W7UV87RDRT0f23Y67Bk5liGfGQ0llhiQb/qPuKLtK2yd10Es9w8b Hy69vQugWLFjB+q4fAx6k0Ob+PZzsIVCI0CWNgyByrU0KTqUQ3HrDSdnf9r1fvT1jzK4 hpioxKre5H/4VhjC5Am1/PCkehcQpFocQCvs95KEOaBgmHnWEpT/xEbj+ZZY6FW/NV4s uiBVUl70lycKntMFUEmniakNcNB2cV6TYUbBcwlM7E3Q6Wcb0w7TrQm6lH0BzQKdQ+Ko Sndw== X-Gm-Message-State: ALoCoQmntjj+r1/XDJiGA8JEaWXNq46bbLpL4tuCVKs/2rXgrmfuzbVhKzgGx2S2nO+kAZ3oixER X-Received: by 10.66.234.193 with SMTP id ug1mr23278551pac.92.1381007186245; Sat, 05 Oct 2013 14:06:26 -0700 (PDT) Received: from hackintosh.wemm.org (c-71-198-8-135.hsd1.ca.comcast.net. [71.198.8.135]) by mx.google.com with ESMTPSA id yo2sm27683007pab.8.1969.12.31.16.00.00 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 05 Oct 2013 14:06:25 -0700 (PDT) Message-ID: <52507F4A.1050707@wemm.org> Date: Sat, 05 Oct 2013 14:06:18 -0700 From: Peter Wemm Organization: World Domination in progress. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: freebsd-arch@freebsd.org Subject: Re: Userland patch level References: <8661tbsi40.fsf@nine.des.no> In-Reply-To: <8661tbsi40.fsf@nine.des.no> X-Enigmail-Version: 1.5.2 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92" X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Oct 2013 21:06:27 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 10/5/13 11:11 AM, Dag-Erling Sm=F8rgrav wrote: > The attached patch adds a shell script, /libexec/freebsd-version, which= > has the current version patch level hardcoded and prints them when run.= > It can also be used to extract the version and patch level from the > installed kernel, even before rebooting after an upgrade. The goal is > to be able to correctly determine the userland version in situations > where it does not match what the running kernel reports, which is > commonly the case when using freebsd-update or when running inside a > jail. In the long run, this will make it possible for `pkg audit` and > similar tools to correctly report a vulnerable userland. IMHO, promoting the parsing strings like this is fraught with danger. Th= e canonical one-true-version is __FreeBSD_version, I'd much rather encourag= e people to refer to that, and it is available in newvers.sh in the same wa= y that you're building it now. We've been dealing with this problem at yahoo for several years now. Providing a convenient way to parse the __FreeBSD_version and kern.osreld= ate tags would be nice. Up until now, the most reliable way to determine the kernel and userland versions has been to parse kern.osreldate to find the running kernel, and= to parse /usr/include/osreldate.h to determine the userland version. buildworld itself even uses /usr/include/osreldate.h to reliably determin= e the userland version. I realize it's not quite as convenient to pull an osreldate out of a rand= om kernel file (vs the running one), but at least the running one is availab= le when the kernel itself isn't. What happens if you're in a chroot/jail where the kernel file itself isn't even present in the file system - eg: = was pxe booted? freebsd-version.sh.in seems fragile as presented. It's missing loader.conf.local parsing, hardcodes the assumption that you use /boot (v= s /efi), etc. The usage string has a -i option that doesn't seem to exist.= Secteam does bump the osreldate for patch releases, right? Woudn't that = be sufficient for userland audit tools to reliably identify vulnerable userl= ands? --=20 Peter Wemm - peter@wemm.org; peter@FreeBSD.org; peter@yahoo-inc.com; KI6F= JV --6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (Darwin) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJQf08ACgkQFRKuUnJ3cX99gACeK5OXs37JYvgZ3dsTPL2Q36u4 8zIAn0sEHR5oUGy1nik8Ty2TB92H4c+T =MLX1 -----END PGP SIGNATURE----- --6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92--