From nobody Thu Jul 8 09:17:07 2021 X-Original-To: freebsd-ports@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 419818D6251; Thu, 8 Jul 2021 09:17:09 +0000 (UTC) (envelope-from se@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4GL9fY17rmz4Qll; Thu, 8 Jul 2021 09:17:09 +0000 (UTC) (envelope-from se@freebsd.org) Received: from Stefans-MBP-449.fritz.box (p200300cd5f1f2f007ca904cdc22dde0c.dip0.t-ipconnect.de [IPv6:2003:cd:5f1f:2f00:7ca9:4cd:c22d:de0c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) (Authenticated sender: se/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id 527E42D5CD; Thu, 8 Jul 2021 09:17:08 +0000 (UTC) (envelope-from se@freebsd.org) From: Stefan Esser To: Michael Grimm , Warner Losh Cc: FreeBSD-STABLE Mailing List , FreeBSD ports , lukasz@wasikowski.net References: <416D3033-138D-4BBB-84FA-FAEA2944C837@ellael.org> <08637D0D-9D65-4F53-9A64-F4742BA8E415@ellael.org> <0B2C7AEA-27C6-4259-9DCF-D20C19737A50@ellael.org> Subject: security/rkhunter without hashes after recent STABLE-13 update Message-ID: <4355013a-0be1-829f-2fe5-86eeb4ba80f7@freebsd.org> Date: Thu, 8 Jul 2021 11:17:07 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 List-Id: Porting software to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-ports List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-ports@freebsd.org X-BeenThere: freebsd-ports@freebsd.org MIME-Version: 1.0 In-Reply-To: <0B2C7AEA-27C6-4259-9DCF-D20C19737A50@ellael.org> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="GxeD6L2ZH33KPpGC8vsNLNvpZgPiZw8R2" X-ThisMailContainsUnwantedMimeParts: N This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --GxeD6L2ZH33KPpGC8vsNLNvpZgPiZw8R2 Content-Type: multipart/mixed; boundary="PhEMBSXfMc8zoSFWPwaQWT8IQX0EdkuQ7"; protected-headers="v1" From: Stefan Esser To: Michael Grimm , Warner Losh Cc: FreeBSD-STABLE Mailing List , FreeBSD ports , lukasz@wasikowski.net Message-ID: <4355013a-0be1-829f-2fe5-86eeb4ba80f7@freebsd.org> Subject: security/rkhunter without hashes after recent STABLE-13 update References: <416D3033-138D-4BBB-84FA-FAEA2944C837@ellael.org> <08637D0D-9D65-4F53-9A64-F4742BA8E415@ellael.org> <0B2C7AEA-27C6-4259-9DCF-D20C19737A50@ellael.org> In-Reply-To: <0B2C7AEA-27C6-4259-9DCF-D20C19737A50@ellael.org> --PhEMBSXfMc8zoSFWPwaQWT8IQX0EdkuQ7 Content-Type: multipart/mixed; boundary="------------F0E6835EAC1DDC280EA83B43" Content-Language: en-US This is a multi-part message in MIME format. --------------F0E6835EAC1DDC280EA83B43 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Am 07.07.21 um 22:24 schrieb Michael Grimm: > Warner Losh wrote: >> >> On Wed, Jul 7, 2021 at 12:47 PM Michael Grimm wr= ote: >>> Warner Losh wrote: >=20 >>>> Sorry for any hassle this work is causing. >>> >>> No big deal for rkhunter, a workaround exists ;-) >> >> I think the reason is that it automatically switched to using sha256su= m >> because it was present, but it didn't automatically change #HASH_FLD_I= DX=3D4 >> to be 1. The shell script is tricky enough that I've not looked throug= h it >> all. I'd argue this is a bug in the get_sha_hash_function which doesn'= t >> adjust the HASH_FLD_IDX based on which version it finds. Instead, it s= ets >> it unconditionally to 4 on *BSD or DragonFly. [...] >=20 > But anyway, you nailed it! That fixes rkhunter. It will now produce has= hes for both /sbin/sha256 and /sbin/sha256sum. >=20 > The attached patch (diff to new rkhunter script with both succeeding hu= nks) will work for the rkhunter-1.4.6 script. >=20 > Thanks and with kind regards, > Michael Hi Warner and Michael, the reason I added full support for the -c option was that a port build f= ailed since it assumed that if the name of the hash program ended in "sum" it w= as fully compatible with the Coreutils program of that name and that is supp= orted the "-c digestfile" option. This is a general problem when we gain compatibility with some other OS (= TM): Ports often assume that availability of a program (MACRO, include file, .= =2E.) means it is the real thing, and not only attempt of an emulation of the m= ost important feature (i.e. only considering a very specific use case). An alternative (and my preferred fix) would be to not search for the *sum= functions on FreeBSD, and thus not having to adjust the HASH_FLD_IDX vari= able: -- files/rkhunter.orig 2018-02-24 23:08:27 UTC +++ files/rkhunter @@ -4750,7 +4750,12 @@ get_sha_hash_function() { return fi - HFUNC=3D`find_cmd sha${SHA_SIZE}sum` + case ${OPERATING_SYSTEM} in + FreeBSD) + HFUNC=3D`find_cmd sha${SHA_SIZE}` ;; + *) + HFUNC=3D`find_cmd sha${SHA_SIZE}sum` ;; + esac if [ -z "${HFUNC}" ]; then HFUNC=3D`find_cmd sha${SHA_SIZE}` The suggested patch is attached. I did not want to change more lines than= required, and other BSDs could easily added to the special case, should they be affected, too. And I'd assume that this patch could be accepted by the upstream ... Michael, could you please test this patch? (I do not have rkhunter installed on my system ...) Regards, STefan --------------F0E6835EAC1DDC280EA83B43 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="rkhunter-port.diff" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="rkhunter-port.diff" ZGlmZiAtLWdpdCBhL3NlY3VyaXR5L3JraHVudGVyL2ZpbGVzL3BhdGNoLWZpbGVzX3JraHVu dGVyIGIvc2VjdXJpdHkvcmtodW50ZXIvZmlsZXMvcGF0Y2gtZmlsZXNfcmtodW50ZXIKaW5k ZXggYmQ3MGMzYTI3NmY0Li42MTZjNTg5YWUxMTIgMTAwNjQ0Ci0tLSBhL3NlY3VyaXR5L3Jr aHVudGVyL2ZpbGVzL3BhdGNoLWZpbGVzX3JraHVudGVyCisrKyBiL3NlY3VyaXR5L3JraHVu dGVyL2ZpbGVzL3BhdGNoLWZpbGVzX3JraHVudGVyCkBAIC0xLDYgKzEsMjAgQEAKLS0tLSBm aWxlcy9ya2h1bnRlci5vcmlnCTIwMTQtMDMtMTIgMjA6NTQ6NTUgVVRDCistLS0gZmlsZXMv cmtodW50ZXIub3JpZwkyMDE4LTAyLTI0IDIzOjA4OjI3IFVUQwogKysrIGZpbGVzL3JraHVu dGVyCi1AQCAtNzI3NSw2ICs3Mjc1LDkgQEAgZG93bmxvYWRfZmlsZSgpIHsKK0BAIC00NzUw LDcgKzQ3NTAsMTIgQEAgZ2V0X3NoYV9oYXNoX2Z1bmN0aW9uKCkgeworIAkJcmV0dXJuCisg CWZpCisgCistCUhGVU5DPWBmaW5kX2NtZCBzaGEke1NIQV9TSVpFfXN1bWAKKysJY2FzZSAk e09QRVJBVElOR19TWVNURU19IGluCisrCUZyZWVCU0QpCisrCQlIRlVOQz1gZmluZF9jbWQg c2hhJHtTSEFfU0laRX1gIDs7CisrCSopCisrCQlIRlVOQz1gZmluZF9jbWQgc2hhJHtTSEFf U0laRX1zdW1gIDs7CisrCWVzYWMKKyAKKyAJaWYgWyAteiAiJHtIRlVOQ30iIF07IHRoZW4K KyAJCUhGVU5DPWBmaW5kX2NtZCBzaGEke1NIQV9TSVpFfWAKK0BAIC03NTIyLDYgKzc1Mjcs OSBAQCBkb3dubG9hZF9maWxlKCkgewogIAkJcm0gLWYgIiR7T1VUUFVUX0ZJTEV9IiA+L2Rl di9udWxsIDI+JjEKICAKICAJCWNhc2UgIiR7UktIV0VCQ01EX0JBU0V9IiBpbgo= --------------F0E6835EAC1DDC280EA83B43-- --PhEMBSXfMc8zoSFWPwaQWT8IQX0EdkuQ7-- --GxeD6L2ZH33KPpGC8vsNLNvpZgPiZw8R2 Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEEo3HqZZwL7MgrcVMTR+u171r99UQFAmDmwpMFAwAAAAAACgkQR+u171r99URI HAgAlv+3InNypIQjAxvqXgljkWRUZRx/lA5NH+cxeV9pSpY1vUNzrw7HoTUo63MJAZnscYVBgnCR U8ErDCbS27iyQAakgdNMOpFSu7GcMJfxWg9ykfpKtt9toPJksx0wrUTjV8rBZwl7fNBGfnzmNa41 EcsHQWS/uTw7BFBcEX73YH3cT8gr+KOeXYeS2RWNoQ6vXt/UOAlt50sBLgAjnxkFJWqrRK+nStfh 46KnNZ9/NCfy7SivXnd0mE5ztl+IyOCm2Dj+BOgEmqvJCV7+v2FnXlHFlWPQV3Civ65yEEkohEWD g1JkfU3CHk3/jih/y6wDyu11Yk6MGyQaP0hV6U6ESQ== =Ol13 -----END PGP SIGNATURE----- --GxeD6L2ZH33KPpGC8vsNLNvpZgPiZw8R2--