From owner-freebsd-arch@FreeBSD.ORG Sat Oct 5 21:06:27 2013 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 0E21771 for ; Sat, 5 Oct 2013 21:06:27 +0000 (UTC) (envelope-from peter@wemm.org) Received: from mail-pb0-x229.google.com (mail-pb0-x229.google.com [IPv6:2607:f8b0:400e:c01::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id D25DA2630 for ; Sat, 5 Oct 2013 21:06:26 +0000 (UTC) Received: by mail-pb0-f41.google.com with SMTP id rp2so5482638pbb.0 for ; Sat, 05 Oct 2013 14:06:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wemm.org; s=google; h=message-id:date:from:organization:user-agent:mime-version:to :subject:references:in-reply-to:content-type; bh=UinRF+W75mwcTzjwcbAsgk51BATmEHuKvA1wghhN4/0=; b=aS1fjapS+CzhUNjOeV1UXBwrxK9oJJrrfCN5cWtZWPcdPRrG+pVasQ9lxrVisljY2l k8SdU7ap+TEAKoquscHd/EiMnYwb/D3alPXv6XHr+PMd/LNHRkYZ2oo808fbf9XAZarB bBsVNSy3n4tiZDBqpJLhkzhmVhS9CuI1H6Tp8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:organization:user-agent :mime-version:to:subject:references:in-reply-to:content-type; bh=UinRF+W75mwcTzjwcbAsgk51BATmEHuKvA1wghhN4/0=; b=LprQosQorixityfiJY98SBx8AtDrB4k0G00oyFb0nuuX+P5QkG3A2aq+GtbTTfNp+/ H3Fc6kgalWvlbBG4W7UV87RDRT0f23Y67Bk5liGfGQ0llhiQb/qPuKLtK2yd10Es9w8b Hy69vQugWLFjB+q4fAx6k0Ob+PZzsIVCI0CWNgyByrU0KTqUQ3HrDSdnf9r1fvT1jzK4 hpioxKre5H/4VhjC5Am1/PCkehcQpFocQCvs95KEOaBgmHnWEpT/xEbj+ZZY6FW/NV4s uiBVUl70lycKntMFUEmniakNcNB2cV6TYUbBcwlM7E3Q6Wcb0w7TrQm6lH0BzQKdQ+Ko Sndw== X-Gm-Message-State: ALoCoQmntjj+r1/XDJiGA8JEaWXNq46bbLpL4tuCVKs/2rXgrmfuzbVhKzgGx2S2nO+kAZ3oixER X-Received: by 10.66.234.193 with SMTP id ug1mr23278551pac.92.1381007186245; Sat, 05 Oct 2013 14:06:26 -0700 (PDT) Received: from hackintosh.wemm.org (c-71-198-8-135.hsd1.ca.comcast.net. [71.198.8.135]) by mx.google.com with ESMTPSA id yo2sm27683007pab.8.1969.12.31.16.00.00 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 05 Oct 2013 14:06:25 -0700 (PDT) Message-ID: <52507F4A.1050707@wemm.org> Date: Sat, 05 Oct 2013 14:06:18 -0700 From: Peter Wemm Organization: World Domination in progress. User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: freebsd-arch@freebsd.org Subject: Re: Userland patch level References: <8661tbsi40.fsf@nine.des.no> In-Reply-To: <8661tbsi40.fsf@nine.des.no> X-Enigmail-Version: 1.5.2 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92" X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Oct 2013 21:06:27 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 10/5/13 11:11 AM, Dag-Erling Sm=F8rgrav wrote: > The attached patch adds a shell script, /libexec/freebsd-version, which= > has the current version patch level hardcoded and prints them when run.= > It can also be used to extract the version and patch level from the > installed kernel, even before rebooting after an upgrade. The goal is > to be able to correctly determine the userland version in situations > where it does not match what the running kernel reports, which is > commonly the case when using freebsd-update or when running inside a > jail. In the long run, this will make it possible for `pkg audit` and > similar tools to correctly report a vulnerable userland. IMHO, promoting the parsing strings like this is fraught with danger. Th= e canonical one-true-version is __FreeBSD_version, I'd much rather encourag= e people to refer to that, and it is available in newvers.sh in the same wa= y that you're building it now. We've been dealing with this problem at yahoo for several years now. Providing a convenient way to parse the __FreeBSD_version and kern.osreld= ate tags would be nice. Up until now, the most reliable way to determine the kernel and userland versions has been to parse kern.osreldate to find the running kernel, and= to parse /usr/include/osreldate.h to determine the userland version. buildworld itself even uses /usr/include/osreldate.h to reliably determin= e the userland version. I realize it's not quite as convenient to pull an osreldate out of a rand= om kernel file (vs the running one), but at least the running one is availab= le when the kernel itself isn't. What happens if you're in a chroot/jail where the kernel file itself isn't even present in the file system - eg: = was pxe booted? freebsd-version.sh.in seems fragile as presented. It's missing loader.conf.local parsing, hardcodes the assumption that you use /boot (v= s /efi), etc. The usage string has a -i option that doesn't seem to exist.= Secteam does bump the osreldate for patch releases, right? Woudn't that = be sufficient for userland audit tools to reliably identify vulnerable userl= ands? --=20 Peter Wemm - peter@wemm.org; peter@FreeBSD.org; peter@yahoo-inc.com; KI6F= JV --6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (Darwin) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlJQf08ACgkQFRKuUnJ3cX99gACeK5OXs37JYvgZ3dsTPL2Q36u4 8zIAn0sEHR5oUGy1nik8Ty2TB92H4c+T =MLX1 -----END PGP SIGNATURE----- --6wF1E0jcQLWIM2mEI1s1qhekd1UIuAt92--