From owner-freebsd-current@freebsd.org Sat May 14 19:46:04 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9C057B3B3DB for ; Sat, 14 May 2016 19:46:04 +0000 (UTC) (envelope-from tim@kientzle.com) Received: from monday.kientzle.com (kientzle.com [142.254.26.11]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 5EC8E1B0D; Sat, 14 May 2016 19:46:03 +0000 (UTC) (envelope-from tim@kientzle.com) Received: (from root@localhost) by monday.kientzle.com (8.14.4/8.14.4) id u4EJk0Yp065241; Sat, 14 May 2016 19:46:01 GMT (envelope-from tim@kientzle.com) Received: from [192.168.2.102] (192.168.1.101 [192.168.1.101]) by kientzle.com with SMTP id t5amans6a97tvi9tu94mhhynna; Sat, 14 May 2016 19:46:00 +0000 (UTC) (envelope-from tim@kientzle.com) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Subject: Re: libarchive update SVN r299529 breaks "ezjail update" From: Tim Kientzle In-Reply-To: Date: Sat, 14 May 2016 12:46:00 -0700 Cc: FreeBSD current Content-Transfer-Encoding: quoted-printable Message-Id: <13C1C575-4AEA-463F-A6BE-92843DAD7B53@kientzle.com> References: <2c059cf5-2c8a-3b89-16c3-eedf02a01ec5@protected-networks.net> <20160512173440.Horde.5l1s9ijXRgAeMNgmT0MmCPa@mail.vx.sk> <20160512175418.Horde.JvYoOSRwfU_l2TIXv697u2B@mail.vx.sk> To: Martin Matuska , Michael Butler X-Mailer: Apple Mail (2.3124) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 May 2016 19:46:04 -0000 A little history about this issue: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2015-2304 > On May 14, 2016, at 12:17 PM, Tim Kientzle wrote: >=20 > Many people consider the traditional behavior to be a security risk, = which is why this was changed. >=20 > FreeBSD is welcome to make --insecure the default on FreeBSD, but I'm = reluctant to do that in the upstream libarchive project. >=20 > Tim >=20 >=20 >> On May 12, 2016, at 8:54 AM, Martin Matuska wrote: >>=20 >> Looks like we have to remove line #174 from cpio/cpio.c: >> cpio->extract_flags |=3D ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS; >>=20 >> This breaks traditional cpio behavior. >>=20 >> Quoting Martin Matuska : >>=20 >>> Hi Michael, I have looked at the source and this is an intended = change in 3.2.0. >>>=20 >>> An absolute path security check was added, cpio refuses to extract = or copy over absolute paths. To do this anyway the "--insecure" flag = must be used. >>>=20 >>> Here is the commit: >>> = https://github.com/libarchive/libarchive/commit/59357157706d47c365b2227739= e17daba3607526 >>>=20 >>> Quoting Michael Butler : >>>=20 >>>> It seems that today's libarchive update breaks cpio's behaviour: >>>>=20 >>>> sudo ezjail-admin update -i -s /usr/src >>>>=20 >>>> [ .. ] >>>>=20 >>>> cd /usr/src/etc/..; install -o root -g wheel -m 444 COPYRIGHT >>>> /usr/local/jails/fulljail/ >>>> install -o root -g wheel -m 444 >>>> /usr/src/etc/../sys/i386/conf/GENERIC.hints >>>> /usr/local/jails/fulljail/boot/device.hints >>>> /usr/local/jails/basejail/bincpio: bin: Path is absolute: Unknown = error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/catcpio: bin/cat: Path is absolute: >>>> Unknown error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/chflagscpio: bin/chflags: Path is >>>> absolute: Unknown error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/chiocpio: bin/chio: Path is absolute: >>>> Unknown error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/chmodcpio: bin/chmod: Path is = absolute: >>>> Unknown error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/cpcpio: bin/cp: Path is absolute: = Unknown >>>> error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/datecpio: bin/date: Path is absolute: >>>> Unknown error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/ddcpio: bin/dd: Path is absolute: = Unknown >>>> error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/dfcpio: bin/df: Path is absolute: = Unknown >>>> error: -1 >>>>=20 >>>> /usr/local/jails/basejail/bin/domainnamecpio: bin/domainname: Path = is >>>> absolute: Unknown error: -1 >>>> [ .. etc. .. ] >>>=20 >>>=20 >>>=20 >>> Martin Matuska >>> FreeBSD committer >>> http://blog.vx.sk >>=20 >>=20 >>=20 >> Martin Matuska >> FreeBSD committer >> http://blog.vx.sk >=20