Ubuntu 20.10 is using a newer version of libselinux that
complains that matchpathcon is obsolete. Rewrite the code
that it uses the recommended selabel_lookup instead.
* m4/jm-macros.m4 (coreutils_MACROS): Do not check for
matchpathcon_init_prefix, as it is no longer used.
* src/copy.c (set_file_security_ctx): Omit process_local arg,
as it is equivalent to !x->set_security_context. All callers changed.
* src/copy.h (struct cp_options): set_security_context is now of
type struct selabel_handle *, not bool. All uses changed.
* src/cp.c, src/install.c, src/mkdir.c, src/mkfifo.c, src/mknod.c:
* src/mv.c: Include selinux/label.h.
(main): Use selabel_open for set_security context.
* src/install.c (matchpathcon_init_prefix): Remove; now unused.
(get_labeling_handle): New static function.
(setdefaultfilecon, main): Use it.
(setdefaultfilecon): Do something regardless of
ENABLE_MATCHPATHCON, which seems to be a revenant macro.
(setdefaultfilecon): Use selabel_lookup instead of the obsolescent
matchpathcon. Report an error unless it fails due to ENOENT.
* src/local.mk (src_ginstall_CPPFLAGS): Remove.
* src/selinux.c: Include selinux/label.h
Do not include die.h, error.h, canonicalize.h.
(defaultcon, restorecon_private, restorecon):
New arg HANDLE. All callers changed.
Use selabel_lookup rather than matchpathcon.
(restorecon_private, restorecon): Don’t lose track of errno.
* src/selinux.c, src/selinux.h:
(restorecon): Don’t call ‘error’; that’s the caller’s job.
Use HAVE_SELINUX_LABEL_H, not HAVE_SELINUX_SELINUX_H,
in case there is some weird system with the former but not the latter.
* src/selinux.h (struct selinux_handle): Add forward decl.
This lets use assume multiple-precision arithmetic on all
platforms, simplifying the code.
* bootstrap.conf (gnulib_modules): Add libgmp.
* configure.ac: Don’t call cu_GMP, as this is now done by Gnulib.
* m4/gmp.m4: Remove.
* src/expr.c, src/factor.c: Use gmp.h unconditionally.
* src/factor.c: Use the simpler ‘#ifndef mpz_inits’ to
determine whether there is an mpz_inits macro.
Run "make update-copyright" and then...
* gnulib: Update to latest with copyright year adjusted.
* tests/init.sh: Sync with gnulib to pick up copyright year.
* bootstrap: Likewise.
* tests/sample-test: Adjust to use the single most recent year.
Fail developer builds if VLAs are used,
as there are portability concerns to consider with them.
* configure.ac: Enable -Wvla which is implicit in the full list added.
* m4/jm-macros.m4: Define GNULIB_NO_VLA which disables use of
VLAs within gnulib code.
Run "make update-copyright" and then...
* gnulib: Update to latest with copyright year adjusted.
* tests/init.sh: Sync with gnulib to pick up copyright year.
* bootstrap: Likewise.
* tests/sample-test: Adjust to use the single most recent year.
Run "make update-copyright" and then...
* gnulib: Update to latest with copyright year adjusted.
* tests/init.sh: Sync with gnulib to pick up copyright year.
* bootstrap: Likewise.
* tests/sample-test: Adjust to use the single most recent year.
* m4/jm-macros.m4: Check for the header.
* src/dd.c: Avoid the workaround where the header
is not available (on non glibc systems).
* src/shred.c: Likewise.
This reverts commit v8.27-97-g8cb06d4 because
the setsid() fallback was not implemented correctly
and disabling the ioctl was not a complete solution
to the security issue of the child being passed
the tty of the parent.
Given runcon is not really a sandbox command,
the advice is to use `runcon ... setsid ...`
to avoid this particular issue.
We only use one of statfs or statvfs for `stat -f`
and on the BSDs we use statfs which doesn't have the
f_namelen member. However on OpenBSD and later FreeBSD
systems statfs does provide f_namemax, so use that.
* NEWS: Mention the improvement for OpenBSD and FreeBSD.
* m4/stat-prog.m4: Check for f_namemax in the statfs struct.
* src/stat.c: Return '?' rather than '*' when we can't
determine the max length of the file system.
* tests/ln/sf-1.sh: This test was failing on all BSDs
due to '*' being returned for the max length which
caused the test to attempt to create 1Mi+1 names.
The test now uses a short name when we can't determine
the max name length to use.
Reported by Assaf Gordon on various BSD based systems.
Similar to the issue with SELinux sandbox (CVE-2016-7545),
children of runcon can inject arbitrary input to the terminal
that would be run at the originating terminal privileges.
The new libseccomp dependency is widely available and used
on modern SELinux systems, but is not available by default
on older systems like RHEL6 etc.
* m4/jm-macros.m4: Check for libseccomp and
warn if unavailable on selinux supporting systems.
* src/local.mk: Link runcon with -lseccomp.
* src/runcon.c (disable_tty_inject): A new function to
disable use of the TIOCSTI using libseccomp, or with setsid()
where libseccomp is unavailable.
* tests/misc/runcon-no-inject.sh: A new test that uses
python to make the TIOCSTI call, and ensure that doesn't succeed.
* tests/local.mk: Reference the new test
* NEWS: Mention the fix.
Addresses http://bugs.gnu.org/24541
This saves about 0.5MB uncompressed from the tarball.
* Makefile.am: Following on from v8.26-34-g2c64bc8
update the oldest documented version to 8.18 which
is now about 5 years old. Also remove older ChangeLogs
that were previously thought to be for changes not
in the git history, but are adequately recorded upon review.
* build-aux/ChangeLog-2007: Remove file.
* lib/ChangeLog-2007: Likewise.
* m4/ChangeLog-2007: Likewise.
A lot of this is converting http: to https:.
Also, gmane went away, so remove URLs that no longer work and
are not easy to figure out what they were.
Some of this stuff is so old that it no longer matters anyway.
Run "make update-copyright" and then...
* gnulib: Update to latest with copyright year adjusted.
* tests/init.sh: Sync with gnulib to pick up copyright year.
* bootstrap: Likewise.
* tests/sample-test: Adjust to use the single most recent year.
This doesn't affect the generated code on my system; it's merely
a cleaner way to use the recently-introduced Linux-specific API.
* m4/jm-macros.m4 (gl_CHECK_ALL_HEADERS): Check for linux/fs.h.
* src/copy.c: Include <linux.fs.h> if available.
(FICLONE) [__linux__]: Define if not already defined.
(clone_file): Use FICLONE instead of the older BTRFS_IOC_CLONE,
as this ioctl is no longer btrfs-specific.
Run "make update-copyright" and then...
* gnulib: Update to latest with copyright year adjusted.
* tests/init.sh: Sync with gnulib to pick up copyright year.
* bootstrap: Likewise.
* tests/sample-test: Adjust to use the single most recent year.
* m4/jm-macros.m4 (HAVE_FPSETPREC): Define if needed.
* src/numfmt.c (main): Call fpsetprec() if needed.
Fixes large-15 and large-16 test failures on 32 bit FreeBSD.
* m4/jm-macros.m4 (coreutils_MACROS): Check for syncfs().
* man/sync.x: Add references to syncfs, fsync and fdatasync.
* doc/coreutils.texi (sync invocation): Document the new feature.
* src/sync.c: Include "quote.h".
(AUTHORS): Include myself.
(MODE_FILE, MODE_DATA, MODE_FILE_SYSTEM, MODE_SYNC): New enum values.
(long_options): Define.
(sync_arg): New function.
(usage): Describe that arguments are now accepted.
(main): Add arguments parsing and add support for fsync(2),
fdatasync(2) and syncfs(2).
* tests/misc/sync.sh: New (and only) test for sync.
* tests/local.mk: Reference the new test.
* AUTHORS: Add myself to sync's authors.
* NEWS: Mention the new feature.
Run "make update-copyright" and then...
* tests/sample-test: Adjust to use the single most recent year.
* tests/du/bind-mount-dir-cycle-v2.sh: Fix case in copyright message,
so that year is updated automatically in future.
With --sparse=always use fallocate(...PUNCH_HOLE...) to
avoid any permanent allocation due to speculative
preallocation employed by file systems such as XFS.
* m4/jm-macros.m4: Check for <linux/falloc.h> and fallocate().
* src/copy.c (punch_hole): A new function to try and punch
a hole at the specified offset if supported.
(create_hole): Call punch_hole() after requesting a hole.
(extent_copy): Likewise.
* NEWS: Mention the improvement.
Run "make update-copyright", but then also run this,
perl -pi -e 's/2\d\d\d-//' tests/sample-test
to make that one script use the single most recent year number.
Handle both newer selinux libraries with mode_to_security_class(),
and systems without selinux at all. We could easily adjust
gnulib to provide the necessary stubs for use by this module,
but it's more efficient to just stub out the module completely,
when not using selinux.
* src/selinux.h: Define stubs for the two module functions,
when SELinux is not available.
* src/selinux.c: Exclude all logic in preference for the stubs
when selinux isn't used. Also when newer selinux libs are used,
don't use our conflicting static version of mode_to_security_class().
m4/jm-macros.m4: Check for the system mode_to_security_class().
Consolidate all smack routines and checks in a module.
We replace and wrap the most commonly used smack routines,
which allows removing ifdefs throughout the code.
* gl/lib/smack.h: A new header containing the implementation
of the wrapped and replacement routines. Note the is_smack_enabled()
routine should be optimized out at compile time when compiled
on a system without libsmack.
* gl/modules/smack: Describe the new module and move the
configure time code here from ...
* m4/jm-macros.m4: ... here.
* bootstrap.conf: Reference the new module.
* src/id.c: Use the routines without ifdefs where possible.
* src/ls.c: Likewise.
* src/mkdir.c: Likewise.
* src/mkfifo.c: Likewise.
* src/mknod.c: Likewise.
There was slight change to libsmack such that positive values are
reserved for returning length of the label for smack_new_label_from_*
functions.
* m4/jm-macros.m4: Set HAVE_SMACK when both smack_new_label_from_self()
and recently added smack_new_label_from_path() are present.
The latter's presence indicates the newer API of the former.
* src/id.c (main): Check that smack_new_label_from_self() < 0,
and not just non-zero.
Adds an optional dependency on libsmack.
* m4/jm-macros.m4: Look for the smack library/header.
* src/id.c (main): Output the smack context if available.
* src/local.mk: Link with libsmack if available.
* NEWS: Mention the new feature.
* m4/gmp.m4 (cu_GMP): Add an extra check that gmp.h is available
which is required on one Mac OS X 10.5.8 system at least,
where the lib was available but the header wasn't.
Also enable our GMP code on systems where GMP is not in a separate lib.
Run "make update-copyright", but then also run this,
perl -pi -e 's/2\d\d\d-//' tests/sample-test
to make that one script use the single most recent year number.
The new factor code introduced usage of mpz_inits() and
mpz_clears(), which are only available since GMP >= 5,
and will result in a compile error when missing.
* m4/gmp.m4 (cu_GMP): Define HAVE_DECL_MPZ_INITS appropriately.
* src/factor (mpz_inits): New function, defined where missing.
(mpz_clears): Likewise.
This was originally attempted in commit v8.12-117-g5a647a0,
but reverted before release because of the unreliability
of disabling core dumps using setrlimit() on Linux kernels.
This new version instead uses prctl() where available to
more reliably disable core dumps for the timeout process.
* m4/jm-macros.m4: Define HAVE_SETRLIMIT and HAVE_PRCTL.
* src/timeout.c (disable_core_dumps): A new function
that disables coredumps using prctl or setrlimit if available.
(main): If the child exited with a signal and we can
disable core dumps, then raise that signal to the timeout
process itself, so that callers may also see the signal status.
Also print a message indicating when the monitored command
dumped core, as that information is lost in the signal
propagation through timeout.
Convert the few remaining coreutils-specific files in lib/ to
gnulib-style modules under gl/, removing their corresponding .m4
files, since the information recorded in those files is better
stored in module-description file in gl/modules/.
* bootstrap.conf (gnulib_modules): Add new modules:
fd-reopen, buffer-lcm, xfts, strnumcmp.
* gl/lib/buffer-lcm.c: Renamed from the file in lib/.
* gl/lib/buffer-lcm.h: Likewise.
* gl/lib/fd-reopen.c: Likewise.
* gl/lib/fd-reopen.h: Likewise.
* gl/lib/strintcmp.c: Likewise.
* gl/lib/strnumcmp-in.h: Likewise.
* gl/lib/strnumcmp.c: Likewise.
* gl/lib/strnumcmp.h: Likewise.
* gl/lib/xfts.c: Likewise.
* gl/lib/xfts.h: Likewise.
* gl/modules/buffer-lcm: New module-description file.
* gl/modules/fd-reopen: Likewise.
* gl/modules/strnumcmp: Likewise.
* gl/modules/xfts: Likewise.
* m4/fd-reopen.m4: Remove, no longer needed.
* m4/strnumcmp.m4: Likewise.
* m4/xfts.m4: Likewise.
* m4/prereq.m4: Do not AC_REQUIRE the m4 functions from
our just-removed m4/*.m4 files.
struct statfs has the f_frsize member since Linux 2.6,
so use that rather than f_bsize which can be different.
Note the related df change mentioned in NEWS is handled
in gnulib by using statvfs() rather than statfs()
on Linux > 2.6.36 (where statvfs doesn't hang) and the
same method as stat for Linux 2.6 kernels earlier than that.
stat(1) doesn't use statvfs() on GNU/Linux as the f_type
member isn't available there.
Note the change to not use statvfs() on GNU/Linux was introduced
in gnulib commit eda39b8 16-08-2003.
* m4/stat-prog.m4 (cu_PREREQ_STAT_PROG): Check for the f_frsize
member in the statfs structure.
* src/stat.c: Use (struct statfs).f_frsize if available.
* NEWS (Bug fixes): Mention this stat fix, and the related df fix
coming in the next gnulib update.
* THANKS.in: Add Nikolaus.
Reported and Tested by Nikolaus Rath
* bootstrap.conf (gnulib_modules): Add sys_resource.
* src/sort.c: Remove #if HAVE_SYS_RESOURCE_H guard around inclusion
of <sys/resource.h> and move the inclusion "up" into the alphabetized
list of its peers. This also avoids a failure of the
sc_prohibit_always_true_header_tests syntax-check rule.
* m4/jm-macros.m4 (gl_CHECK_ALL_HEADERS): Remove sys/resource.h.
This change affects only systems that have neither *at function support
nor the /proc/self/fd support required to emulate those *at functions.
* src/remove.c (write_protected_non_symlink): Call faccessat
unconditionally. Thus we no longer need euidaccess_stat, which was
the sole function used here to operate on a full relative file name.
Remove full_name parameter and update caller.
* lib/euidaccess-stat.h: Remove file.
* lib/euidaccess-stat.c: Likewise.
* m4/euidaccess-stat.m4: Likewise.
* po/POTFILES.in: Remove lib/euidaccess-stat.c.
* m4/prereq.m4 (gl_PREREQ): Don't require gl_EUIDACCESS_STAT.
Prompted by a report from Bruno Haible that the rm/deep-2
test was failing on HP-UX 11.31.
See http://thread.gmane.org/gmane.comp.gnu.coreutils.general/1748
Interix provides faster replacements for getgr{gid,nam,ent} where
group member information is not fetched from domain controllers.
This makes 'id' usable on domain controlled interix boxes.
* m4/jm-macros.m4: Check for _nomembers functions.
* src/system.h: Redefine function to _nomembers when available.
* src/stat.c (USE_STATVFS): Adjust definition so that it is enabled
also on AIX 7.x systems that provide statvfs64 and no statvfs.
[USE_STATVFS && ! STAT_STATVFS && STAT_STATVFS64] (STATFS): Define
to statvfs64 in that precise case.
* m4/stat-prog.m4 (cu_PREREQ_STAT_PROG): Adjust the condition
here to match the new one in stat.c, to keep them in sync.
Reported by Bruno Haible. For details, see
http://article.gmane.org/gmane.comp.gnu.coreutils.general/1668
* m4/jm-macros.m4 (coreutils_MACROS): Use fdatasync only if declared.
MacOS X 10.7 has an fdatasync that is not declared, and is rumored to
be ineffective. (Bug#9141)
* m4/jm-macros.m4: Define HAVE_SETRLIMIT.
* src/timeout.c: If the child exited with a signal,
raise that signal to the timeout process itself,
so that callers may also see the signal status.
Use setrlimit to disable core dumps for the timeout
process, which would be generated by some signals.
With it, we can remove the two sole tests of HAVE_TERMIOS_H.
* bootstrap.conf (gnulib_modules): Add termios.
* src/ls.c: Don't test HAVE_TERMIOS_H.
* src/stty.c: Likewise.
* m4/jm-macros.m4 (gl_CHECK_ALL_TYPES): Remove configure-time
test for termios.h.
* lib/Makefile.am (libcoreutils_a_SOURCES): Remove xmemxfrm.c,
xmemxfrm.h.
* lib/memxfrm.c, lib/memxfrm.h, lib/xmemxfrm.c, lib/xmemxfrm.h: Remove.
* m4/memxfrm.m4: Likewise.
* m4/prereq.m4 (gl_PREREQ): Remove gl_MEMXFRM.
* po/POTFILES.in: Remove lib/xmemxfrm.c.
* src/sort.c: Don't include xmemxfrm.h.
(cmp_hashes): Remove.
(xstrxfrm): New function.
(compare_random): If a line contains NULs, don't create a big
buffer that contains the strxfrm output of each string in the line.
Instead, accumulate checksums and differences as we go, so that
at any one time we have to store at most the output of a single
strxfrm call when processing the line. This removes the need for
an memxfrm function.
