diff --git a/bcc-0.25.0-clang-Fix-file_exists_and_ownedby-return-value-4935.patch b/bcc-0.25.0-clang-Fix-file_exists_and_ownedby-return-value-4935.patch new file mode 100644 index 0000000000000000000000000000000000000000..c623cfe95743d1aa2e516cc62096a23ae0603f2a --- /dev/null +++ b/bcc-0.25.0-clang-Fix-file_exists_and_ownedby-return-value-4935.patch @@ -0,0 +1,33 @@ +From 509b05f2790fd1f9e725e353521a5a555ca57aaf Mon Sep 17 00:00:00 2001 +From: Chunsheng Luo <48231204+luochenglcs@users.noreply.github.com> +Date: Mon, 18 Mar 2024 00:09:21 +0800 +Subject: [PATCH] clang: Fix file_exists_and_ownedby return value (#4935) + +commit 008ea09 (clang: check header ownership) updates file_exists() +to file_exists_and_ownedby(), add verifies onwer, but the return value +is different from before, causing problems with the original code. + +Signed-off-by: Chunsheng Luo +Signed-off-by: Jerome Marchand +--- + src/cc/frontends/clang/kbuild_helper.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc +index 1b291469..0387f872 100644 +--- a/src/cc/frontends/clang/kbuild_helper.cc ++++ b/src/cc/frontends/clang/kbuild_helper.cc +@@ -143,8 +143,8 @@ int KBuildHelper::get_flags(const char *uname_machine, vector *cflags) { + static inline int file_exists_and_ownedby(const char *f, uid_t uid) + { + struct stat buffer; +- int ret; +- if ((ret = stat(f, &buffer)) == 0) { ++ int ret = stat(f, &buffer) == 0; ++ if (ret) { + if (buffer.st_uid != uid) { + std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n"; + return -1; +-- +2.44.0 + diff --git a/bcc-0.25.0-clang-check-header-ownership-4928.patch b/bcc-0.25.0-clang-check-header-ownership-4928.patch new file mode 100644 index 0000000000000000000000000000000000000000..a25fd26c1eea9e98c75f21d4be7cbc1868aa2cfd --- /dev/null +++ b/bcc-0.25.0-clang-check-header-ownership-4928.patch @@ -0,0 +1,68 @@ +From d6a5130c5f18499da26eef88f52da75c9e33d63d Mon Sep 17 00:00:00 2001 +From: Brendan Gregg +Date: Thu, 7 Mar 2024 05:27:14 +1100 +Subject: [PATCH] clang: check header ownership (#4928) + +Example testing with a brendan-owned /tmp/kheaders file (note the "ERROR:" message): + +~/bcc/build$ sudo /usr/share/bcc/tools/biosnoop +ERROR: header file ownership unexpected: /tmp/kheaders-5.15.47-internal +:1:10: fatal error: './include/linux/kconfig.h' file not found +#include "./include/linux/kconfig.h" + ^~~~~~~~~~~~~~~~~~~~~~~~~~~ +1 error generated. +Traceback (most recent call last): + File "/usr/share/bcc/tools/biosnoop", line 335, in + b = BPF(text=bpf_text) + File "/usr/lib/python3/dist-packages/bcc-0.1.5+6cd27218-py3.10.egg/bcc/__init__.py", line 479, in __init__ +Exception: Failed to compile BPF module +~/bcc/build$ ls -lhd /tmp/kheaders-5.15.47-internal +drwxrwxr-x 2 brendan dev 4.0K Mar 6 02:50 /tmp/kheaders-5.15.47-internal + +No error when chown'd back to root. +--- + src/cc/frontends/clang/kbuild_helper.cc | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc +index 933aec8e..1b291469 100644 +--- a/src/cc/frontends/clang/kbuild_helper.cc ++++ b/src/cc/frontends/clang/kbuild_helper.cc +@@ -140,15 +140,22 @@ int KBuildHelper::get_flags(const char *uname_machine, vector *cflags) { + return 0; + } + +-static inline int file_exists(const char *f) ++static inline int file_exists_and_ownedby(const char *f, uid_t uid) + { + struct stat buffer; +- return (stat(f, &buffer) == 0); ++ int ret; ++ if ((ret = stat(f, &buffer)) == 0) { ++ if (buffer.st_uid != uid) { ++ std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n"; ++ return -1; ++ } ++ } ++ return ret; + } + + static inline int proc_kheaders_exists(void) + { +- return file_exists(PROC_KHEADERS_PATH); ++ return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0); + } + + static inline int extract_kheaders(const std::string &dirpath, +@@ -214,7 +221,7 @@ int get_proc_kheaders(std::string &dirpath) + snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release); + dirpath = std::string(dirpath_tmp); + +- if (file_exists(dirpath_tmp)) ++ if (file_exists_and_ownedby(dirpath_tmp, 0)) + return 0; + + // First time so extract it +-- +2.43.2 + diff --git a/bcc-0.25.0-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch b/bcc-0.25.0-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch new file mode 100644 index 0000000000000000000000000000000000000000..5bc5995bd6bbf57228f30d9cbf64487998b24978 --- /dev/null +++ b/bcc-0.25.0-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch @@ -0,0 +1,76 @@ +From 1d504ac46d2a0210813147b6a57d657b6c2a5d2e Mon Sep 17 00:00:00 2001 +From: Jerome Marchand +Date: Fri, 17 May 2024 15:36:07 +0200 +Subject: [PATCH] clang: fail when the kheaders ownership is wrong (#4928) + (#4985) + +file_exists_and_ownedby() returns -1 when the file exists but its +ownership is unexpected, which is very misleading since anything non +zero is interpreted as true and a function with such a name is +expected to return a boolean. So currently all this does, is write a +warning message, and continues as if nothing is wrong. + +Make file_exists_and_ownedby() returns false when the ownership is +wrong and have get_proc_kheaders() fails when this happen. Also have +all the *exists* functions return bool to avoid such issues in the +future. + +Signed-off-by: Jerome Marchand +--- + src/cc/frontends/clang/kbuild_helper.cc | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc +index 0387f872..9dd3c3c8 100644 +--- a/src/cc/frontends/clang/kbuild_helper.cc ++++ b/src/cc/frontends/clang/kbuild_helper.cc +@@ -140,20 +140,26 @@ int KBuildHelper::get_flags(const char *uname_machine, vector *cflags) { + return 0; + } + +-static inline int file_exists_and_ownedby(const char *f, uid_t uid) ++static inline bool file_exists(const char *f) ++{ ++ struct stat buffer; ++ return (stat(f, &buffer) == 0); ++} ++ ++static inline bool file_exists_and_ownedby(const char *f, uid_t uid) + { + struct stat buffer; + int ret = stat(f, &buffer) == 0; + if (ret) { + if (buffer.st_uid != uid) { + std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n"; +- return -1; ++ return false; + } + } + return ret; + } + +-static inline int proc_kheaders_exists(void) ++static inline bool proc_kheaders_exists(void) + { + return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0); + } +@@ -221,8 +227,14 @@ int get_proc_kheaders(std::string &dirpath) + snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release); + dirpath = std::string(dirpath_tmp); + +- if (file_exists_and_ownedby(dirpath_tmp, 0)) +- return 0; ++ if (file_exists(dirpath_tmp)) { ++ if (file_exists_and_ownedby(dirpath_tmp, 0)) ++ return 0; ++ else ++ // The path exists, but is owned by a non-root user ++ // Something fishy is going on ++ return -EEXIST; ++ } + + // First time so extract it + return extract_kheaders(dirpath, uname_data); +-- +2.44.0 + diff --git a/bcc.spec b/bcc.spec index cfe758ea64ce93dd00793c3d7a96c79deef0842d..6a11f1ea18d0fb108f6ae41c4b369dcd84daf235 100644 --- a/bcc.spec +++ b/bcc.spec @@ -1,4 +1,4 @@ -%global anolis_release .0.3 +%global anolis_release .0.1 # luajit is not available RHEL 8 %bcond_with lua @@ -11,7 +11,7 @@ Name: bcc Version: 0.25.0 -Release: 7%{anolis_release}%{?dist} +Release: 9%{anolis_release}%{?dist} Summary: BPF Compiler Collection (BCC) License: ASL 2.0 URL: https://github.com/iovisor/bcc @@ -31,7 +31,9 @@ Patch11: %{name}-%{version}-Fix-a-llvm-compilation-error.patch Patch12: %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch Patch13: %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch Patch14: %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch - +Patch15: %{name}-%{version}-clang-check-header-ownership-4928.patch +Patch16: %{name}-%{version}-clang-Fix-file_exists_and_ownedby-return-value-4935.patch +Patch17: %{name}-%{version}-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch Patch1000: %{name}-%{version}-Add-libbpf-with-commit-0667206913b.patch Patch1001: 0001-support-anolis-own-feature-bpf-rich-container.patch @@ -258,15 +260,17 @@ done %changelog -* Mon Oct 28 2024 wangzhe - 0.25.0-7.0.3 -- tools: add customized tools (joseph.qi@linux.alibaba.com) - -* Thu Jul 18 2024 wangzhe - 0.25.0-7.0.2 +* Fri Nov 08 2024 Hui Li - 0.25.0-9.0.1 +- Add support for loongarch64 - support bpf rich container (yingyu.dtc@alibaba-inc.com) - disable BPF_PROG_TYPE_SYSCALL (Liwei Ge) +- tools: add customized tools (joseph.qi@linux.alibaba.com) -* Fri Jul 05 2024 Hui Li - 0.25.0-7.0.1 -- Add support for loongarch64 +* Tue May 28 2024 Jerome Marchand - 0.25.0-9 +- Really prevent the loading of compromised headers (RHEL-28768, CVE-2024-2314) + +* Tue Mar 12 2024 Jerome Marchand - 0.25.0-8 +- Check header ownership (RHEL-28768) * Wed Nov 08 2023 Jerome Marchand - 0.25.0-7 - Fix repo URL in tests.yml diff --git a/dist b/dist index 9c0e36ec42a2d9bfefacb21ac6354c9ddd910533..1fe92cf0fdf9c2625d878a2ace258f64c1e8ca44 100644 --- a/dist +++ b/dist @@ -1 +1 @@ -an8 +an8_10