stepchenkoas/mkimage-profiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tar2fs: avoid losetup race

Browse Source 
There's a race condition (TOCTOU) between losetup --find
and applying the obtained path after additional dd in between;
twice awful as *at least* running both losetups closely would
reduce the window significantly, and reading the manpage
properly back then would eliminate this.

Reported-by: Anton Midyukov <antohami@altlinux.org>
Suggested-by: Gleb F-Malinovskiy <glebfm@altlinux.org>
This commit is contained in:
Michael Shigorin 2022-03-29 12:19:59 +03:00 committed by Anton Midyukov
parent e245447c06
commit 1a33a37aca
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bin/tar2fs
View File

@ -165,7 +165,6 @@ for i in losetup sfdisk parted kpartx $MKFS; do
fi
done
LOOPDEV="$(losetup --find)" # would be sad about non-binary megabytes too
ROOTFS="$WORKDIR/chroot"
BOOTFS=
@ -204,7 +203,8 @@ trap exit_handler EXIT ERR
rm -f -- "$IMG"
OFFSET="$(($CUR_BOUNDARY + $EFIPARTSIZEM + $BOOTLOADERPARTSIZEM + $BOOTSIZEM + $ROOTSIZEM - 1))"
dd if=/dev/zero of="$IMG" conv=notrunc bs=$MB count=1 seek="$OFFSET"
losetup "$LOOPDEV" "$IMG"
losetup -f "$IMG"
LOOPDEV=$(losetup -j "$IMG" | cut -f 1 -d ':')
parting mklabel "$PARTTABLE"