Re: [RFC PATCH] kbuild: check uniqueness of basename of modules

[Masahiro Yamada]

Hi Kees,

On Thu, May 16, 2019 at 3:38 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> On Thu, May 16, 2019 at 02:55:02AM +0900, Masahiro Yamada wrote:
> >
> > On Thu, May 16, 2019 at 1:20 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> > >
> > > On Wed, May 15, 2019 at 04:53:15PM +0900, Masahiro Yamada wrote:
> > > > On Wed, May 15, 2019 at 4:40 PM Masahiro Yamada
> > > > <yamada.masahiro@xxxxxxxxxxxxx> wrote:
> > > > >
> > > > > [...]
> > > > > diff --git a/scripts/modules-check.sh b/scripts/modules-check.sh
> > > > > new file mode 100755
> > > > > index 000000000000..944e68bd22b0
> > > > > --- /dev/null
> > > > > +++ b/scripts/modules-check.sh
> > > > > @@ -0,0 +1,18 @@
> > > > > +#!/bin/sh
> > > > > +# SPDX-License-Identifier: GPL-2.0
> > > > > +
> > > > > +# Warn if two or more modules have the same basename
> > > > > +check_same_name_modules()
> > > > > +{
> > > > > +       same_name_modules=$(cat modules.order modules.builtin | \
> > > > > +                               xargs basename -a | sort | uniq -d)
> > >
> > > While probably it'll never be a problem, just for robustness, I'd add "--"
> > > to the end basename to terminate argument interpretation:
> > >
> > >     xargs basename -a -- | sort | ...
> >
> >
> > Sorry for my ignorance, but could you
> > teach me the effect of "--" ?
> >
> >
> > I sometimes use "--" as a separator
> > when there is ambiguity in arguments
> > for example, "git log <revision> -- <path>"
> >
> >
> > In this case, what is intended by "--"?
>
> It means "end of arguments" so that whatever xargs passes into the
> program aren't interpretted as an argument. In this case, if there was
> a module path somehow ever named --weird/build/path/foo.o, xargs would
> launch basename as:
>
>         basename -a --weird/build/path/foo.o
>
> and basename would fail since it didn't recognize the argument. Having
> "--" will stop argument parsing:
>
>         basename -a -- --weird/build/path/foo.o
>
> This is just a robustness suggestion that I always recommend for xargs
> piping, since this can turn into a security flaw (though not here) when
> an argument may have behavioral side-effects. So, it's just a thing that
> always jumps out at me, though in this particular case I don't think
> we could ever see it cause a problem, but better to always write these
> xargs patterns as safely as possible.

I did not think about the security issue.
Thanks for your expert comments!


-- 
Best Regards
Masahiro Yamada