Re: [PATCH 2/2] kconfig: Deny command substitution in string values

[Richard Weinberger]

Boris,

----- Ursprüngliche Mail -----
> Von: "Boris Kolpackov" <boris@xxxxxxxxxxxxxxxxx>
> An: "richard" <richard@xxxxxx>
> CC: "masahiroy" <masahiroy@xxxxxxxxxx>, "linux-kernel" <linux-kernel@xxxxxxxxxxxxxxx>, "linux-kbuild"
> <linux-kbuild@xxxxxxxxxxxxxxx>
> Gesendet: Mittwoch, 22. September 2021 17:18:43
> Betreff: Re: [PATCH 2/2] kconfig: Deny command substitution in string values

> Richard Weinberger <richard@xxxxxx> writes:
> 
>> > So effectively it's now impossible to include ` or $ in kconfig
>> > string values. Seems like a major, backwards-incompatible
>> > restriction.
>> 
>> Do you have a working example?
> 
> You mean of a project that uses kconfig and that is capable of
> handling string values with these characters? If so, then yes,
> see for example, libbuild2-kconfig[1] which is a build system
> module that implements kconfig-based configuration support for
> build2. In particular, it exposes values from .config  as
> buildfile variables but it doesn't do this by sourcing .config.
> Instead it loads .config using the kconfig API and then sets
> the corresponding buildfile variables programmatically.

I had a config setting of Linux in mind. :-)

> 
>> Since the config is sourced in the scripts/setlocalversion it will
>> not work correctly anyway.
> 
> The actual file being sources is include/config/auto.conf, not
> .config, right?
> 

Yes. auto.conf is .config post processed.
This is exactly where my mitigation takes place.
 
>> > I think if this is really desired, then it should be re-done with
>> > escaping (similar to ") rather than outright banning inconvenient
>> > characters.
>> 
>> Escaping is not so easy since the very same content is included
>> in shell scripts (sertlocalversion), in Makefiles and in C files.
> 
> Again, I don't think it's .config that gets included in C files but
> rather include/generated/autoconf.h, right?
> 

Yes. But the key/values are taken as-is.

Just add some odd characters to your .config, build the kernel and observe
the breakage at different levels.
Or something like CONFIG_DEFAULT_HOSTNAME="`touch owned`". ;-)

>> At least I didn't find find a good way to escape these characters
>> such that all three programming environments will accept it.
> 
> If my understanding is correct, then you are concerned with the
> autoconf functionality: the auto.conf makefile and autoconf.h
> header, and not the .config file itself. Perhaps it will be less
> disruptive to do the escaping (or banning) at that level?

My concern is that currently a .config file can contain hostile content
that will get executed at build time.
.config files are often blindly shared across untrusted developers.
So I thought that mitigating this whole is worth it.

> Specifically:
> 
> 1. If you do escaping at that level, then you can do it differently
>   for auto.conf and autoconf.h. Though auto.conf still seems to be
>   read by both make and shell.

I need to think about that. Thanks for the pointer.

Thanks,
//richard