File squilt-20220617.c1a5044.obscpio of Package squilt

Overview Repositories Revisions Requests Users Attributes Meta

File squilt-20220617.c1a5044.obscpio of Package squilt (Revision 9848ba182285226215f74fba8a9fce33)

Currently displaying revision 9848ba182285226215f74fba8a9fce33 , Show latest

07070100000000000081A400000000000000000000000162AC6CDC00000430000000000000000000000000000000000000002000000000squilt-20220617.c1a5044/LICENSEMIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
07070100000001000081A400000000000000000000000162AC6CDC00000271000000000000000000000000000000000000002200000000squilt-20220617.c1a5044/README.md# squilt
Wrapper to confine quilt with [nsjail](https://github.com/google/nsjail)

# Why?
Using quilt on untrusted spec files is not secure. For more see
[this posting by Matthias](https://www.openwall.com/lists/oss-security/2018/09/27/2).

Matthias developed the original exploit, but as described in the posting, any
command in %prep is run as the user calling quilt without any limitations. This
was (at least to us) unexpected.

# Usage
If you add an alias quilt=squilt or copy this script as 'quilt' to a directory
that is earlier in $PATH you should be able to use it like you use quilt without
noticying a difference.
07070100000002000081ED00000000000000000000000162AC6CDC00000BD2000000000000000000000000000000000000001F00000000squilt-20220617.c1a5044/squilt#!/bin/sh

QUILT_USER_CONFIG="$HOME/.quiltrc"
QUILT_GLOBAL_CONFIG="/etc/quilt.quiltrc"

if ! which nsjail 2>/dev/null; then
  echo "you need nsjail (security/nsjail in OBS) for this wrapper to work"
  exit 1
fi

mount_dir=$(pwd)
if [ -L patches ]; then
  # are we inside the already unpacked dir? If so mount the parent dir so we
  # have access to the patches
  mount_dir=$mount_dir/..
fi

# we need to create a temporary config file since mounts with
# : don't work on the command line
TMPFILE=`mktemp -t squilt.nsjail.XXXXXXXXXX` || exit 1
trap "rm -f -- '$TMPFILE'" EXIT

cat <<END_CONFIG > $TMPFILE
name: "quilt secure sandbox"

description: "This policy allows to run quilt in a secure way"

time_limit: 120

cwd: "$(pwd)"
envar: "HOME=$HOME"
envar: "PATH=$PATH"

# bind for read-only access
mount {
        src: "/bin"
        dst: "/bin"
        rw: false
        is_bind: true
}
mount {
        src: "/lib"
        dst: "/lib"
        rw: false
        is_bind: true
}
mount {
        src: "/lib64"
        dst: "/lib64"
        rw: false
        is_bind: true
}
mount {
        src: "/usr"
        dst: "/usr"
        rw: false
        is_bind: true
}
mount {
        src: "/sbin"
        dst: "/sbin"
        rw: false
        is_bind: true
}
mount {
        src: "/etc/alternatives"
        dst: "/etc/alternatives"
        rw: false
        is_bind: true
        mandatory: false
}
mount {
        src: "/etc/nsswitch.conf"
        dst: "/etc/nsswitch.conf"
        rw: false
        is_bind: true
}
mount {
        src: "/etc/ld.so.cache"
        dst: "/etc/ld.so.cache"
        rw: false
        is_bind: true
}
mount {
        src: "/etc/rpm"
        dst: "/etc/rpm"
        rw: false
        is_bind: true
}

# rw access to real files
mount {
        src: "$mount_dir"
        dst: "$mount_dir"
        rw: true
        is_bind: true
}
mount {
        src: "/dev/null"
        dst: "/dev/null"
        rw: true
        is_bind: true
}
mount {
        src: "/dev/urandom"
        dst: "/dev/urandom"
        rw: true
        is_bind: true
}

# fake rw access to tmpfs versions
mount {
        dst: "/tmp"
        fstype: "tmpfs"
        rw: true
        is_bind: false
}
mount {
        dst: "/var/tmp"
        fstype: "tmpfs"
        rw: true
        is_bind: false
}
mount {
        dst: "$HOME/rpmbuild"
        fstype: "tmpfs"
        rw: true
        is_bind: false
}

rlimit_as_type: HARD
rlimit_core_type: HARD
rlimit_cpu_type: HARD
rlimit_fsize_type: HARD
rlimit_nofile_type: HARD
rlimit_nproc_type: HARD
rlimit_stack_type: HARD
END_CONFIG

if [ -e "$QUILT_USER_CONFIG" ]; then
  cat <<END_CONFIG >> $TMPFILE
mount {
        src: "$QUILT_USER_CONFIG"
        dst: "$QUILT_USER_CONFIG"
        rw: false
        is_bind: true
}
END_CONFIG
fi

if [ -e "$QUILT_GLOBAL_CONFIG" ]; then
  cat <<END_CONFIG >> $TMPFILE
mount {
        src: "$QUILT_GLOBAL_CONFIG"
        dst: "$QUILT_GLOBAL_CONFIG"
        rw: false
        is_bind: true
}
END_CONFIG
fi

nsjail -Mo -q --config $TMPFILE -- /usr/bin/quilt $@
07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000B00000000TRAILER!!!11 blocks

Places

File squilt-20220617.c1a5044.obscpio of Package squilt (Revision 9848ba182285226215f74fba8a9fce33)

Places