aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenys Vlasenko <vda.linux@googlemail.com>2017-08-04 17:36:16 +0200
committerDenys Vlasenko <vda.linux@googlemail.com>2017-08-04 17:36:16 +0200
commit74c05f5b2cfde7a561e55437eb499f96864179a3 (patch)
treed2f84f2fcf5ab032a58bc37c6a0b6f0d6f273c9b
parentdd5a40246b91bd5d3d165998e6ac3cc4f7083f63 (diff)
downloadbusybox-w32-74c05f5b2cfde7a561e55437eb499f96864179a3.tar.gz
busybox-w32-74c05f5b2cfde7a561e55437eb499f96864179a3.tar.bz2
busybox-w32-74c05f5b2cfde7a561e55437eb499f96864179a3.zip
chat: trim help text
Noticed while auditing nofork/noexec status function old new delta packed_usage 31777 31747 -30 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat
-rw-r--r--NOFORK_NOEXEC.lst93
-rw-r--r--miscutils/chat.c4
-rw-r--r--util-linux/freeramdisk.c8
3 files changed, 58 insertions, 47 deletions
diff --git a/NOFORK_NOEXEC.lst b/NOFORK_NOEXEC.lst
index 74922ff52..9741f21ea 100644
--- a/NOFORK_NOEXEC.lst
+++ b/NOFORK_NOEXEC.lst
@@ -11,8 +11,8 @@ runner: sometimes may run for long(ish) time, and/or works with network:
11 ^C has to work (cat BIGFILE, chmod -R, ftpget, nc) 11 ^C has to work (cat BIGFILE, chmod -R, ftpget, nc)
12 12
13"runners" can become eligible after shell is taught ^C to interrupt NOFORKs, 13"runners" can become eligible after shell is taught ^C to interrupt NOFORKs,
14need to be inspected that they do not fall into alloc+xfunc, open+xfunc 14need to be inspected that they do not fall into alloc+xfunc, open+xfunc,
15categories. 15leak categories.
16 16
17Why can't be NOEXEC: 17Why can't be NOEXEC:
18suid: runs under different uid - must fork+exec 18suid: runs under different uid - must fork+exec
@@ -23,7 +23,15 @@ daemon: runs indefinitely; these are also always fit "rare" category
23longterm: often runs for a long time (many seconds), execing would make 23longterm: often runs for a long time (many seconds), execing would make
24 memory footprint smaller 24 memory footprint smaller
25complex: no immediately obvious reason why NOFORK wouldn't work, 25complex: no immediately obvious reason why NOFORK wouldn't work,
26 but does some non-obvoius operations (example: fuser, lsof, losetup) 26 but does some non-obvoius operations (example: fuser, lsof, losetup);
27 detailed audit often turns out that it's a leaker
28
29Interesting example of "interactive" applet which is nevertheless can be
30(and is) NOEXEC is "rm". Yes, "rm -i" is interactive - but it's not that typical
31for users to keep it waiting for many minutes, whereas running "rm" in shell
32is very typical, and speeding up this common use via NOEXEC is useful.
33IOW: rm is "interactive", but not "longterm".
34
27 35
28[ - NOFORK 36[ - NOFORK
29[[ - NOFORK 37[[ - NOFORK
@@ -34,9 +42,9 @@ adduser
34adjtimex 42adjtimex
35ar - runner 43ar - runner
36arch - NOFORK 44arch - NOFORK
37arp 45arp - complex, rare
38arping - runner 46arping - runner
39ash - interactive 47ash - interactive, longterm
40awk - noexec. runner 48awk - noexec. runner
41base64 - runner 49base64 - runner
42basename - NOFORK 50basename - NOFORK
@@ -52,7 +60,7 @@ bzcat - runner
52bzip2 - runner 60bzip2 - runner
53cal - runner: cal -n9999 61cal - runner: cal -n9999
54cat - runner 62cat - runner
55chat 63chat - needs ^C to work
56chattr - runner 64chattr - runner
57chgrp - noexec. runner 65chgrp - noexec. runner
58chmod - noexec. runner 66chmod - noexec. runner
@@ -77,10 +85,10 @@ cut - noexec. runner
77date - noexec. nofork candidate(needs to stop messing up env, free xasprintf result, not use xfuncs after xasprintf) 85date - noexec. nofork candidate(needs to stop messing up env, free xasprintf result, not use xfuncs after xasprintf)
78dc - runner (eats stdin if no params) 86dc - runner (eats stdin if no params)
79dd - noexec. runner 87dd - noexec. runner
80deallocvt 88deallocvt - leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds. Also, "rare" category. Can be noexec.
81delgroup 89delgroup
82deluser 90deluser
83depmod 91depmod - complex, rare
84devmem - runner, complex (access to device memory may hang) 92devmem - runner, complex (access to device memory may hang)
85df - complex (nested allocs) 93df - complex (nested allocs)
86dhcprelay - daemon 94dhcprelay - daemon
@@ -88,16 +96,16 @@ diff - runner
88dirname - NOFORK 96dirname - NOFORK
89dmesg - runner 97dmesg - runner
90dnsd - daemon 98dnsd - daemon
91dnsdomainname - DNS resolution may trigger, need ^C 99dnsdomainname - needs ^C (may talk to DNS servers, which may be down)
92dos2unix - noexec. runner 100dos2unix - noexec. runner
93dpkg - runner 101dpkg - runner
94du - runner 102du - runner
95dumpkmap 103dumpkmap - leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds. Also, "rare" category. Can be noexec.
96dumpleases 104dumpleases
97echo - NOFORK 105echo - NOFORK
98ed - interactive 106ed - interactive, longterm
99egrep - runner 107egrep - longterm runner ("CMD | egrep ..." may run indefinitely, better to exec to conserve memory)
100eject 108eject - leaks: open+ioctl_or_perror_and_die, changes state (moves fds)
101env - noexec. changes state (env) 109env - noexec. changes state (env)
102envdir - spawner 110envdir - spawner
103envuidgid - spawner 111envuidgid - spawner
@@ -107,24 +115,24 @@ factor - runner (eats stdin if no params)
107fakeidentd - daemon 115fakeidentd - daemon
108false - NOFORK 116false - NOFORK
109fatattr - complex (xopen+xioctl can leak fd) 117fatattr - complex (xopen+xioctl can leak fd)
110fbset 118fbset - leaks: open+xfunc, complex, rare
111fbsplash - runner, interactive 119fbsplash - runner, longterm
112fdflush 120fdflush - leaks: open+ioctl_or_perror_and_die, needs ^C (floppy may be unresponsive), rare
113fdformat - runner 121fdformat - needs ^C (floppy may be unresponsive), longterm, rare
114fdisk - interactive 122fdisk - interactive, longterm
115fgconsole 123fgconsole - leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds. Also, "rare" category. Can be noexec.
116fgrep - runner 124fgrep - longterm runner ("CMD | fgrep ..." may run indefinitely, better to exec to conserve memory)
117find - noexec. runner 125find - noexec. runner
118findfs - suid 126findfs - suid
119flash_eraseall 127flash_eraseall
120flash_lock 128flash_lock
121flash_unlock 129flash_unlock
122flashcp 130flashcp
123flock 131flock - spawner, changes state (file locks)
124fold - noexec. runner 132fold - noexec. runner
125free - nofork candidate(struct globals, needs to close /proc/meminfo fd) 133free - nofork candidate(struct globals, needs to close /proc/meminfo fd)
126freeramdisk 134freeramdisk - leaks: open+ioctl_or_perror_and_die
127fsck - interactive 135fsck - interactive, longterm
128fsck.minix 136fsck.minix
129fsfreeze 137fsfreeze
130fstrim 138fstrim
@@ -134,8 +142,8 @@ ftpget - runner
134ftpput - runner 142ftpput - runner
135fuser - complex 143fuser - complex
136getopt - noexec. complex (many allocs) 144getopt - noexec. complex (many allocs)
137getty - interactive 145getty - interactive, longterm
138grep - runner 146grep - longterm runner ("CMD | grep ..." may run indefinitely, better to exec to conserve memory)
139groups - noexec 147groups - noexec
140gunzip - runner 148gunzip - runner
141gzip - runner 149gzip - runner
@@ -147,7 +155,7 @@ hexdump - noexec. runner
147hostid - NOFORK 155hostid - NOFORK
148hostname - DNS resolution may trigger, need ^C 156hostname - DNS resolution may trigger, need ^C
149httpd - daemon 157httpd - daemon
150hush - interactive 158hush - interactive, longterm
151hwclock 159hwclock
152i2cdetect 160i2cdetect
153i2cdump 161i2cdump
@@ -180,39 +188,39 @@ killall - NOFORK
180killall5 - NOFORK 188killall5 - NOFORK
181klogd - daemon 189klogd - daemon
182last - runner (I've got 1300 lines of output when tried it) 190last - runner (I've got 1300 lines of output when tried it)
183less - interactive 191less - interactive, longterm
184link - NOFORK 192link - NOFORK
185linux32 - spawner 193linux32 - spawner
186linux64 - spawner 194linux64 - spawner
187linuxrc - daemon 195linuxrc - daemon
188ln - noexec 196ln - noexec
189loadfont 197loadfont
190loadkmap 198loadkmap - leaks: get_console_fd_or_die() may open a new fd, or return one of stdio fds. Also, "rare" category. Can be noexec.
191logger - runner 199logger - runner
192login - suid, interactive 200login - suid, interactive, longterm
193logname - NOFORK 201logname - NOFORK
194losetup - complex 202losetup - complex
195lpd - daemon 203lpd - daemon
196lpq - runner 204lpq - runner
197lpr - runner 205lpr - runner
198ls - noexec. runner 206ls - noexec. runner
199lsattr 207lsattr - runner. noexec candidate (ls is, why not this one?)
200lsmod - noexec 208lsmod - noexec
201lsof - complex 209lsof - complex
202lspci 210lspci - noexec candidate, too rare to bother for nofork
203lsscsi 211lsscsi - noexec candidate, too rare to bother for nofork
204lsusb 212lsusb - noexec candidate, too rare to bother for nofork
205lzcat - runner 213lzcat - runner
206lzma - runner 214lzma - runner
207lzop - runner 215lzop - runner
208lzopcat - runner 216lzopcat - runner
209makedevs 217makedevs
210makemime - runner 218makemime - runner
211man - spawner, interactive 219man - spawner, interactive, longterm
212md5sum - noexec. runner 220md5sum - noexec. runner
213mdev - daemon 221mdev - daemon
214mesg 222mesg
215microcom - interactive, complex 223microcom - interactive, longterm
216mkdir - NOFORK 224mkdir - NOFORK
217mkdosfs 225mkdosfs
218mke2fs 226mke2fs
@@ -223,10 +231,10 @@ mkfs.vfat
223mknod - noexec 231mknod - noexec
224mkpasswd 232mkpasswd
225mkswap 233mkswap
226mktemp 234mktemp - leaks: xstrdup+concat_path_file
227modinfo - noexec 235modinfo - noexec
228modprobe - noexec 236modprobe - noexec
229more - interactive 237more - interactive, longterm
230mount - suid 238mount - suid
231mountpoint 239mountpoint
232mpstat 240mpstat
@@ -305,12 +313,11 @@ setpriv - spawner
305setserial 313setserial
306setsid - spawner 314setsid - spawner
307setuidgid 315setuidgid
308sh - interactive
309sha1sum - noexec. runner 316sha1sum - noexec. runner
310sha256sum - noexec. runner 317sha256sum - noexec. runner
311sha3sum - noexec. runner 318sha3sum - noexec. runner
312sha512sum - noexec. runner 319sha512sum - noexec. runner
313showkey - interactive 320showkey - interactive, longterm
314shred - runner 321shred - runner
315shuf - noexec. runner 322shuf - noexec. runner
316slattach 323slattach
@@ -342,7 +349,7 @@ tar - runner
342taskset - spawner 349taskset - spawner
343tcpsvd - daemon 350tcpsvd - daemon
344tee - runner 351tee - runner
345telnet - interactive 352telnet - interactive, longterm
346telnetd - daemon 353telnetd - daemon
347test - NOFORK 354test - NOFORK
348tftp - runner 355tftp - runner
@@ -359,7 +366,7 @@ truncate - NOFORK
359tty - NOFORK 366tty - NOFORK
360ttysize - NOFORK 367ttysize - NOFORK
361tunctl 368tunctl
362tune2fs 369tune2fs - leaks: open+xfunc
363ubiattach 370ubiattach
364ubidetach 371ubidetach
365ubimkvol 372ubimkvol
@@ -387,8 +394,8 @@ users - nofork candidate(is getutxent ok?)
387usleep - NOFORK 394usleep - NOFORK
388uudecode - runner 395uudecode - runner
389uuencode - runner 396uuencode - runner
390vconfig 397vconfig - leaks: xsocket+ioctl_or_perror_and_die
391vi - interactive 398vi - interactive, longterm
392vlock - suid 399vlock - suid
393volname - runner 400volname - runner
394w 401w
diff --git a/miscutils/chat.c b/miscutils/chat.c
index 216a899a0..1446a040c 100644
--- a/miscutils/chat.c
+++ b/miscutils/chat.c
@@ -82,8 +82,8 @@
82//usage: "EXPECT [SEND [EXPECT [SEND...]]]" 82//usage: "EXPECT [SEND [EXPECT [SEND...]]]"
83//usage:#define chat_full_usage "\n\n" 83//usage:#define chat_full_usage "\n\n"
84//usage: "Useful for interacting with a modem connected to stdin/stdout.\n" 84//usage: "Useful for interacting with a modem connected to stdin/stdout.\n"
85//usage: "A script consists of one or more \"expect-send\" pairs of strings,\n" 85//usage: "A script consists of \"expect-send\" argument pairs.\n"
86//usage: "each pair is a pair of arguments. Example:\n" 86//usage: "Example:\n"
87//usage: "chat '' ATZ OK ATD123456 CONNECT '' ogin: pppuser word: ppppass '~'" 87//usage: "chat '' ATZ OK ATD123456 CONNECT '' ogin: pppuser word: ppppass '~'"
88 88
89#include "libbb.h" 89#include "libbb.h"
diff --git a/util-linux/freeramdisk.c b/util-linux/freeramdisk.c
index 55187cb40..a73578404 100644
--- a/util-linux/freeramdisk.c
+++ b/util-linux/freeramdisk.c
@@ -67,8 +67,12 @@ int freeramdisk_main(int argc UNUSED_PARAM, char **argv)
67 fd = xopen(single_argv(argv), O_RDWR); 67 fd = xopen(single_argv(argv), O_RDWR);
68 68
69 // Act like freeramdisk, fdflush, or both depending on configuration. 69 // Act like freeramdisk, fdflush, or both depending on configuration.
70 ioctl_or_perror_and_die(fd, (ENABLE_FREERAMDISK && applet_name[1] == 'r') 70 ioctl_or_perror_and_die(fd,
71 || !ENABLE_FDFLUSH ? BLKFLSBUF : FDFLUSH, NULL, "%s", argv[1]); 71 ((ENABLE_FREERAMDISK && applet_name[1] == 'r') || !ENABLE_FDFLUSH)
72 ? BLKFLSBUF
73 : FDFLUSH,
74 NULL, "%s", argv[1]
75 );
72 76
73 if (ENABLE_FEATURE_CLEAN_UP) close(fd); 77 if (ENABLE_FEATURE_CLEAN_UP) close(fd);
74 78
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-18 13:30:06 +0000