FHS: Allow /usr/src/kernel

This directory and it's subdirectories will contain the source code
and helper scripts/binaries of the current compiled kernel.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire_format_time(): Fix typo

Fix a small typo when displaying the build time
which is longer than 1 hour.

In such a case the following message got displayed:

Build successfully completed in 01m07m02s

Which should be 01h07m02s

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Allow /var/mail owned by root:mail

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

archive: Return a file descriptor for any archive files

This is a lot more handy for us later on when we are dealing with any of
the payload which might potentially larger as it can now be read bit by
bit.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Drop /usr/bin/su from list of allowed SUID binaries

In the Makefile (util-linx.nm) we specify some capabilities to avoid setting
the suid bit.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

archive: Silently ignore if systemd-sysusers could not be executed

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

jail: Move flags to individual exec commands

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strip: Apply hack to preserve capabilities

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

parser: Free regular expressions

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Allow gpasswd, ksu and pkexec to have the setuid bit set

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Fix setuid check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Silence a warning as it gets in the way of the progress bar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Allow installing kernel source in /usr/src

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Check for capabilities being applied to non-executable files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

transaction: Automatically create system users

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tests: Check if relative/absolute paths confuse pakfire_path_match

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

jail: Log the path of the command we tried to execute

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

systemd: Automatically apply tmpfiles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

packages: Fail match if we could not parse the dependency

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Export capabilities in Python

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Write capabilities

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Read capabilities

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Drop limitation for only non-executable files in /usr/share

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Allow dotfiles in /root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Allow some setuid binaries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

jail: Allow setting file capabilities in the jail

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

macros: Define docdir

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop old hardening check script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Tidy up the RPATH checking code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Extend RELRO check to check for BIND_NOW

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Pass Dyn tag to the callback function

Some values are not considered to be strings.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop old RPATH check script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Implement RPATH/RUNPATH check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Make fetch more information from ELF sections easier

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Unify fetching ELF sections

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Rename NO-* flags to MISSING-*

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Do not perform BUILDROOT check on Python bytecode files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

filelist: Add option to show a progressbar

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

filelist: Add flags argument to walk function

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Perform world writable check only for regular files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

macros: Define tmpfilesdir

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Add /root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Set r if file could not be opened

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

files: Skip payload check for empty files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Do not check for ELF status again when dumping issues

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Move strip check into file check

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Rename hardening check to just check

That way, we can include some checks that are not too closely related to
any hardening issues.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Move FHS check into hardening checks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Check for world-writable files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: Fix path pattern matching with characters after stars

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Remove forgotten debug statements

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Perform BUILDROOT check in C

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Check for correct location and permission of shared objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tests: Add check for pakfire_path_match with stars in middle

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Fix indentation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Do not allow any executable files in /var

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Do not allow any executable files in /usr/share

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: All files in /boot must be owned by root

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Ensure that firmware files are not executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Rearrange the matrix

No functional changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Drop check-include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Check permissions of files in /usr/include

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Do not allow any unknown subdirectories in /var

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Enfore that all files in /usr/*bin are executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Do not allow any subdirectories in /usr/bin & /usr/sbin

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Implement being able to check for file type

This allows us a more granular filtering

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Do not allow any more files in /usr and /usr/src

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Implement checking file ownerships

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Drop check-libraries script

This is now covered by the new builtin FHS check.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Drop old FHS script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

FHS: Implement some simple filesystem checks

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: path_matches: Check if pattern is shorter than string

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util: Implement a simple path matching function that supports **

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

arch: Drop support for all 32 bit architectures

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

compress: Fix wrong variable in threads code

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

packager: Don't initialize an unsigned integer with -1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

compress: Enable parallel compression for Zstandard if available

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

compress: Create a unified function to create archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

snapshots: Call it store/restore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

snapshots: Do not modify an existing snapshot

Instead, the routines will now write the new snapshot to a temporary
location and replace it more or less atomically.

Fixes: #13045 - Multiple concurrent instances can destroy the snapshot
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "snapshots: Pass path instead of file descriptor"

This reverts commit 4667a2ca811f6f2b20c1cfb3223dd8b90af4952c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

compress: Do not overwrite configuration on extraction

This is somewhat experimental and I would need to think a little bit
more about this.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

jail: Enable all QEMU CPU features by default

When we are emulating a different architecture, QEMU by default emulates
a very basic processor which might not be able to emulate for example
SIMD instructions.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Mark files as executable

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Rename extension check to patterns

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Do not check for SSP for runtime linkers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python: Release and acquire the GIL when we need it

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Dump the complete filelist

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

compress: Resolve hardlinks when writing archives

Fixes: #13014
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Correctly fail PIE test

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Show build time at the end

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

string: Add function to format elapsed time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Perform magic check for all files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Skip hardening checks for firmware files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

CFLAGS: Move string formatting stuff into an extra variable

That way, we can clear it easily.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Disable all hardening checks for Relocatable Objects

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Skip SSP check for data libraries

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

build: Implement marking configuration files in archives

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Fix digest comment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

file: Add missing return type

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>