Minix/minix
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

pkgsrc pkg_install tools, ported by Gautam Tirumala.

Browse Source
This commit is contained in:
Ben Gras
2010-07-16 00:15:25 +00:00
parent 0f7365e6af
commit 7e8ed05df4
92 changed files with 20722 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
commands/pkg_install/admin/Makefile Normal file
View File

@@ -0,0 +1,8 @@
PROG= pkg_admin
SCRIPTS= audit-packages download-vulnerability-list
FILES=
SRCS= main.c audit.c check.c
MAN= pkg_admin.1 download-vulnerability-list.8 audit-packages.8
.include "../Makefile.inc"
.include <bsd.prog.mk>

39
commands/pkg_install/admin/admin.h Normal file
View File

@@ -0,0 +1,39 @@
/*-
* Copyright (c) 2008 The NetBSD Foundation, Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
extern int quiet;
extern int verbose;
void check(char **);
void audit_pkgdb(int, char **);
void audit_pkg(int, char **);
void audit_batch(int, char **);
void audit_history(int, char **);
void check_pkg_vulnerabilities(int, char **);
void fetch_pkg_vulnerabilities(int, char **);
void usage(void);

130
commands/pkg_install/admin/audit-packages Normal file
View File

@@ -0,0 +1,130 @@
#!/bin/sh
pkg_admin=/usr/bin/sbin/pkg_admin
usage() {
echo 'Usage: audit-packages [-deqsVv] [-c config_file] [-F file]' >& $2
echo ' [-g file] [-h file]' >& $2
echo ' [-K pkg_dbdir] [-n package] [-p package]' >& $2
echo ' [-Q varname] [-t type]' >& $2
echo "Please use the audit, audit-pkg, audit-batch and fetch-pkg-vulnerabilities" >& $2
echo "commands of pkg_admin instead." >& $2
exit $1
}
do_pkgdb=
do_eol=
do_fetch=
do_quiet=
do_sign=
do_verbose=
do_check_file=
do_check_pattern=
do_check_installed=
do_check_vul_file=
do_limit_type=
do_print_var=
args=`getopt F:K:Q:Vc:deg:h:n:p:qst:v $*`
if [ $? -ne 0 ]; then
usage 1 2
fi
set -- $args
while [ $# -gt 0 ]; do
case "$1" in
-F)
do_check_file=$2
shift
;;
-K)
do_pkgdb="$1 $2"
shift
;;
-Q)
do_print_var="$2"
shift
;;
-V)
exec ${pkg_admin} -V
;;
-c)
echo "The audit-packages wrapper does not support -c" >&2
echo "Please use the audit, audit-pkg, audit-batch and fetch-pkg-vulnerabilities" >& 2
echo "commands of pkg_admin instead." >& 2
exit 1
;;
-d)
do_fetch=1
;;
-e)
do_eol=-e
;;
-g)
echo "The audit-packages wrapper does not support -g" >&2
echo "Please switch to \`\`pkg_admin fetch-pkg-vulnerabilities''." >&2
exit 1
;;
-h)
do_check_vul_file=$2
shift
;;
-n)
do_check_pattern=$2
shift
;;
-p)
do_check_installed=$2
shift
;;
-q)
do_quiet=-q
;;
-s)
do_sign=-s
;;
-t)
do_limit_type="-t $2"
shift
;;
-v)
do_verbose="$do_verbose -v"
;;
esac
shift
done
if [ -n "${do_fetch}" ]; then
exec ${pkg_admin} ${do_pkgdb} fetch-pkg-vulnerabilities ${do_sign}
fi
if [ -n "${do_check_vul_file}" ]; then
exec ${pkg_admin} ${do_pkgdb} check-pkg-vulnerabilities ${do_sign} "${do_check_vul_file}"
fi
if [ -n "${do_print_var}" ]; then
exec ${pkg_admin} ${do_pkgdb} config-var "${do_print_var}"
fi
if [ -n "${do_check_file}" ]; then
if [ -n "${do_check_pattern}" -o -n "${do_check_installed}" ]; then
echo "Only one of -F, -n or -p is interpreted at a time." >& 2
usage 1 2
fi
exec ${pkg_admin} ${do_pkgdb} ${do_verbose} ${do_quiet} audit-pkg \
${do_eol} ${do_limit_type} ${do_check_file}
fi
if [ -n "${do_check_pattern}" ]; then
if [ -n "${do_check_installed}" ]; then
echo "Only one of -F, -n or -p is interpreted at a time." >& 2
usage 1 2
fi
exec ${pkg_admin} ${do_pkgdb} ${do_verbose} ${do_quiet} audit-pkg \
${do_eol} ${do_limit_type} ${do_check_pattern}
fi
# If do_check_installed is empty, all packages are checked.
exec ${pkg_admin} ${do_pkgdb} ${do_verbose} ${do_quiet} audit \
${do_eol} ${do_limit_type} ${do_check_installed}

66
commands/pkg_install/admin/audit-packages.8 Normal file
View File

@@ -0,0 +1,66 @@
.\" $NetBSD: audit-packages.8,v 1.1 2010/03/19 12:49:53 wiz Exp $
.\"
.\" Copyright (c) 2010 The NetBSD Foundation, Inc.
.\" All rights reserved.
.\"
.\" This code is derived from software contributed to The NetBSD Foundation
.\" by Thomas Klausner.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd March 18, 2010
.Dt AUDIT-PACKAGES 8
.Os
.Sh NAME
.Nm audit-packages
.Nd report vulnerabilities for the installed packages
.Sh SYNOPSIS
.Nm
.Op Fl deqsVv
.Op Fl c Ar config_file
.Op Fl F Ar file
.Op Fl g Ar file
.Op Fl h Ar file
.Op Fl K Ar pkg_dbdir
.Op Fl n Ar package
.Op Fl p Ar package
.Op Fl Q Ar varname
.Op Fl t Ar type
.Sh DESCRIPTION
.Nm
is deprecated.
Please use the
.Cm audit ,
.Cm audit-pkg ,
.Cm audit-batch ,
and
.Cm fetch-pkg-vulnerabilities
commands of
.Xr pkg_admin 1
instead.
.Pp
The
.Nm
script is installed for backwards compatibility only and will
eventually be removed.
.Sh SEE ALSO
.Xr pkg_admin 1

508
commands/pkg_install/admin/audit.c Normal file
View File

@@ -0,0 +1,508 @@
/* $NetBSD: audit.c,v 1.16 2010/06/16 23:02:48 joerg Exp $ */
#if HAVE_CONFIG_H
#include "config.h"
#endif
#ifndef __minix
#include <nbcompat.h>
#endif
#if HAVE_SYS_CDEFS_H
#include <sys/cdefs.h>
#endif
#ifndef __minix
__RCSID("$NetBSD: audit.c,v 1.16 2010/06/16 23:02:48 joerg Exp $");
#endif
/*-
* Copyright (c) 2008 Joerg Sonnenberger <joerg@NetBSD.org>.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#if HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#if HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
#if HAVE_ERR_H
#include <err.h>
#endif
#if HAVE_ERRNO_H
#include <errno.h>
#endif
#if HAVE_FCNTL_H
#include <fcntl.h>
#endif
#if HAVE_SIGNAL_H
#include <signal.h>
#endif
#if HAVE_STDIO_H
#include <stdio.h>
#endif
#if HAVE_STRING_H
#include <string.h>
#endif
#if HAVE_TIME_H
#include <time.h>
#endif
#if defined(NETBSD) || defined(__minix)
#include <unistd.h>
#else
#include <nbcompat/unistd.h>
#endif
#include <fetch.h>
#include "admin.h"
#include "lib.h"
static int check_signature = 0;
static const char *limit_vul_types = NULL;
static int update_pkg_vuln = 0;
static struct pkg_vulnerabilities *pv;
static const char audit_options[] = "est:";
static void
parse_options(int argc, char **argv, const char *options)
{
int ch;
optreset = 1;
/*
* optind == 0 is interpreted as partial reset request
* by GNU getopt, so compensate against this and cleanup
* at the end.
*/
optind = 1;
++argc;
--argv;
while ((ch = getopt(argc, argv, options)) != -1) {
switch (ch) {
case 'e':
check_eol = "yes";
break;
case 's':
check_signature = 1;
break;
case 't':
limit_vul_types = optarg;
break;
case 'u':
update_pkg_vuln = 1;
break;
default:
usage();
/* NOTREACHED */
}
}
--optind; /* See above comment. */
}
static int
check_exact_pkg(const char *pkg)
{
return audit_package(pv, pkg, limit_vul_types, quiet ? 0 : 1);
}
static int
check_batch_exact_pkgs(const char *fname)
{
FILE *f;
char buf[4096], *line, *eol;
int ret;
ret = 0;
if (strcmp(fname, "-") == 0)
f = stdin;
else {
f = fopen(fname, "r");
if (f == NULL)
err(EXIT_FAILURE, "Failed to open input file %s",
fname);
}
while ((line = fgets(buf, sizeof(buf), f)) != NULL) {
eol = line + strlen(line);
if (eol == line)
continue;
--eol;
if (*eol == '\n') {
if (eol == line)
continue;
*eol = '\0';
}
ret |= check_exact_pkg(line);
}
if (f != stdin)
fclose(f);
return ret;
}
static int
check_one_installed_pkg(const char *pkg, void *cookie)
{
int *ret = cookie;
*ret |= check_exact_pkg(pkg);
return 0;
}
static int
check_installed_pattern(const char *pattern)
{
int ret = 0;
match_installed_pkgs(pattern, check_one_installed_pkg, &ret);
return ret;
}
static void
check_and_read_pkg_vulnerabilities(void)
{
struct stat st;
time_t now;
if (pkg_vulnerabilities_file == NULL)
errx(EXIT_FAILURE, "PKG_VULNERABILITIES is not set");
if (verbose >= 1) {
if (stat(pkg_vulnerabilities_file, &st) == -1) {
if (errno == ENOENT)
errx(EXIT_FAILURE,
"pkg-vulnerabilities not found, run %s -d",
getprogname());
errx(EXIT_FAILURE, "pkg-vulnerabilities not readable");
}
now = time(NULL);
now -= st.st_mtime;
if (now < 0)
warnx("pkg-vulnerabilities is from the future");
else if (now > 86400 * 7)
warnx("pkg-vulnerabilities is out of date (%ld days old)",
(long)(now / 86400));
else if (verbose >= 2)
warnx("pkg-vulnerabilities is %ld day%s old",
(long)(now / 86400), now / 86400 == 1 ? "" : "s");
}
pv = read_pkg_vulnerabilities_file(pkg_vulnerabilities_file, 0, check_signature);
}
void
audit_pkgdb(int argc, char **argv)
{
int rv;
parse_options(argc, argv, audit_options);
argv += optind;
check_and_read_pkg_vulnerabilities();
rv = 0;
if (*argv == NULL)
rv |= check_installed_pattern("*");
else {
for (; *argv != NULL; ++argv)
rv |= check_installed_pattern(*argv);
}
free_pkg_vulnerabilities(pv);
if (rv == 0 && verbose >= 1)
fputs("No vulnerabilities found\n", stderr);
exit(rv ? EXIT_FAILURE : EXIT_SUCCESS);
}
void
audit_pkg(int argc, char **argv)
{
int rv;
parse_options(argc, argv, audit_options);
argv += optind;
check_and_read_pkg_vulnerabilities();
rv = 0;
for (; *argv != NULL; ++argv)
rv |= check_exact_pkg(*argv);
free_pkg_vulnerabilities(pv);
if (rv == 0 && verbose >= 1)
fputs("No vulnerabilities found\n", stderr);
exit(rv ? EXIT_FAILURE : EXIT_SUCCESS);
}
void
audit_batch(int argc, char **argv)
{
int rv;
parse_options(argc, argv, audit_options);
argv += optind;
check_and_read_pkg_vulnerabilities();
rv = 0;
for (; *argv != NULL; ++argv)
rv |= check_batch_exact_pkgs(*argv);
free_pkg_vulnerabilities(pv);
if (rv == 0 && verbose >= 1)
fputs("No vulnerabilities found\n", stderr);
exit(rv ? EXIT_FAILURE : EXIT_SUCCESS);
}
void
check_pkg_vulnerabilities(int argc, char **argv)
{
parse_options(argc, argv, "s");
if (argc != optind + 1)
usage();
pv = read_pkg_vulnerabilities_file(argv[optind], 0, check_signature);
free_pkg_vulnerabilities(pv);
}
void
fetch_pkg_vulnerabilities(int argc, char **argv)
{
struct pkg_vulnerabilities *pv_check;
char *buf;
size_t buf_len, buf_fetched;
ssize_t cur_fetched;
struct url *url;
struct url_stat st;
fetchIO *f;
int fd;
struct stat sb;
char my_flags[20];
const char *flags;
parse_options(argc, argv, "su");
if (argc != optind)
usage();
if (verbose >= 2)
fprintf(stderr, "Fetching %s\n", pkg_vulnerabilities_url);
url = fetchParseURL(pkg_vulnerabilities_url);
if (url == NULL)
errx(EXIT_FAILURE,
"Could not parse location of pkg_vulnerabilities: %s",
fetchLastErrString);
flags = fetch_flags;
if (update_pkg_vuln) {
fd = open(pkg_vulnerabilities_file, O_RDONLY);
if (fd != -1 && fstat(fd, &sb) != -1) {
url->last_modified = sb.st_mtime;
snprintf(my_flags, sizeof(my_flags), "%si",
fetch_flags);
flags = my_flags;
} else
update_pkg_vuln = 0;
if (fd != -1)
close(fd);
}
f = fetchXGet(url, &st, flags);
if (f == NULL && update_pkg_vuln &&
fetchLastErrCode == FETCH_UNCHANGED) {
if (verbose >= 1)
fprintf(stderr, "%s is not newer\n",
pkg_vulnerabilities_url);
exit(EXIT_SUCCESS);
}
if (f == NULL)
errx(EXIT_FAILURE, "Could not fetch vulnerability file: %s",
fetchLastErrString);
/*
if (st.size > SSIZE_MAX - 1)
errx(EXIT_FAILURE, "pkg-vulnerabilities is too large");
*/
buf_len = st.size;
buf = xmalloc(buf_len + 1);
buf_fetched = 0;
while (buf_fetched < buf_len) {
cur_fetched = fetchIO_read(f, buf + buf_fetched,
buf_len - buf_fetched);
if (cur_fetched == 0)
errx(EXIT_FAILURE,
"Truncated pkg-vulnerabilities received");
else if (cur_fetched == -1)
errx(EXIT_FAILURE,
"IO error while fetching pkg-vulnerabilities: %s",
fetchLastErrString);
buf_fetched += cur_fetched;
}
buf[buf_len] = '\0';
pv_check = read_pkg_vulnerabilities_memory(buf, buf_len, check_signature);
free_pkg_vulnerabilities(pv_check);
fd = open(pkg_vulnerabilities_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
if (fd == -1)
err(EXIT_FAILURE, "Cannot create pkg-vulnerability file %s",
pkg_vulnerabilities_file);
if (write(fd, buf, buf_len) != (ssize_t)buf_len)
err(EXIT_FAILURE, "Cannot write pkg-vulnerability file");
if (close(fd) == -1)
err(EXIT_FAILURE, "Cannot close pkg-vulnerability file after write");
free(buf);
exit(EXIT_SUCCESS);
}
static int
check_pkg_history_pattern(const char *pkg, const char *pattern)
{
const char *delim, *end_base;
if ((delim = strchr(pattern, '*')) != NULL) {
if ((end_base = strrchr(pattern, '-')) == NULL)
errx(EXIT_FAILURE, "Missing - in wildcard pattern %s",
pattern);
if ((delim = strchr(pattern, '>')) != NULL ||
(delim = strchr(pattern, '<')) != NULL)
errx(EXIT_FAILURE,
"Mixed relational and wildcard patterns in %s",
pattern);
} else if ((delim = strchr(pattern, '>')) != NULL) {
end_base = delim;
if ((delim = strchr(pattern, '<')) != NULL && delim < end_base)
errx(EXIT_FAILURE, "Inverted operators in %s",
pattern);
} else if ((delim = strchr(pattern, '<')) != NULL) {
end_base = delim;
} else if ((end_base = strrchr(pattern, '-')) == NULL) {
errx(EXIT_FAILURE, "Missing - in absolute pattern %s",
pattern);
}
if (strncmp(pkg, pattern, end_base - pattern) != 0)
return 0;
if (pkg[end_base - pattern] != '\0')
return 0;
return 1;
}
static int
check_pkg_history1(const char *pkg, const char *pattern)
{
const char *open_brace, *close_brace, *inner_brace, *suffix, *iter;
size_t prefix_len, suffix_len, middle_len;
char *expanded_pkg;
open_brace = strchr(pattern, '{');
if (open_brace == NULL) {
if ((close_brace = strchr(pattern, '}')) != NULL)
errx(EXIT_FAILURE, "Unbalanced {} in pattern %s",
pattern);
return check_pkg_history_pattern(pkg, pattern);
}
close_brace = strchr(open_brace, '}');
if (strchr(pattern, '}') != close_brace)
errx(EXIT_FAILURE, "Unbalanced {} in pattern %s",
pattern);
while ((inner_brace = strchr(open_brace + 1, '{')) != NULL) {
if (inner_brace >= close_brace)
break;
open_brace = inner_brace;
}
expanded_pkg = xmalloc(strlen(pattern)); /* {} are going away... */
prefix_len = open_brace - pattern;
suffix = close_brace + 1;
suffix_len = strlen(suffix) + 1;
memcpy(expanded_pkg, pattern, prefix_len);
++open_brace;
do {
iter = strchr(open_brace, ',');
if (iter == NULL || iter > close_brace)
iter = close_brace;
middle_len = iter - open_brace;
memcpy(expanded_pkg + prefix_len, open_brace, middle_len);
memcpy(expanded_pkg + prefix_len + middle_len, suffix,
suffix_len);
if (check_pkg_history1(pkg, expanded_pkg)) {
free(expanded_pkg);
return 1;
}
open_brace = iter + 1;
} while (iter < close_brace);
free(expanded_pkg);
return 0;
}
static void
check_pkg_history(const char *pkg)
{
size_t i;
for (i = 0; i < pv->entries; ++i) {
if (!quick_pkg_match(pv->vulnerability[i], pkg))
continue;
if (strcmp("eol", pv->classification[i]) == 0)
continue;
if (check_pkg_history1(pkg, pv->vulnerability[i]) == 0)
continue;
printf("%s %s %s\n", pv->vulnerability[i],
pv->classification[i], pv->advisory[i]);
}
}
void
audit_history(int argc, char **argv)
{
parse_options(argc, argv, "st:");
argv += optind;
check_and_read_pkg_vulnerabilities();
for (; *argv != NULL; ++argv)
check_pkg_history(*argv);
free_pkg_vulnerabilities(pv);
exit(EXIT_SUCCESS);
}

263
commands/pkg_install/admin/check.c Normal file
View File

@@ -0,0 +1,263 @@
/* $NetBSD: check.c,v 1.10 2010/01/22 13:30:41 joerg Exp $ */
#if HAVE_CONFIG_H
#include "config.h"
#endif
#ifndef __minix
#include <nbcompat.h>
#endif
#if HAVE_SYS_CDEFS_H
#include <sys/cdefs.h>
#endif
#ifndef __minix
__RCSID("$NetBSD: check.c,v 1.10 2010/01/22 13:30:41 joerg Exp $");
#endif
/*-
* Copyright (c) 1999-2008 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Hubert Feyrer <hubert@feyrer.de>.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#if HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#if HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
#if HAVE_DIRENT_H
#include <dirent.h>
#endif
#if HAVE_ERR_H
#include <err.h>
#endif
#if HAVE_ERRNO_H
#include <errno.h>
#endif
#if HAVE_FCNTL_H
#include <fcntl.h>
#endif
#if !defined(NETBSD) && !defined(__minix)
#include <nbcompat/md5.h>
#else
#include <minix/md5.h>
#endif
#if HAVE_LIMITS_H
#include <limits.h>
#endif
#if HAVE_STDIO_H
#include <stdio.h>
#endif
#if HAVE_STRING_H
#include <string.h>
#endif
#include "admin.h"
#include "lib.h"
static int checkpattern_fn(const char *, void *);
/*
* Assumes CWD is in /var/db/pkg/<pkg>!
*/
static void
check1pkg(const char *pkgdir, int *filecnt, int *pkgcnt)
{
FILE *f;
plist_t *p;
package_t Plist;
char *PkgName, *dirp = NULL, *md5file;
char file[MaxPathSize];
char *content;
content = pkgdb_pkg_file(pkgdir, CONTENTS_FNAME);
f = fopen(content, "r");
if (f == NULL)
err(EXIT_FAILURE, "can't open %s", content);
free(content);
read_plist(&Plist, f);
p = find_plist(&Plist, PLIST_NAME);
if (p == NULL)
errx(EXIT_FAILURE, "Package %s has no @name, aborting.",
pkgdir);
PkgName = p->name;
for (p = Plist.head; p; p = p->next) {
switch (p->type) {
case PLIST_FILE:
if (dirp == NULL) {
warnx("dirp not initialized, please send-pr!");
abort();
}
(void) snprintf(file, sizeof(file), "%s/%s", dirp, p->name);
if (isfile(file) || islinktodir(file)) {
if (p->next && p->next->type == PLIST_COMMENT) {
if (strncmp(p->next->name, CHECKSUM_HEADER, ChecksumHeaderLen) == 0) {
if ((md5file = MD5File(file, NULL)) != NULL) {
/* Mismatch? */
if (strcmp(md5file, p->next->name + ChecksumHeaderLen) != 0)
printf("%s fails MD5 checksum\n", file);
free(md5file);
}
} else if (strncmp(p->next->name, SYMLINK_HEADER, SymlinkHeaderLen) == 0) {
char buf[MaxPathSize + SymlinkHeaderLen];
int cc;
(void) strlcpy(buf, SYMLINK_HEADER, sizeof(buf));
if ((cc = readlink(file, &buf[SymlinkHeaderLen],
sizeof(buf) - SymlinkHeaderLen - 1)) < 0) {
warnx("can't readlink `%s'", file);
} else {
buf[SymlinkHeaderLen + cc] = 0x0;
if (strcmp(buf, p->next->name) != 0) {
printf("symlink (%s) is not same as recorded value, %s: %s\n",
file, buf, p->next->name);
}
}
}
}
(*filecnt)++;
} else if (isbrokenlink(file)) {
warnx("%s: Symlink `%s' exists and is in %s but target does not exist!", PkgName, file, CONTENTS_FNAME);
} else {
warnx("%s: File `%s' is in %s but not on filesystem!", PkgName, file, CONTENTS_FNAME);
}
break;
case PLIST_CWD:
if (strcmp(p->name, ".") != 0)
dirp = p->name;
else
dirp = pkgdb_pkg_dir(pkgdir);
break;
case PLIST_IGNORE:
p = p->next;
break;
case PLIST_SHOW_ALL:
case PLIST_SRC:
case PLIST_CMD:
case PLIST_CHMOD:
case PLIST_CHOWN:
case PLIST_CHGRP:
case PLIST_COMMENT:
case PLIST_NAME:
case PLIST_UNEXEC:
case PLIST_DISPLAY:
case PLIST_PKGDEP:
case PLIST_DIR_RM:
case PLIST_OPTION:
case PLIST_PKGCFL:
case PLIST_BLDDEP:
case PLIST_PKGDIR:
break;
}
}
free_plist(&Plist);
fclose(f);
(*pkgcnt)++;
}
struct checkpattern_arg {
int filecnt;
int pkgcnt;
int got_match;
};
static int
checkpattern_fn(const char *pkg, void *vp)
{
struct checkpattern_arg *arg = vp;
check1pkg(pkg, &arg->filecnt, &arg->pkgcnt);
if (!quiet)
printf(".");
arg->got_match = 1;
return 0;
}
static void
check_pkg(const char *pkg, int *filecnt, int *pkgcnt, int allow_unmatched)
{
struct checkpattern_arg arg;
char *pattern;
arg.filecnt = *filecnt;
arg.pkgcnt = *pkgcnt;
arg.got_match = 0;
if (match_installed_pkgs(pkg, checkpattern_fn, &arg) == -1)
errx(EXIT_FAILURE, "Cannot process pkdbdb");
if (arg.got_match != 0) {
*filecnt = arg.filecnt;
*pkgcnt = arg.pkgcnt;
return;
}
if (ispkgpattern(pkg)) {
if (allow_unmatched)
return;
errx(EXIT_FAILURE, "No matching pkg for %s.", pkg);
}
pattern = xasprintf("%s-[0-9]*", pkg);
if (match_installed_pkgs(pattern, checkpattern_fn, &arg) == -1)
errx(EXIT_FAILURE, "Cannot process pkdbdb");
if (arg.got_match == 0)
errx(EXIT_FAILURE, "cannot find package %s", pkg);
free(pattern);
*filecnt = arg.filecnt;
*pkgcnt = arg.pkgcnt;
}
void
check(char **argv)
{
int filecnt, pkgcnt;
filecnt = 0;
pkgcnt = 0;
setbuf(stdout, NULL);
if (*argv == NULL) {
check_pkg("*", &filecnt, &pkgcnt, 1);
} else {
for (; *argv != NULL; ++argv)
check_pkg(*argv, &filecnt, &pkgcnt, 0);
}
printf("\n");
printf("Checked %d file%s from %d package%s.\n",
filecnt, (filecnt == 1) ? "" : "s",
pkgcnt, (pkgcnt == 1) ? "" : "s");
}

37
commands/pkg_install/admin/download-vulnerability-list Normal file
View File

@@ -0,0 +1,37 @@
#!/bin/sh
pkg_admin=/usr/bin/sbin/pkg_admin
usage() {
echo 'Usage: download-vulnerability-list [-hs] [-c config_file]' >& $2
echo "Please use \`\`pkg_admin fetch-pkg-vulnerabilities'' instead." >& $2
exit $1
}
do_sign=
args=`getopt c:hs $*`
if [ $? -ne 0 ]; then
usage 1 2
fi
set -- $args
while [ $# -gt 0 ]; do
case "$1" in
-c)
echo "The download-vulnerability-list wrapper does not support -c" >&2
echo "Please switch to \`\`pkg_admin fetch-pkg-vulnerabilities''." >&2
exit 1
;;
-h)
usage 0 1
;;
-s)
do_sign=-s
;;
esac
shift
done
exec ${pkg_admin} fetch-pkg-vulnerabilities ${do_sign}

54
commands/pkg_install/admin/download-vulnerability-list.8 Normal file
View File

@@ -0,0 +1,54 @@
.\" $NetBSD: download-vulnerability-list.8,v 1.1 2010/03/19 12:49:53 wiz Exp $
.\"
.\" Copyright (c) 2010 The NetBSD Foundation, Inc.
.\" All rights reserved.
.\"
.\" This code is derived from software contributed to The NetBSD Foundation
.\" by Thomas Klausner.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd March 18, 2010
.Dt DOWNLOAD-VULNERABILITY-LIST 8
.Os
.Sh NAME
.Nm download-vulnerability-list
.Nd download vulnerability list used for checking installed packages
.Sh SYNOPSIS
.Nm
.Op Fl hs
.Op Fl c Ar config_file
.Sh DESCRIPTION
.Nm
is deprecated.
Please use the
.Cm fetch-pkg-vulnerabilities
command of
.Xr pkg_admin 1
instead.
.Pp
The
.Nm
script is installed for backwards compatibility only and will
eventually be removed.
.Sh SEE ALSO
.Xr pkg_admin 1

758
commands/pkg_install/admin/main.c Normal file
View File

@@ -0,0 +1,758 @@
/* $NetBSD: main.c,v 1.61 2010/04/20 00:39:13 joerg Exp $ */
#if HAVE_CONFIG_H
#include "config.h"
#endif
#ifndef __minix
#include <nbcompat.h>
#endif
#if HAVE_SYS_CDEFS_H
#include <sys/cdefs.h>
#endif
#ifndef __minix
__RCSID("$NetBSD: main.c,v 1.61 2010/04/20 00:39:13 joerg Exp $");
#endif
/*-
* Copyright (c) 1999-2009 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Hubert Feyrer <hubert@feyrer.de> and
* by Joerg Sonnenberger <joerg@NetBSD.org>.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#if HAVE_SYS_TYPES_H
#include <sys/types.h>
#endif
#if HAVE_SYS_STAT_H
#include <sys/stat.h>
#endif
#if HAVE_DIRENT_H
#include <dirent.h>
#endif
#if HAVE_ERR_H
#include <err.h>
#endif
#if HAVE_ERRNO_H
#include <errno.h>
#endif
#if HAVE_FCNTL_H
#include <fcntl.h>
#endif
#if !defined(NETBSD) && !defined(__minix)
#include <nbcompat/md5.h>
#else
#include <minix/md5.h>
#endif
#if HAVE_LIMITS_H
#include <limits.h>
#endif
#if HAVE_STDIO_H
#include <stdio.h>
#endif
#if HAVE_STRING_H
#include <string.h>
#endif
#ifndef BOOTSTRAP
#include <archive.h>
#include <fetch.h>
#endif
#include "admin.h"
#include "lib.h"
#define DEFAULT_SFX ".t[bg]z" /* default suffix for ls{all,best} */
struct pkgdb_count {
size_t files;
size_t directories;
size_t packages;
};
static const char Options[] = "C:K:SVbd:qs:v";
int quiet, verbose;
static void set_unset_variable(char **, Boolean);
/* print usage message and exit */
void
usage(void)
{
(void) fprintf(stderr, "usage: %s [-bqSVv] [-C config] [-d lsdir] [-K pkg_dbdir] [-s sfx] command [args ...]\n"
"Where 'commands' and 'args' are:\n"
" rebuild - rebuild pkgdb from +CONTENTS files\n"
" rebuild-tree - rebuild +REQUIRED_BY files from forward deps\n"
" check [pkg ...] - check md5 checksum of installed files\n"
" add pkg ... - add pkg files to database\n"
" delete pkg ... - delete file entries for pkg in database\n"
" set variable=value pkg ... - set installation variable for package\n"
" unset variable pkg ... - unset installation variable for package\n"
" lsall /path/to/pkgpattern - list all pkgs matching the pattern\n"
" lsbest /path/to/pkgpattern - list pkgs matching the pattern best\n"
" dump - dump database\n"
" pmatch pattern pkg - returns true if pkg matches pattern, otherwise false\n"
" fetch-pkg-vulnerabilities [-s] - fetch new vulnerability file\n"
" check-pkg-vulnerabilities [-s] <file> - check syntax and checksums of the vulnerability file\n"
" audit [-es] [-t type] ... - check installed packages for vulnerabilities\n"
" audit-pkg [-es] [-t type] ... - check listed packages for vulnerabilities\n"
" audit-batch [-es] [-t type] ... - check packages in listed files for vulnerabilities\n"
" audit-history [-t type] ... - print all advisories for package names\n"
" check-license <condition> - check if condition is acceptable\n"
" check-single-license <license> - check if license is acceptable\n"
" config-var name - print current value of the configuration variable\n"
" check-signature ... - verify the signature of packages\n"
" x509-sign-package pkg spkg key cert - create X509 signature\n"
" gpg-sign-package pkg spkg - create GPG signature\n",
getprogname());
exit(EXIT_FAILURE);
}
/*
* add1pkg(<pkg>)
* adds the files listed in the +CONTENTS of <pkg> into the
* pkgdb.byfile.db database file in the current package dbdir. It
* returns the number of files added to the database file.
*/
static int
add_pkg(const char *pkgdir, void *vp)
{
FILE *f;
plist_t *p;
package_t Plist;
char *contents;
char *PkgName, *dirp;
char file[MaxPathSize];
struct pkgdb_count *count;
if (!pkgdb_open(ReadWrite))
err(EXIT_FAILURE, "cannot open pkgdb");
count = vp;
++count->packages;
contents = pkgdb_pkg_file(pkgdir, CONTENTS_FNAME);
if ((f = fopen(contents, "r")) == NULL)
errx(EXIT_FAILURE, "%s: can't open `%s'", pkgdir, CONTENTS_FNAME);
free(contents);
read_plist(&Plist, f);
if ((p = find_plist(&Plist, PLIST_NAME)) == NULL) {
errx(EXIT_FAILURE, "Package `%s' has no @name, aborting.", pkgdir);
}
PkgName = p->name;
dirp = NULL;
for (p = Plist.head; p; p = p->next) {
switch(p->type) {
case PLIST_FILE:
if (dirp == NULL) {
errx(EXIT_FAILURE, "@cwd not yet found, please send-pr!");
}
(void) snprintf(file, sizeof(file), "%s/%s", dirp, p->name);
if (!(isfile(file) || islinktodir(file))) {
if (isbrokenlink(file)) {
warnx("%s: Symlink `%s' exists and is in %s but target does not exist!",
PkgName, file, CONTENTS_FNAME);
} else {
warnx("%s: File `%s' is in %s but not on filesystem!",
PkgName, file, CONTENTS_FNAME);
}
} else {
pkgdb_store(file, PkgName);
++count->files;
}
break;
case PLIST_PKGDIR:
add_pkgdir(PkgName, dirp, p->name);
++count->directories;
break;
case PLIST_CWD:
if (strcmp(p->name, ".") != 0)
dirp = p->name;
else
dirp = pkgdb_pkg_dir(pkgdir);
break;
case PLIST_IGNORE:
p = p->next;
break;
case PLIST_SHOW_ALL:
case PLIST_SRC:
case PLIST_CMD:
case PLIST_CHMOD:
case PLIST_CHOWN:
case PLIST_CHGRP:
case PLIST_COMMENT:
case PLIST_NAME:
case PLIST_UNEXEC:
case PLIST_DISPLAY:
case PLIST_PKGDEP:
case PLIST_DIR_RM:
case PLIST_OPTION:
case PLIST_PKGCFL:
case PLIST_BLDDEP:
break;
}
}
free_plist(&Plist);
fclose(f);
pkgdb_close();
return 0;
}
static void
delete1pkg(const char *pkgdir)
{
if (!pkgdb_open(ReadWrite))
err(EXIT_FAILURE, "cannot open pkgdb");
(void) pkgdb_remove_pkg(pkgdir);
pkgdb_close();
}
static void
rebuild(void)
{
char *cachename;
struct pkgdb_count count;
count.files = 0;
count.directories = 0;
count.packages = 0;
cachename = pkgdb_get_database();
if (unlink(cachename) != 0 && errno != ENOENT)
err(EXIT_FAILURE, "unlink %s", cachename);
setbuf(stdout, NULL);
iterate_pkg_db(add_pkg, &count);
printf("\n");
printf("Stored %" PRIzu " file%s and %zu explicit director%s"
" from %"PRIzu " package%s in %s.\n",
count.files, count.files == 1 ? "" : "s",
count.directories, count.directories == 1 ? "y" : "ies",
count.packages, count.packages == 1 ? "" : "s",
cachename);
}
static int
lspattern(const char *pkg, void *vp)
{
const char *dir = vp;
printf("%s/%s\n", dir, pkg);
return 0;
}
static int
lsbasepattern(const char *pkg, void *vp)
{
puts(pkg);
return 0;
}
static int
remove_required_by(const char *pkgname, void *cookie)
{
char *path;
path = pkgdb_pkg_file(pkgname, REQUIRED_BY_FNAME);
if (unlink(path) == -1 && errno != ENOENT)
err(EXIT_FAILURE, "Cannot remove %s", path);
free(path);
return 0;
}
static void
add_required_by(const char *pattern, const char *required_by)
{
char *best_installed, *path;
int fd;
size_t len;
best_installed = find_best_matching_installed_pkg(pattern);
if (best_installed == NULL) {
warnx("Dependency %s of %s unresolved", pattern, required_by);
return;
}
path = pkgdb_pkg_file(best_installed, REQUIRED_BY_FNAME);
free(best_installed);
if ((fd = open(path, O_WRONLY | O_APPEND | O_CREAT, 0644)) == -1)
errx(EXIT_FAILURE, "Cannot write to %s", path);
free(path);
len = strlen(required_by);
if (write(fd, required_by, len) != (ssize_t)len ||
write(fd, "\n", 1) != 1 ||
close(fd) == -1)
errx(EXIT_FAILURE, "Cannot write to %s", path);
}
static int
add_depends_of(const char *pkgname, void *cookie)
{
FILE *fp;
plist_t *p;
package_t plist;
char *path;
path = pkgdb_pkg_file(pkgname, CONTENTS_FNAME);
if ((fp = fopen(path, "r")) == NULL)
errx(EXIT_FAILURE, "Cannot read %s of package %s",
CONTENTS_FNAME, pkgname);
free(path);
read_plist(&plist, fp);
fclose(fp);
for (p = plist.head; p; p = p->next) {
if (p->type == PLIST_PKGDEP)
add_required_by(p->name, pkgname);
}
free_plist(&plist);
return 0;
}
static void
rebuild_tree(void)
{
if (iterate_pkg_db(remove_required_by, NULL) == -1)
errx(EXIT_FAILURE, "cannot iterate pkgdb");
if (iterate_pkg_db(add_depends_of, NULL) == -1)
errx(EXIT_FAILURE, "cannot iterate pkgdb");
}
int
main(int argc, char *argv[])
{
Boolean use_default_sfx = TRUE;
Boolean show_basename_only = FALSE;
char lsdir[MaxPathSize];
char sfx[MaxPathSize];
char *lsdirp = NULL;
int ch;
setprogname(argv[0]);
if (argc < 2)
usage();
while ((ch = getopt(argc, argv, Options)) != -1)
switch (ch) {
case 'C':
config_file = optarg;
break;
case 'K':
pkgdb_set_dir(optarg, 3);
break;
case 'S':
sfx[0] = 0x0;
use_default_sfx = FALSE;
break;
case 'V':
show_version();
/* NOTREACHED */
case 'b':
show_basename_only = TRUE;
break;
case 'd':
(void) strlcpy(lsdir, optarg, sizeof(lsdir));
lsdirp = lsdir;
break;
case 'q':
quiet = 1;
break;
case 's':
(void) strlcpy(sfx, optarg, sizeof(sfx));
use_default_sfx = FALSE;
break;
case 'v':
++verbose;
break;
default:
usage();
/* NOTREACHED */
}
argc -= optind;
argv += optind;
if (argc <= 0) {
usage();
}
/*
* config-var is reading the config file implicitly,
* so skip it here.
*/
if (strcasecmp(argv[0], "config-var") != 0)
pkg_install_config();
if (use_default_sfx)
(void) strlcpy(sfx, DEFAULT_SFX, sizeof(sfx));
if (strcasecmp(argv[0], "pmatch") == 0) {
char *pattern, *pkg;
argv++; /* "pmatch" */
if (argv[0] == NULL || argv[1] == NULL) {
usage();
}
pattern = argv[0];
pkg = argv[1];
if (pkg_match(pattern, pkg)){
return 0;
} else {
return 1;
}
} else if (strcasecmp(argv[0], "rebuild") == 0) {
rebuild();
printf("Done.\n");
} else if (strcasecmp(argv[0], "rebuild-tree") == 0) {
rebuild_tree();
printf("Done.\n");
} else if (strcasecmp(argv[0], "check") == 0) {
argv++; /* "check" */
check(argv);
if (!quiet) {
printf("Done.\n");
}
} else if (strcasecmp(argv[0], "lsall") == 0) {
argv++; /* "lsall" */
while (*argv != NULL) {
/* args specified */
int rc;
const char *basep, *dir;
dir = lsdirp ? lsdirp : dirname_of(*argv);
basep = basename_of(*argv);
if (show_basename_only)
rc = match_local_files(dir, use_default_sfx, 1, basep, lsbasepattern, NULL);
else
rc = match_local_files(dir, use_default_sfx, 1, basep, lspattern, __UNCONST(dir));
if (rc == -1)
errx(EXIT_FAILURE, "Error from match_local_files(\"%s\", \"%s\", ...)",
dir, basep);
argv++;
}
} else if (strcasecmp(argv[0], "lsbest") == 0) {
argv++; /* "lsbest" */
while (*argv != NULL) {
/* args specified */
const char *basep, *dir;
char *p;
dir = lsdirp ? lsdirp : dirname_of(*argv);
basep = basename_of(*argv);
p = find_best_matching_file(dir, basep, use_default_sfx, 1);
if (p) {
if (show_basename_only)
printf("%s\n", p);
else
printf("%s/%s\n", dir, p);
free(p);
}
argv++;
}
} else if (strcasecmp(argv[0], "list") == 0 ||
strcasecmp(argv[0], "dump") == 0) {
pkgdb_dump();
} else if (strcasecmp(argv[0], "add") == 0) {
struct pkgdb_count count;
count.files = 0;
count.directories = 0;
count.packages = 0;
for (++argv; *argv != NULL; ++argv)
add_pkg(*argv, &count);
} else if (strcasecmp(argv[0], "delete") == 0) {
argv++; /* "delete" */
while (*argv != NULL) {
delete1pkg(*argv);
argv++;
}
} else if (strcasecmp(argv[0], "set") == 0) {
argv++; /* "set" */
set_unset_variable(argv, FALSE);
} else if (strcasecmp(argv[0], "unset") == 0) {
argv++; /* "unset" */
set_unset_variable(argv, TRUE);
} else if (strcasecmp(argv[0], "config-var") == 0) {
argv++;
if (argv == NULL || argv[1] != NULL)
errx(EXIT_FAILURE, "config-var takes exactly one argument");
pkg_install_show_variable(argv[0]);
} else if (strcasecmp(argv[0], "check-license") == 0) {
if (argv[1] == NULL)
errx(EXIT_FAILURE, "check-license takes exactly one argument");
load_license_lists();
switch (acceptable_pkg_license(argv[1])) {
case 0:
puts("no");
return 0;
case 1:
puts("yes");
return 0;
case -1:
errx(EXIT_FAILURE, "invalid license condition");
}
} else if (strcasecmp(argv[0], "check-single-license") == 0) {
if (argv[1] == NULL)
errx(EXIT_FAILURE, "check-license takes exactly one argument");
load_license_lists();
switch (acceptable_license(argv[1])) {
case 0:
puts("no");
return 0;
case 1:
puts("yes");
return 0;
case -1:
errx(EXIT_FAILURE, "invalid license");
}
}
#ifndef BOOTSTRAP
else if (strcasecmp(argv[0], "findbest") == 0) {
struct url *url;
char *output;
int rc;
process_pkg_path();
rc = 0;
for (++argv; *argv != NULL; ++argv) {
url = find_best_package(NULL, *argv, 1);
if (url == NULL) {
rc = 1;
continue;
}
output = fetchStringifyURL(url);
puts(output);
fetchFreeURL(url);
free(output);
}
return rc;
} else if (strcasecmp(argv[0], "fetch-pkg-vulnerabilities") == 0) {
fetch_pkg_vulnerabilities(--argc, ++argv);
} else if (strcasecmp(argv[0], "check-pkg-vulnerabilities") == 0) {
check_pkg_vulnerabilities(--argc, ++argv);
} else if (strcasecmp(argv[0], "audit") == 0) {
audit_pkgdb(--argc, ++argv);
} else if (strcasecmp(argv[0], "audit-pkg") == 0) {
audit_pkg(--argc, ++argv);
} else if (strcasecmp(argv[0], "audit-batch") == 0) {
audit_batch(--argc, ++argv);
} else if (strcasecmp(argv[0], "audit-history") == 0) {
audit_history(--argc, ++argv);
} else if (strcasecmp(argv[0], "check-signature") == 0) {
struct archive *pkg;
int rc;
rc = 0;
for (--argc, ++argv; argc > 0; --argc, ++argv) {
char *archive_name;
pkg = open_archive(*argv, &archive_name);
if (pkg == NULL) {
warnx("%s could not be opened", *argv);
continue;
}
if (pkg_full_signature_check(archive_name, &pkg))
rc = 1;
free(archive_name);
if (!pkg)
archive_read_finish(pkg);
}
return rc;
} else if (strcasecmp(argv[0], "x509-sign-package") == 0) {
#ifdef HAVE_SSL
--argc;
++argv;
if (argc != 4)
errx(EXIT_FAILURE, "x509-sign-package takes exactly four arguments");
pkg_sign_x509(argv[0], argv[1], argv[2], argv[3]);
#else
errx(EXIT_FAILURE, "OpenSSL support is not included");
#endif
} else if (strcasecmp(argv[0], "gpg-sign-package") == 0) {
--argc;
++argv;
if (argc != 2)
errx(EXIT_FAILURE, "gpg-sign-package takes exactly two arguments");
pkg_sign_gpg(argv[0], argv[1]);
}
#endif
else {
usage();
}
return 0;
}
struct set_installed_info_arg {
char *variable;
char *value;
int got_match;
};
static int
set_installed_info_var(const char *name, void *cookie)
{
struct set_installed_info_arg *arg = cookie;
char *filename;
int retval;
filename = pkgdb_pkg_file(name, INSTALLED_INFO_FNAME);
retval = var_set(filename, arg->variable, arg->value);
free(filename);
arg->got_match = 1;
return retval;
}
static void
set_unset_variable(char **argv, Boolean unset)
{
struct set_installed_info_arg arg;
char *eq;
char *variable;
int ret = 0;
if (argv[0] == NULL || argv[1] == NULL)
usage();
variable = NULL;
if (unset) {
arg.variable = argv[0];
arg.value = NULL;
} else {
eq = NULL;
if ((eq=strchr(argv[0], '=')) == NULL)
usage();
variable = xmalloc(eq-argv[0]+1);
strlcpy(variable, argv[0], eq-argv[0]+1);
arg.variable = variable;
arg.value = eq+1;
if (strcmp(variable, AUTOMATIC_VARNAME) == 0 &&
strcasecmp(arg.value, "yes") != 0 &&
strcasecmp(arg.value, "no") != 0) {
errx(EXIT_FAILURE,
"unknown value `%s' for " AUTOMATIC_VARNAME,
arg.value);
}
}
if (strpbrk(arg.variable, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") != NULL) {
free(variable);
errx(EXIT_FAILURE,
"variable name must not contain uppercase letters");
}
argv++;
while (*argv != NULL) {
arg.got_match = 0;
if (match_installed_pkgs(*argv, set_installed_info_var, &arg) == -1)
errx(EXIT_FAILURE, "Cannot process pkdbdb");
if (arg.got_match == 0) {
char *pattern;
if (ispkgpattern(*argv)) {
warnx("no matching pkg for `%s'", *argv);
ret++;
} else {
pattern = xasprintf("%s-[0-9]*", *argv);
if (match_installed_pkgs(pattern, set_installed_info_var, &arg) == -1)
errx(EXIT_FAILURE, "Cannot process pkdbdb");
if (arg.got_match == 0) {
warnx("cannot find package %s", *argv);
++ret;
}
free(pattern);
}
}
argv++;
}
if (ret > 0)
exit(EXIT_FAILURE);
free(variable);
return;
}

322
commands/pkg_install/admin/pkg_admin.1 Normal file
View File

@@ -0,0 +1,322 @@
.\" $NetBSD: pkg_admin.1,v 1.32 2010/06/16 23:02:48 joerg Exp $
.\"
.\" Copyright (c) 1999-2010 The NetBSD Foundation, Inc.
.\" All rights reserved.
.\"
.\" This code is derived from software contributed to The NetBSD Foundation
.\" by Hubert Feyrer <hubert@feyrer.de>.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in the
.\" documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\" must display the following acknowledgement:
.\" This product includes software developed by the NetBSD
.\" Foundation, Inc. and its contributors.
.\" 4. Neither the name of The NetBSD Foundation nor the names of its
.\" contributors may be used to endorse or promote products derived
.\" from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd June 16, 2010
.Dt PKG_ADMIN 1
.Os
.Sh NAME
.Nm pkg_admin
.Nd perform various administrative tasks to the pkg system
.Sh SYNOPSIS
.Nm
.Op Fl bqSVv
.Op Fl C Ar config
.Op Fl d Ar lsdir
.Op Fl K Ar pkg_dbdir
.Op Fl s Ar sfx_pattern
.Ar command Op args ...
.Sh DESCRIPTION
This command performs various administrative tasks around the
.Nx
Packages System.
.Sh OPTIONS
The following command-line options are supported:
.Bl -tag -width indent
.It Fl b
Print only the base names when matching package names for
.Cm lsall
and
.Cm lsbest .
.It Fl C Ar config
Read the configuration file from
.Ar config
instead of the system default.
.It Fl d Ar lsdir
Set
.Ar lsdir
as the path to the directory in which to find matching package names for
.Cm lsall
and
.Cm lsbest .
.It Fl K Ar pkg_dbdir
Override the value of the
.Dv PKG_DBDIR
configuration option with the value
.Ar pkg_dbdir .
.It Fl q
Perform checks in a quiet manner.
In normal operation,
.Nm
prints a
.Sq \&.
to standard output to indicate progress.
This option suppresses this progress indicator.
.It Fl S
Set the shell glob pattern for package suffixes when matching package
names for
.Cm lsall
and
.Cm lsbest
to be the null suffix.
.It Fl s Ar sfx_pattern
Set the shell glob pattern for package suffixes when matching package
names for
.Cm lsall
and
.Cm lsbest .
The default pattern is ".t[bg]z".
.It Fl V
Print version number and exit.
.It Fl v
Be more verbose.
.El
.Pp
The following commands are supported:
.Bl -tag -width indent
.It Cm add Ar pkg ...
For each listed package, write the absolute pathnames of the files listed in
its
.Pa +CONTENTS
file together with the package they belong to into the package database.
This should be used only by
.Xr pkg_view 1 .
.It Cm audit Oo Fl es Oc Oo Fl t Ar type Oc Oo Ar pkg Oc ...
Check the listed installed packages for vulnerabilities.
If no package is given, check all installed packages.
If
.Fl e
is given, override the
.Dv CHECK_END_OF_LIFE
option from
.Xr pkg_install.conf 5
with
.Qq Li yes .
If
.Fl s
is given, check the signature of the pkg-vulnerabilities file before using it.
.Fl t
restricts the reported vulnerabilities to type
.Ar type .
.It Cm audit-pkg Oo Fl es Oc Oo Fl t Ar type Oc Oo Ar pkg Oc ...
Like
.Cm audit ,
but check only the given package names or patterns.
.It Cm audit-batch Oo Fl es Oc Oo Fl t Ar type Oc Oo Ar pkg-list Oc ...
Like
.Cm audit-pkg ,
but read the package names or patterns one per line from the given files.
.It Cm audit-history Oo Fl s Oc Oo Fl t Ar type Oc Oo Ar pkgbase Oc ...
Print all vulnerabilities for the given base package names.
.It Cm check Op Ar pkg ...
Use this command to check the files belonging to some or all of the
packages installed on the local machine against the checksum
which was recorded in the
.Pa +CONTENTS
files at package installation time.
Symbolic links also have their integrity checked against the recorded
value at package installation time.
If no additional argument is given, the files of all installed packages
are checked, else only the named packages will be checked (wildcards can
be used here, see
.Xr pkg_info 1 ) .
.Pp
The packages'
.Pa +CONTENTS
files will be parsed and the
checksum will be checked for every file found.
A warning message is printed if the expected checksum differs from the
checksum of the file on disk.
Symbolic links are also checked, ensuring that the targets on disk are
the same as the contents recorded at package installation time.
.It Cm check-license Ar condition
Check if
.Ar condition
can be fulfilled with the currently set of accepted licenses.
Prints either yes or no to stdout if the condition can be parsed,
otherwise it exits with error.
.It Cm check-pkg-vulnerabilities Oo Fl s Oc Ar file
Check format and hashes in the pkg-vulnerabilities file
.Ar file .
If
.Fl s
is given, also check the embedded signature.
.It Cm check-signature Ar file ...
Reports if
.Ar file
is a correctly signed package.
.It Cm check-single-license Ar license
Check if
.Ar license
is a valid license name and if it is in the set of acceptable licenses.
Prints either yes or no to stdout if the condition can be parsed,
otherwise it exits with error.
.It Cm config-var Ar variable
Print the current value of
.Ar variable
as used after parsing the configuration file.
.It Cm delete Ar pkg ...
For each listed package, remove all file entries in the package database that
belong to the package.
This should be used only by
.Xr pkg_view 1 .
.It Cm dump
Dump the contents of the package database, similar to
.Cm pkg_info -F .
Columns are printed for the key field used in the pkgdb - the filename -,
and the data field - the package the file belongs to.
.It Cm fetch-pkg-vulnerabilities Oo Fl su Oc
Fetch a new pkg-vulnerabilities file, check the format and if
.Fl s
is given the signature.
If all checks are passed, write it to pkgdb.
If
.Fl u
is given, the fetch is conditional and the file transfer is only done if
the remote version is newer than the one in pkgdb.
.It Cm findbest Ar pattern ...
Search the entries of
.Dv PKG_PATH
for packages matching
.Ar pattern .
Print the URL of the best matching package to stdout for each pattern.
If a pattern is not matched, it is skipped and the command will return
a failure.
.It Cm lsall Ar /dir/pkgpattern
.It Cm lsbest Ar /dir/pkgpattern
List all/best package matching pattern in the given directory
.Pa /dir .
If the
.Fl d
flag is given, then that directory path overrides
.Pa /dir .
Can be used to work around limitations of /bin/sh and other
filename globbing mechanisms.
This option implements matching of
pkg-wildcards against arbitrary files and directories, useful mainly in
the build system itself.
See
.Xr pkg_info 1
for a description of the pattern.
.Pp
Example:
.Bd -literal
yui# cd /usr/pkgsrc/packages/i386ELF/All/
yui# ls unzip*
unzip-5.40.tgz unzip-5.41.tgz
yui# pkg_admin lsall 'unzip*'
/usr/pkgsrc/packages/i386ELF/All/unzip-5.40.tgz
/usr/pkgsrc/packages/i386ELF/All/unzip-5.41.tgz
yui# pkg_admin lsall 'unzip\*[Ge]5.40'
/usr/pkgsrc/packages/i386ELF/All/unzip-5.40.tgz
/usr/pkgsrc/packages/i386ELF/All/unzip-5.41.tgz
yui# pkg_admin lsall 'unzip\*[Ge]5.41'
/usr/pkgsrc/packages/i386ELF/All/unzip-5.41.tgz
yui# pkg_admin lsbest 'unzip\*[Ge]5.40'
/usr/pkgsrc/packages/i386ELF/All/unzip-5.41.tgz
yui# pkg_admin lsall /usr/pkgsrc/packages/i386ELF/All/'{mit,unproven}-pthread*'
/usr/pkgsrc/packages/i386ELF/All/mit-pthreads-1.60b6.tgz
/usr/pkgsrc/packages/i386ELF/All/unproven-pthreads-0.15.tgz
.Ed
.It Cm pmatch Ar pattern Ar pkg
Returns true if
.Ar pkg
matches
.Ar pattern ,
otherwise returns false.
.It Cm rebuild
Rebuild the package database mapping from scratch.
This option is only intended for recovery after system crashes
during package installation and removal.
.It Cm rebuild-tree
Rebuild the +REQUIRED_BY files from scratch by reresolving all dependencies.
.Pp
This option is intended to be used for fixing inconsistencies between
the records of depending and depended-on packages, such as can arise
by the use of
.Cm pkg_delete -f .
.It Cm set Ar variable=value pkg ...
Set variable with information about the installed package.
Use
.Cm unset
to remove a variable.
.Pp
Packages that are not installed directly by the user but pulled in as
dependencies are marked by setting
.Dq automatic=YES .
.It Cm gpg-sign-package pkg spkg
Sign the binary package
.Ar pkg
using GPG and write the result to
.Ar spkg .
.It Cm x509-sign-package pkg spkg key cert
Sign the binary package
.Ar pkg
using the key
.Ar key
and the certificate
.Ar cert ,
using
.Ar spkg
as output file.
.It Cm unset Ar variable pkg ...
Remove an installation variable.
.El
.Sh ENVIRONMENT
See
.Xr pkg_install.conf 5
for options, that can also be specified using the environment.
.Sh FILES
.Bl -tag -width /var/db/pkg/pkgdb.byfile.db -compact
.It Pa /var/db/pkg/pkgdb.byfile.db
.It Pa /var/db/pkg/\*[Lt]pkg\*[Gt]/+CONTENTS
.El
.Sh SEE ALSO
.Xr pkg_add 1 ,
.Xr pkg_create 1 ,
.Xr pkg_delete 1 ,
.Xr pkg_info 1 ,
.Xr pkg_view 1 ,
.Xr pkg_install.conf 5 ,
.Xr pkgsrc 7
.Sh HISTORY
The
.Nm
command first appeared in
.Nx 1.4 .
.Sh AUTHORS
The
.Nm
command was written by Hubert Feyrer.