Re: kern/41669: Veriexec generation with -d flag includes non-executable files by default.

[Elad Efrat <elad%NetBSD.org@localhost>]

The following reply was made to PR kern/41669; it has been noted by GNATS.

From: Elad Efrat <elad%NetBSD.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: agc%netbsd.org@localhost
Subject: Re: kern/41669: Veriexec generation with -d flag includes 
non-executable
 files by default.
Date: Sun, 05 Jul 2009 12:48:19 +0300

 This is a multi-part message in MIME format.
 --------------020008000401040901080705
 Content-Type: text/plain; charset=ISO-8859-1; format=flowed
 Content-Transfer-Encoding: 7bit
 
 cemkayali%eticaret.com.tr@localhost wrote:
 >> Number:         41669
 >> Category:       kern
 >> Synopsis:       Veriexec generation with -d flag includes non-executable 
 >> files by default.
 >> Confidential:   no
 >> Severity:       serious
 >> Priority:       medium
 >> Responsible:    kern-bug-people
 >> State:          open
 >> Class:          change-request
 >> Submitter-Id:   net
 >> Arrival-Date:   Sun Jul 05 01:25:00 +0000 2009
 >> Originator:     Cem Kayali
 >> Release:        NetbSD 5 amd64
 >> Organization:
 >> Environment:
 >> Description:
 > 
 > Hello!
 > 
 > #!/bin/sh
 > veriexecgen -r -D \
 > -d /usr/pkg/bin \
 > -d /usr/pkg/sbin \
 > -d /usr/pkg/lib
 > 
 > 
 > It includes fingerprints for non-executable files too --- though no '-a' 
 > usage. Sample fingerprints:
 > 
 > /usr/pkg/lib/perl5/man/man1/perlfaq9.1 SHA256 
 > 136b51102b75379ced4fca30749d32a831b341af187b436cbf4a736447880667 file, 
 > indirect
 > /usr/pkg/lib/perl5/man/man1/perlfilter.1 SHA256 
 > 25cabc33282859c0e2de9df565164abc7942a1313200da5b2602a7e29520ddeb file, 
 > indirect
 > /usr/pkg/lib/perl5/man/man1/perlfork.1 SHA256 
 > 1eeef370fd08005253393f6a7ec727686378c8c9811286da9ea99cba4fbf2188 file, 
 > indirect
 > /usr/pkg/lib/perl5/man/man1/perlform.1 SHA256 
 > 374457ea9bcded64a3f98543dda5b8dfc1d84309f6512736604c2a986fb03942 file, 
 > indirect
 > /usr/pkg/lib/perl5/man/man1/perlfreebsd.1 SHA256 
 > f646441728e2cbffce78d90512127ceaf854581654f375e6c1c5188606b7483b file, 
 > indirect
 
 A quick look suggests that the attached diff addresses the issue -- I'm
 not sure why we need to care about "scan_system_dirs" in that case. Does
 it look okay to you, Al?
 
 Thanks,
 
 -e.
 
 --------------020008000401040901080705
 Content-Type: text/plain;
  name="veriexecgen.c.diff"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: inline;
  filename="veriexecgen.c.diff"
 
 Index: veriexecgen.c
 ===================================================================
 RCS file: /usr/cvs/src/usr.sbin/veriexecgen/veriexecgen.c,v
 retrieving revision 1.16
 diff -u -p -r1.16 veriexecgen.c
 --- veriexecgen.c      29 Apr 2008 06:53:04 -0000      1.16
 +++ veriexecgen.c      4 Jul 2009 16:06:54 -0000
 @@ -214,7 +214,7 @@ add_new_entry(veriexecgen_t *vp, FTSENT 
        } else
                sb = *file->fts_statp;
  
 -      if (!vp->all_files && !vp->scan_system_dirs && !IS_EXEC(sb.st_mode))
 +      if (!vp->all_files && !IS_EXEC(sb.st_mode))
                return;
  
        e = ecalloc(1UL, sizeof(*e));
 
 --------------020008000401040901080705--