Index: src/scripts/package_script_whitelist.sh |
diff --git a/src/scripts/package_script_whitelist.sh b/src/scripts/package_script_whitelist.sh |
deleted file mode 100755 |
index 9d1904dc6ec47dbf41e8b253c5fcf9b8457548c2..0000000000000000000000000000000000000000 |
--- a/src/scripts/package_script_whitelist.sh |
+++ /dev/null |
@@ -1,215 +0,0 @@ |
-#!/bin/bash |
- |
-# Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
-# Use of this source code is governed by a BSD-style license that can be |
-# found in the LICENSE file. |
- |
-# This script is used to maintain the whitelist for package maintainer scripts. |
-# If a package maintainer script is in the whitelist file then it is ok to skip |
-# running that maintainer script when installing the package. Otherwise there |
-# should be an equivalent script that can perform those operation on a target |
-# root file system. |
-# |
-# The whitelist contains on entry per line which is the filename followed by |
-# its md5sum. Ideally it is kept in sorted by package name like below: |
-# bar.postinst MD5SUM1 |
-# bar.postinst MD5SUM2 |
-# bar.preinst MD5SUM3 |
-# foo.postinst MD5SUM4 |
-# |
-# TODO: Should be able to whitelist on built packages and not just an already |
-# created rootfs. |
- |
-. "$(dirname "$0")/common.sh" |
- |
-DEFINE_string whitelist "${SRC_ROOT}/package_scripts/package.whitelist" \ |
- "The whitelist file to use." |
-DEFINE_string file "" "The path to a presinst/postinst file for add/audit." |
-DEFINE_string root "" \ |
- "Mounted root on which to look for the maintainer scripts when using audit." |
-DEFINE_string audit_pattern "*" \ |
- "Package name pattern used when auditing all packages [ex: 'lib*']" |
- |
-FLAGS_HELP="Usage: $(basename $0) [options] add|audit|check |
- |
-Use this script to maintain the package scripts whitelist. It handles the |
-following commands: |
- |
- add: Add the --file= specified file to the whitelist. |
- audit: If no --file= is given, audit all non-whitelisted scripts in the |
- given rootfs. This will show you the files in turn and give you |
- the option to Skip/View/Whitelist/Create template for the script. |
- If --file is given it will do the same for that one file. |
- check: Checks if the --file= is in the whitelist. |
-" |
- |
-# Parse command line |
-FLAGS "$@" || exit 1 |
-eval set -- "${FLAGS_ARGV}" |
- |
-# Adds a the file at the given path to the whitelist. |
-# |
-# $1 - Path to file to add to whitelist. |
-add_to_whitelist() { |
- local path=$1 |
- local whitelist="$FLAGS_whitelist" |
- local file=$(basename "$path") |
- |
- local checksum=$(md5sum "$path" | awk '{ print $1 }') |
- if [ ! -f "$whitelist" ]; then |
-cat <<EOF > "$whitelist" |
-# Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
-# Use of this source code is governed by a BSD-style license that can be |
-# found in the LICENSE file. |
-EOF |
- fi |
- |
- echo "$file $checksum" | \ |
- sort -u -o "${whitelist}.new" "$whitelist" - |
- mv "${whitelist}.new" "$whitelist" |
-} |
- |
-# Creates a template alternative maintainer script in the same directory |
-# as the whitelist file. This will run instead of the whitelisted package |
-# scripts using only build machine binaries and targeting a rootfs. |
-# |
-# $1 - The name of the template (like 'foo.postinst') |
-create_script_template() { |
- local file=$1 |
- |
- local whitelist_dir=$(dirname "$FLAGS_whitelist") |
- local path="${whitelist_dir}/${file}" |
- if [ -f "$path" ]; then |
- echo "Error: Alternative maintainer script '$path' already exists." |
- return |
- fi |
- |
-cat <<EOF > "$path" |
-#!/bin/bash |
- |
-# Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
-# Use of this source code is governed by a BSD-style license that can be |
-# found in the LICENSE file. |
- |
-# $file |
- |
-set -e |
- |
-# \$ROOT - The path to the target root file system. |
-# \$SRC_ROOT - The path to the source tree. |
- |
-# TODO: The equivalent of $file running from outside of the target rootfs |
-# that only uses tools from the build machine and not from the target. |
- |
-exit 1 |
- |
-EOF |
- chmod 0750 "$path" |
-} |
- |
-# Show the script to the user for audit purposes. |
-# |
-# $1 - The script to show. |
-show_script() { |
- local path=$1 |
- local type=$(file -b "$path") |
- local is_text=$(echo "$type" | grep -c "text") |
- if [ $is_text -eq 0 ]; then |
- local file=$(basename "$path") |
- echo "Unable to view '$file'; not a text file. Type is '$type'" |
- else |
- local pager="/usr/bin/less" |
- if [ -n "$PAGER" ]; then |
- pager="$PAGER" |
- fi |
- $pager "$path" |
- fi |
-} |
- |
-# Process a given script for audit purposes. We show the script to the user |
-# and then prompt them with options. |
-# |
-# $1 - The script to process |
-audit_script() { |
- local path=$1 |
- local file=$(basename "$path") |
- local prompt="$file: (Q)uit, (S)kip, (V)iew, (W)hitelist, (C)reate template?" |
- |
- show_script "$path" |
- while true; do |
- read -n 1 -p "$prompt " ANSWER |
- echo "" |
- ANSWER="${ANSWER:0:1}" # Get just the first character |
- case $ANSWER in |
- Q*|q*) |
- exit 0 |
- ;; |
- S*|s*) |
- echo "Skipping: $file" |
- return |
- ;; |
- V*|v*) |
- show_script "$path" |
- ;; |
- W*|w*) |
- echo "Whitelisting: $file" |
- add_to_whitelist "$path" |
- return |
- ;; |
- C*|c*) |
- echo "Creating template for: $file" |
- create_script_template "$file" |
- ;; |
- *) |
- echo "Unknown response: '$ANSWER'" |
- ;; |
- esac |
- done |
-} |
- |
-# Audit all non-whitelisted script in $FLAGS_root |
-audit_all() { |
- echo "Auditing packages at: $FLAGS_root" |
- local dpkg_info="$FLAGS_root/var/lib/dpkg/info" |
- local scripts=$(ls "$dpkg_info"/$FLAGS_audit_pattern.preinst \ |
- "$dpkg_info"/$FLAGS_audit_pattern.postinst | sort -r) |
- |
- for s in $scripts; do |
- if ! is_whitelisted "$s"; then |
- audit_script "$s" |
- fi |
- done |
-} |
- |
-case $1 in |
- add) |
- if [ -z "$FLAGS_file" ]; then |
- echo "--file parameter is required for 'add' command." |
- exit 1 |
- fi |
- add_to_whitelist "$FLAGS_file" |
- ;; |
- audit) |
- if [ -n "$FLAGS_file" ]; then |
- audit_script "$FLAGS_file" |
- elif [ -n "$FLAGS_root" ]; then |
- audit_all |
- else |
- echo "Error: One of --file or --root is needed for audit command." |
- fi |
- ;; |
- check) |
- if [ -z "$FLAGS_file" ]; then |
- echo "--file parameter is required for 'check' command." |
- exit 1 |
- fi |
- if is_whitelisted "$FLAGS_file"; then |
- echo "Whitelisted" |
- else |
- echo "Not whitelisted" |
- fi |
- ;; |
- *) |
- echo "Unknown command." |
- ;; |
-esac |