#!/usr/bin/python3.5 # # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved. # # Some userland consolidation specific lint checks import pkg.lint.base as base from pkg.lint.engine import lint_fmri_successor import pkg.fmri import pkg.elf as elf import re import os.path import subprocess import pkg.client.api import pkg.client.api_errors import pkg.client.progress class UserlandActionChecker(base.ActionChecker): """An opensolaris.org-specific class to check actions.""" name = "userland.action" def __init__(self, config): self.description = _( "checks Userland packages for common content errors") path = os.getenv('PROTO_PATH') if path != None: self.proto_path = path.split() else: self.proto_path = None # # These lists are used to check if a 32/64-bit binary # is in a proper 32/64-bit directory. # self.pathlist32 = [ "i86", "sparcv7", "32", "i86pc-solaris-64int", # perl path "sun4-solaris-64int" # perl path ] self.pathlist64 = [ "amd64", "sparcv9", "64", "i86pc-solaris-thread-multi-64", # perl path "sun4-solaris-thread-multi-64" # perl path ] self.runpath_re = [ re.compile('^/lib(/.*)?$'), re.compile('^/usr/'), re.compile('^\$ORIGIN/') ] self.runpath_64_re = [ re.compile('^.*/64(/.*)?$'), re.compile('^.*/amd64(/.*)?$'), re.compile('^.*/sparcv9(/.*)?$'), re.compile('^.*/i86pc-solaris-thread-multi-64(/.*)?$'), # perl path re.compile('^.*/sun4-solaris-thread-multi-64(/.*)?$') # perl path ] self.initscript_re = re.compile("^etc/(rc.|init)\.d") self.lint_paths = {} self.ref_paths = {} super(UserlandActionChecker, self).__init__(config) def startup(self, engine): """Initialize the checker with a dictionary of paths, so that we can do link resolution. This is copied from the core pkglint code, but should eventually be made common. """ def seed_dict(mf, attr, dic, atype=None, verbose=False): """Updates a dictionary of { attr: [(fmri, action), ..]} where attr is the value of that attribute from actions of a given type atype, in the given manifest.""" pkg_vars = mf.get_all_variants() if atype: mfg = (a for a in mf.gen_actions_by_type(atype)) else: mfg = (a for a in mf.gen_actions()) for action in mfg: if atype and action.name != atype: continue if attr not in action.attrs: continue variants = action.get_variant_template() variants.merge_unknown(pkg_vars) action.attrs.update(variants) p = action.attrs[attr] dic.setdefault(p, []).append((mf.fmri, action)) # construct a set of FMRIs being presented for linting, and # avoid seeding the reference dictionary with any for which # we're delivering new packages. lint_fmris = {} for m in engine.gen_manifests(engine.lint_api_inst, release=engine.release, pattern=engine.pattern): lint_fmris.setdefault(m.fmri.get_name(), []).append(m.fmri) for m in engine.lint_manifests: lint_fmris.setdefault(m.fmri.get_name(), []).append(m.fmri) engine.logger.debug( _("Seeding reference action path dictionaries.")) for manifest in engine.gen_manifests(engine.ref_api_inst, release=engine.release): # Only put this manifest into the reference dictionary # if it's not an older version of the same package. if not any( lint_fmri_successor(fmri, manifest.fmri) for fmri in lint_fmris.get(manifest.fmri.get_name(), []) ): seed_dict(manifest, "path", self.ref_paths) engine.logger.debug( _("Seeding lint action path dictionaries.")) # we provide a search pattern, to allow users to lint a # subset of the packages in the lint_repository for manifest in engine.gen_manifests(engine.lint_api_inst, release=engine.release, pattern=engine.pattern): seed_dict(manifest, "path", self.lint_paths) engine.logger.debug( _("Seeding local action path dictionaries.")) for manifest in engine.lint_manifests: seed_dict(manifest, "path", self.lint_paths) self.__merge_dict(self.lint_paths, self.ref_paths, ignore_pubs=engine.ignore_pubs) def __merge_dict(self, src, target, ignore_pubs=True): """Merges the given src dictionary into the target dictionary, giving us the target content as it would appear, were the packages in src to get published to the repositories that made up target. We need to only merge packages at the same or successive version from the src dictionary into the target dictionary. If the src dictionary contains a package with no version information, it is assumed to be more recent than the same package with no version in the target.""" for p in src: if p not in target: target[p] = src[p] continue def build_dic(arr): """Builds a dictionary of fmri:action entries""" dic = {} for (pfmri, action) in arr: if pfmri in dic: dic[pfmri].append(action) else: dic[pfmri] = [action] return dic src_dic = build_dic(src[p]) targ_dic = build_dic(target[p]) for src_pfmri in src_dic: # we want to remove entries deemed older than # src_pfmri from targ_dic. for targ_pfmri in targ_dic.copy(): sname = src_pfmri.get_name() tname = targ_pfmri.get_name() if lint_fmri_successor(src_pfmri, targ_pfmri, ignore_pubs=ignore_pubs): targ_dic.pop(targ_pfmri) targ_dic.update(src_dic) l = [] for pfmri in targ_dic: for action in targ_dic[pfmri]: l.append((pfmri, action)) target[p] = l def __realpath(self, path, target): """Combine path and target to get the real path.""" result = os.path.dirname(path) for frag in target.split(os.sep): if frag == '..': result = os.path.dirname(result) elif frag == '.': pass else: result = os.path.join(result, frag) return result def __elf_aslr_check(self, path, engine): result = None ei = elf.get_info(path) type = ei.get("type"); if type != "exe": return result # get the ASLR tag string for this binary aslr_tag_process = subprocess.Popen( "/usr/bin/elfedit -r -e 'dyn:sunw_aslr' " + path, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) # aslr_tag_string will get stdout; err will get stderr aslr_tag_string, err = aslr_tag_process.communicate() # No ASLR tag was found; everthing must be tagged if aslr_tag_process.returncode != 0: engine.error( _("'%s' is not tagged for aslr") % (path), msgid="%s%s.5" % (self.name, "001")) return result # look for "ENABLE" anywhere in the string; # warn about binaries which are not ASLR enabled if re.search("ENABLE", aslr_tag_string) is not None: return result engine.warning( _("'%s' does not have aslr enabled") % (path), msgid="%s%s.6" % (self.name, "001")) return result def __elf_runpath_check(self, path, engine): result = None list = [] ed = elf.get_dynamic(path) ei = elf.get_info(path) bits = ei.get("bits") for dir in ed.get("runpath", "").split(":"): if dir == None or dir == '': continue match = False for expr in self.runpath_re: if expr.match(dir): match = True break # The RUNPATH shouldn't contain any runtime linker # default paths (or the /64 equivalent link) if dir in ['/lib', '/lib/64', '/lib/amd64', '/lib/sparcv9', '/usr/lib', '/usr/lib/64', '/usr/lib/amd64', '/usr/lib/sparcv9' ]: list.append(dir) if match == False: list.append(dir) if bits == 32: for expr in self.runpath_64_re: if expr.search(dir): engine.warning( _("64-bit runpath in 32-bit binary, '%s' includes '%s'") % (path, dir), msgid="%s%s.3" % (self.name, "001")) else: match = False for expr in self.runpath_64_re: if expr.search(dir): match = True break if match == False: engine.warning( _("32-bit runpath in 64-bit binary, '%s' includes '%s'") % (path, dir), msgid="%s%s.3" % (self.name, "001")) if len(list) > 0: result = _("bad RUNPATH, '%%s' includes '%s'" % ":".join(list)) return result def __elf_wrong_location_check(self, path): result = None ei = elf.get_info(path) bits = ei.get("bits") type = ei.get("type"); elems = os.path.dirname(path).split("/") path64 = False for p in self.pathlist64: if (p in elems): path64 = True path32 = False for p in self.pathlist32: if (p in elems): path32 = True # ignore 64-bit executables in normal (non-32-bit-specific) # locations, that's ok now. if (type == "exe" and bits == 64 and path32 == False and path64 == False): return result if bits == 32 and path64: result = _("32-bit object '%s' in 64-bit path") elif bits == 64 and not path64: result = _("64-bit object '%s' in 32-bit path") return result def file_action(self, action, manifest, engine, pkglint_id="001"): """Checks for existence in the proto area.""" if action.name not in ["file"]: return path = action.hash if path == None or path == 'NOHASH': path = action.attrs["path"] # check for writable files without a preserve attribute if "mode" in action.attrs: mode = action.attrs["mode"] if (int(mode, 8) & 0o222) != 0 and "preserve" not in action.attrs: engine.error( _("%(path)s is writable (%(mode)s), but missing a preserve" " attribute") % {"path": path, "mode": mode}, msgid="%s%s.0" % (self.name, pkglint_id)) elif "preserve" in action.attrs: if "mode" in action.attrs: mode = action.attrs["mode"] if (int(mode, 8) & 0o222) == 0: engine.error( _("%(path)s has a preserve action, but is not writable (%(mode)s)") % {"path": path, "mode": mode}, msgid="%s%s.4" % (self.name, pkglint_id)) else: engine.error( _("%(path)s has a preserve action, but no mode") % {"path": path, "mode": mode}, msgid="%s%s.3" % (self.name, pkglint_id)) # checks that require a physical file to look at if self.proto_path is not None: for directory in self.proto_path: fullpath = directory + "/" + path if os.path.exists(fullpath): break if not os.path.exists(fullpath): engine.info( _("%s missing from proto area, skipping" " content checks") % path, msgid="%s%s.1" % (self.name, pkglint_id)) elif elf.is_elf_object(fullpath): # 32/64 bit in wrong place result = self.__elf_wrong_location_check(fullpath) if result != None: engine.error(result % path, msgid="%s%s.2" % (self.name, pkglint_id)) result = self.__elf_runpath_check(fullpath, engine) if result != None: engine.error(result % path, msgid="%s%s.3" % (self.name, pkglint_id)) # illumos does not support ASLR #result = self.__elf_aslr_check(fullpath, engine) file_action.pkglint_desc = _("Paths should exist in the proto area.") def link_resolves(self, action, manifest, engine, pkglint_id="002"): """Checks for link resolution.""" if action.name not in ["link", "hardlink"]: return path = action.attrs["path"] target = action.attrs["target"] realtarget = self.__realpath(path, target) # Check against the target image (ref_paths), since links might # resolve outside the packages delivering a particular # component. # links to files should directly match a patch in the reference # repo. if self.ref_paths.get(realtarget, None): return # If it didn't match a path in the reference repo, it may still # be a link to a directory that has no action because it uses # the default attributes. Look for a path that starts with # this value plus a trailing slash to be sure this it will be # resolvable on a fully installed system. realtarget += '/' for key in self.ref_paths: if key.startswith(realtarget): return engine.error(_("%s %s has unresolvable target '%s'") % (action.name, path, target), msgid="%s%s.0" % (self.name, pkglint_id)) link_resolves.pkglint_desc = _("links should resolve.") def init_script(self, action, manifest, engine, pkglint_id="003"): """Checks for SVR4 startup scripts.""" if action.name not in ["file", "dir", "link", "hardlink"]: return path = action.attrs["path"] if self.initscript_re.match(path): engine.warning( _("SVR4 startup '%s', deliver SMF" " service instead") % path, msgid="%s%s.0" % (self.name, pkglint_id)) init_script.pkglint_desc = _( "SVR4 startup scripts should not be delivered.") class UserlandManifestChecker(base.ManifestChecker): """An opensolaris.org-specific class to check manifests.""" name = "userland.manifest" def __init__(self, config): super(UserlandManifestChecker, self).__init__(config) def forbidden_publisher(self, manifest, engine, pkglint_id="1001"): if not os.environ.get("ENCUMBERED"): for action in manifest.gen_actions_by_type("depend"): for f in action.attrlist("fmri"): pkg_name=pkg.fmri.PkgFmri(f).pkg_name info_needed = pkg.client.api.PackageInfo.ALL_OPTIONS - \ (pkg.client.api.PackageInfo.ACTION_OPTIONS | frozenset([pkg.client.api.PackageInfo.LICENSES])) progtracker = pkg.client.progress.NullProgressTracker() interface=pkg.client.api.ImageInterface("/", pkg.client.api.CURRENT_API_VERSION, progtracker, lambda x: False, None,None) ret = interface.info([pkg_name],True,info_needed) if ret[pkg.client.api.ImageInterface.INFO_FOUND]: allowed_pubs = engine.get_param("%s.allowed_pubs" % self.name).split(" ") + ["openindiana.org","on-nightly"] for i in ret[pkg.client.api.ImageInterface.INFO_FOUND]: if i.publisher not in allowed_pubs: engine.error(_("package %(pkg)s depends on %(name)s, which comes from forbidden publisher %(publisher)s") % {"pkg":manifest.fmri,"name":pkg_name,"publisher":i.publisher}, msgid="%s%s.1" % (self.name, pkglint_id)) forbidden_publisher.pkglint_desc = _( "Dependencies should come from standard publishers" ) def component_check(self, manifest, engine, pkglint_id="001"): manifest_paths = [] files = False license = False for action in manifest.gen_actions_by_type("file"): files = True break if files == False: return for action in manifest.gen_actions_by_type("license"): if not action.attrs['license']: engine.error( _("missing vaue for action license attribute 'license' like 'CDDL','MIT','GPL'..."), msgid="%s%s.0" % (self.name, pkglint_id)) else: license = True break if license == False: engine.error( _("missing license action"), msgid="%s%s.0" % (self.name, pkglint_id)) # if 'org.opensolaris.arc-caseid' not in manifest: # engine.error( _("missing ARC data (org.opensolaris.arc-caseid)"), # msgid="%s%s.0" % (self.name, pkglint_id)) component_check.pkglint_desc = _( "license actions and ARC information are required if you deliver files.") def publisher_in_fmri(self, manifest, engine, pkglint_id="002"): allowed_pubs = engine.get_param( "%s.allowed_pubs" % self.name).split(" ") fmri = manifest.fmri if fmri.publisher and fmri.publisher not in allowed_pubs: engine.error(_("package %s has a publisher set!") % manifest.fmri, msgid="%s%s.2" % (self.name, pkglint_id)) publisher_in_fmri.pkglint_desc = _( "extra publisher set" )