diff -Nur modutils-2.3.4/ChangeLog modutils-2.3.5/ChangeLog --- modutils-2.3.4/ChangeLog Fri Oct 8 20:31:19 1999 +++ modutils-2.3.5/ChangeLog Tue Oct 12 21:06:08 1999 @@ -1,3 +1,19 @@ +1999-10-12 Keith Owens + + modutils 2.3.5 + + * Debian VPATH patches, kernelversion script, man pages by + Wichert Akkerman . + * VPATH fixes for insmod_ksymoops_clean. + * Correct timestamp in insmod_ksymoops_clean, change days from 7 to 2. + * Remove debugging instruction that had been left in. + * Change char-major-14 to soundcore, per sailer@ife.ee.ethz.ch + * Correct ppp-deflate-26, was -24. + * Correct manual headers. + * Add -r flag to depmod and insmod for people who want to shoot + themselves in the foot. + * Reformat messages for 80 character wide screens and add commands. + 1999-10-08 Keith Owens modutils 2.3.4 diff -Nur modutils-2.3.4/depmod/depmod.c modutils-2.3.5/depmod/depmod.c --- modutils-2.3.4/depmod/depmod.c Fri Oct 8 20:23:53 1999 +++ modutils-2.3.5/depmod/depmod.c Tue Oct 12 20:53:21 1999 @@ -23,6 +23,14 @@ * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ + /* + Fixes: + + Add -r flag: Keith Owens October 1999. + */ + +#ident "$Id: depmod.c 1.3 Tue, 12 Oct 1999 20:53:21 +1000 keith $" + #include #include #include @@ -551,6 +559,7 @@ "Option -v force a printout of all visited modules.\n" "Option -n will write the dependency file on stdout only.\n" "Option -V will show you the release version of depmod\n" + "Option -r will allow root to load modules that are not owned by root\n" "\n" "The following options are useful for people managing distributions;\n" "Option '-b basedirectory': use an image of a module tree.\n" @@ -582,12 +591,13 @@ {"syslog", 0, 0, 's'}, {"verbose", 0, 0, 'v'}, {"version", 0, 0, 'V'}, + {"root", 0, 0, 'r'}, {0, 0, 0, 0 } }; error_file = "depmod"; - while ((o = getopt_long(argc, argv, "ab:C:eF:hnqsvV", + while ((o = getopt_long(argc, argv, "ab:C:eF:hnqsvVr", &long_opts[0], NULL)) != EOF) { switch (o) { case 'a': @@ -634,6 +644,10 @@ case 'V': printf("depmod version %s\n", MODUTILS_VERSION); + break; + + case 'r': + root_check_off = 1; break; default: diff -Nur modutils-2.3.4/genksyms/Makefile.in modutils-2.3.5/genksyms/Makefile.in --- modutils-2.3.4/genksyms/Makefile.in Fri Oct 8 16:20:06 1999 +++ modutils-2.3.5/genksyms/Makefile.in Mon Oct 11 10:22:06 1999 @@ -1,4 +1,4 @@ -# $Id: Makefile.in 1.2 Fri, 08 Oct 1999 16:20:06 +1000 keith $ +# $Id: Makefile.in 1.3 Mon, 11 Oct 1999 10:22:06 +1000 keith $ srcdir=@srcdir@ VPATH=@srcdir@ @@ -13,7 +13,7 @@ LDFLAGS = @LDFLAGS@ INSTALL = @INSTALL@ -DEFS = -I$(srcdir) -I$(srcdir)/../include -D_GNU_SOURCE @DEFS@ +DEFS = -I. -I$(srcdir) -I$(srcdir)/../include -D_GNU_SOURCE @DEFS@ %.o: %.c $(CC) $(CFLAGS) $(DEFS) -c -o $@ $< @@ -25,14 +25,14 @@ genksyms: genksyms.o parse.o lex.o ../util/libutil.a $(CC) $(CFLAGS) -o $@ $^ $(LDFLAGS) -$(srcdir)/parse.c $(srcdir)/parse.h: parse.y +parse.c parse.h: parse.y @echo "expect 6 shift/reduce conflicts and 5 reduce/reduce conflicts." - cd $(srcdir); bison -o parse.c -dtv $^ + bison -o parse.c -dtv $^ lex.c: lex.l parse.h flex -o$@ -d $^ -$(srcdir)/crc32.tab: makecrc32.c +crc32.tab: makecrc32.c $(CC) $(CFLAGS) -o makecrc32 $^ ./makecrc32 > $@.tmp mv $@.tmp $@ diff -Nur modutils-2.3.4/include/config.h modutils-2.3.5/include/config.h --- modutils-2.3.4/include/config.h Fri Oct 8 20:23:53 1999 +++ modutils-2.3.5/include/config.h Tue Oct 12 20:53:21 1999 @@ -71,6 +71,7 @@ extern OPT_LIST *probeall_list; extern OPT_LIST *aliases; extern time_t config_mtime; +extern int root_check_off; /* Check modules are owned by root? */ char *fgets_strip(char *buf, int sizebuf, FILE * fin, int *lineno); int config_read(int all, char *force_ver, char *base_dir, char *conf_file); diff -Nur modutils-2.3.4/include/version.h modutils-2.3.5/include/version.h --- modutils-2.3.4/include/version.h Fri Oct 8 16:20:06 1999 +++ modutils-2.3.5/include/version.h Mon Oct 11 10:22:06 1999 @@ -1 +1 @@ -#define MODUTILS_VERSION "2.3.3" +#define MODUTILS_VERSION "2.3.5" diff -Nur modutils-2.3.4/insmod/Makefile.in modutils-2.3.5/insmod/Makefile.in --- modutils-2.3.4/insmod/Makefile.in Fri Oct 8 20:37:09 1999 +++ modutils-2.3.5/insmod/Makefile.in Tue Oct 12 20:53:21 1999 @@ -1,4 +1,4 @@ -# $Id: Makefile.in 1.4 Fri, 08 Oct 1999 20:37:09 +1000 keith $ +# $Id: Makefile.in 1.7 Tue, 12 Oct 1999 20:53:21 +1000 keith $ srcdir=@srcdir@ VPATH=@srcdir@ @@ -51,10 +51,10 @@ install install-bin: all @set -x;\ - for i in $(filter-out $(COMB), $(TARGETS)) insmod_ksymoops_clean; do \ - $(RM) $(sbindir)/$$i; $(INSTALL) $$i $(sbindir); done; \ + for i in $(filter-out $(COMB), $(TARGETS)) $(srcdir)/insmod_ksymoops_clean $(srcdir)/kernelversion; do \ + $(INSTALL) $$i $(sbindir); done; \ for i in $(COMB); do \ - $(RM) $(sbindir)/$$i; ln -sf insmod $(sbindir)/$$i; done + ln -sf insmod $(sbindir)/$$i; done clean: rm -f *.o $(TARGETS) insmod.static diff -Nur modutils-2.3.4/insmod/insmod.c modutils-2.3.5/insmod/insmod.c --- modutils-2.3.4/insmod/insmod.c Thu Sep 2 03:26:13 1999 +++ modutils-2.3.5/insmod/insmod.c Tue Oct 12 20:53:21 1999 @@ -33,9 +33,11 @@ SMP "friendliness" (and -P): Bill Zumach Ksymoops support: Keith Owens August 1999. + + Add -r flag: Keith Owens October 1999. */ -#ident "$Id: insmod.c 1.4 Thu, 02 Sep 1999 03:26:13 +1000 keith $" +#ident "$Id: insmod.c 1.5 Tue, 12 Oct 1999 20:53:21 +1000 keith $" #include #include @@ -1070,6 +1072,7 @@ " -X Do export externs (default)\n" " -y Do not add ksymoops symbols\n" " -Y Do add ksymoops symbols (default)\n" + " -r Allow root to load modules not owned by root\n" " -P PREFIX\n" " --prefix=PREFIX Prefix for kernel or module symbols\n" ,stderr); @@ -1098,6 +1101,7 @@ {"quiet", 0, 0, 'q'}, {"noksymoops", 0, 0, 'y'}, {"ksymoops", 0, 0, 'Y'}, + {"root", 0, 0, 'r'}, {0, 0, 0, 0} }; char *m_name = NULL; @@ -1122,7 +1126,7 @@ errors = optind = 0; /* Process the command line. */ - while ((o = getopt_long(argc, argv, "fkmno:pqsvVxXLP:yY", + while ((o = getopt_long(argc, argv, "fkmno:pqsvVxXLP:yYr", &long_opts[0], NULL)) != EOF) switch (o) { case 'f': /* force loading */ @@ -1169,6 +1173,9 @@ break; case 'Y': /* do define ksymoops symbols */ flag_ksymoops = 1; + break; + case 'r': /* allow root to load non-root modules */ + root_check_off = 1; break; case 'P': /* use prefix on crc */ set_ncv_prefix(optarg); diff -Nur modutils-2.3.4/insmod/insmod_ksymoops_clean modutils-2.3.5/insmod/insmod_ksymoops_clean --- modutils-2.3.4/insmod/insmod_ksymoops_clean Fri Oct 8 20:23:53 1999 +++ modutils-2.3.5/insmod/insmod_ksymoops_clean Tue Oct 12 20:54:30 1999 @@ -1,11 +1,11 @@ #!/bin/sh -# Delete saved ksyms and modules not accessed in 7 days +# Delete saved ksyms and modules not accessed in 2 days if [ -d /var/log/ksymoops ] then set -e # Make sure there is always at least one version - d=`date +%Y%m%d%T%M%S | sed -e 's/://g'` + d=`date +%Y%m%d%H%M%S` cp -a /proc/ksyms /var/log/ksymoops/${d}.ksyms cp -a /proc/modules /var/log/ksymoops/${d}.modules - find /var/log/ksymoops -type f -atime +7 -exec rm {} \; + find /var/log/ksymoops -type f -atime +2 -exec rm {} \; fi diff -Nur modutils-2.3.4/insmod/kernelversion modutils-2.3.5/insmod/kernelversion --- modutils-2.3.4/insmod/kernelversion Thu Jan 1 10:00:00 1970 +++ modutils-2.3.5/insmod/kernelversion Tue Oct 12 20:54:30 1999 @@ -0,0 +1,23 @@ +#!/bin/sh +# Small script to get the kernel version +# Made by W.Akkerman for the Debian modules package. + +# Helper functions from Bruce Perens to replace cut + +pick1() { + eval 'echo $'"$pick_index" +} +pick() { + OLD_IFS=IFS + local delimiter="$1" + shift + pick_index="$1" + shift + IFS=" "$delimiter + pick1 $* + IFS=$OLD_IFS + unset pick_index +} + +version=$(uname -r) +echo `pick . 1 $version`.`pick . 2 $version` diff -Nur modutils-2.3.4/kerneld/Makefile.in modutils-2.3.5/kerneld/Makefile.in --- modutils-2.3.4/kerneld/Makefile.in Fri Oct 8 16:20:06 1999 +++ modutils-2.3.5/kerneld/Makefile.in Mon Oct 11 10:22:06 1999 @@ -1,4 +1,4 @@ -# $Id: Makefile.in 1.2 Fri, 08 Oct 1999 16:20:06 +1000 keith $ +# $Id: Makefile.in 1.3 Mon, 11 Oct 1999 10:22:06 +1000 keith $ srcdir=@srcdir@ VPATH=@srcdir@ @@ -85,7 +85,7 @@ depend dep .depend: $(addsuffix .c, $(TARGETS)) @echo "Read the Makefile comment about NEW_KERNELD_PROTOCOL!" - $(CC) -M $(CFLAGS) $(DEFS) $(addsuffix .c, $(TARGETS)) > .depend + $(CC) -M $(CFLAGS) $(DEFS) $^ > .depend check_persist.o: check_persist.c $(CC) $(CFLAGS) $(DEFS) -DMODULE -D__KERNEL__ -c check_persist.c diff -Nur modutils-2.3.4/man/depmod.8 modutils-2.3.5/man/depmod.8 --- modutils-2.3.4/man/depmod.8 Fri Oct 8 20:23:53 1999 +++ modutils-2.3.5/man/depmod.8 Tue Oct 12 20:53:21 1999 @@ -2,14 +2,14 @@ .\" Copyright (c) 1995, 1999 Bjorn Ekwall (bj0rn@blox.se) .\" This program is distributed according to the Gnu General Public License. .\" See the file COPYING in the base distribution directory -.\" $Id: depmod.8 1.2 Fri, 08 Oct 1999 20:23:53 +1000 keith $ +.\" $Id: depmod.8 1.4 Tue, 12 Oct 1999 20:53:21 +1000 keith $ .\" -.TH DEPMOD 1 "March 15, 1999" Linux "Linux Module Support" +.TH DEPMOD 8 "October 12, 1999" Linux "Linux Module Support" .SH NAME depmod \- handle dependency descriptions for loadable kernel modules .SH SYNOPSIS .B depmod -\-a [\-enqsvV] +\-a [\-enqsvVr] [\-C\ configfile] [\-F\ kernelsyms] [\-b\ basedirectory] [forced_version] .br .B depmod @@ -41,6 +41,24 @@ .I \-V Show the release version name of .B depmod +.TP +.I \-r +Some users compile modules under a non-root userid then install the +modules as root. This process can leave the modules owned by the +non-root userid, even though the modules directory is owned by root. +If the non-root userid is compromised, an intruder can overwrite +existing modules owned by that userid and use this exposure to +bootstrap up to root access. +.TP +.I "" +By default, modutils will reject attempts to use a module that is not +owned by root. Specifying -r will suppress the error and allow root to +load modules that are not owned by root. +.TP +.I "" +.B Use of +.I -r +.B is a major security exposure and is not recommended. .PP The following options are useful for people managing distributions; .TP diff -Nur modutils-2.3.4/man/insmod.8 modutils-2.3.5/man/insmod.8 --- modutils-2.3.4/man/insmod.8 Fri Oct 8 20:23:53 1999 +++ modutils-2.3.5/man/insmod.8 Tue Oct 12 20:53:21 1999 @@ -1,14 +1,14 @@ .\" Copyright (c) 1996 Free Software Foundation, Inc. .\" This program is distributed according to the Gnu General Public License. .\" See the file COPYING in the kernel source directory. -.\" $Id: insmod.8 1.3 Fri, 08 Oct 1999 20:23:53 +1000 keith $ +.\" $Id: insmod.8 1.4 Tue, 12 Oct 1999 20:53:21 +1000 keith $ .\" -.TH INSMOD 1 "24 Aug 1999" Linux "Linux Module Support" +.TH INSMOD 8 "October 12 1999" Linux "Linux Module Support" .SH NAME insmod \- install loadable kernel module .SH SYNOPSIS .B insmod -[\-fkmpqsxXvyY] [\-P\ prefix] [\-o\ module_name] object_file [\ symbol=value\ ...\ ] +[\-fkmpqrsxXvyY] [\-P\ prefix] [\-o\ module_name] object_file [\ symbol=value\ ...\ ] .SH DESCRIPTION .B Insmod installs a loadable module in the running kernel. @@ -42,7 +42,7 @@ Output a load map, making it easier to debug the module in the event of a kernel panic. .TP -.I "\-o in_kernel" +.I "\-o \fRmodule_name" Explicitly name the module, rather than deriving the name from the base name of the source object file. .TP @@ -56,6 +56,24 @@ Do not complain about version mismatch. The problem will only be reflected in the exit status of insmod. .TP +.I \-r +Some users compile modules under a non-root userid then install the +modules as root. This process can leave the modules owned by the +non-root userid, even though the modules directory is owned by root. +If the non-root userid is compromised, an intruder can overwrite +existing modules owned by that userid and use this exposure to +bootstrap up to root access. +.TP +.I "" +By default, modutils will reject attempts to use a module that is not +owned by root. Specifying -r will suppress the error and allow root to +load modules that are not owned by root. +.TP +.I "" +.B Use of +.I -r +.B is a major security exposure and is not recommended. +.TP .I \-s Output everything to \fBsyslog\fP(3) instead of the terminal. .TP @@ -138,7 +156,7 @@ and when you process the log file. To help overcome this problem, if directory /var/log/ksymoops exists then insmod and rmmod will automatically copy /proc/ksyms and /proc/modules to /var/log/ksymoops -with a prefix of `date\ +%Y%m%d%T%M%S\ |\ sed\ -e\ 's/://g'`. +with a prefix of `date\ +%Y%m%d%H%M%S`. The system administrator can tell ksymoops which snapshot files to use when debugging an Oops. There is no switch to disable this automatic copy, if you do not want it to occur, do not create /var/log/ksymoops. @@ -147,16 +165,17 @@ is installed as insmod_clean_ksymoops. .PP .ne 8 +.nf #!/bin/sh - # Delete saved ksyms and modules not accessed in 7 days + # Delete saved ksyms and modules not accessed in 2 days if [ -d /var/log/ksymoops ] then set -e # Make sure there is always at least one version - d=`date +%Y%m%d%T%M%S | sed -e 's/://g'` + d=`date +%Y%m%d%H%M%S` cp -a /proc/ksyms /var/log/ksymoops/${d}.ksyms cp -a /proc/modules /var/log/ksymoops/${d}.modules - find /var/log/ksymoops -type f -atime +7 -exec rm {} \\; + find /var/log/ksymoops -type f -atime +2 -exec rm {} \\; fi .SH SEE ALSO \fBrmmod\fP(8), \fBmodprobe\fP(8), \fBdepmod\fP(8), \fBlsmod\fP(8), diff -Nur modutils-2.3.4/man/kdstat.8 modutils-2.3.5/man/kdstat.8 --- modutils-2.3.4/man/kdstat.8 Thu Jan 1 10:00:00 1970 +++ modutils-2.3.5/man/kdstat.8 Tue Oct 12 21:06:08 1999 @@ -0,0 +1,49 @@ +.\" $Id: kdstat.8 1.2 Tue, 12 Oct 1999 21:06:08 +1000 keith $ +.TH KDSTAT 8 "Debian GNU/Linux" "DEBIAN" +.SH NAME +kdstat \- program to show and change internal kerneld state +.SH SYNOPSIS +.B kdstat +.br +.B kdstat +.I "[debug|nodebug]" +.br +.B kdstat +.I "[keep|nokeep]" +.br +.B kdstat +.I "flush" +.br +.B kdstat +.I delay=