coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-11 05:52:36 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,853 Commits 22 Branches 45 Tags
292f504524b6f6a1574e4b3e1d690a1bc31fec2f
Commit Graph

3853 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leah Rowe 292f504524 nvmutil: stronger entropy_jitter() 
run it for a bit longer

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 464fb5c0d8 util/nvmutil: don't use strcpy 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe cf8cb4bdcc util/nvmutil: check fd path in try_fdpath 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe ab8929808f util/nvmutil: add bound check to x_try_fdpath 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 8911d2c1dd another comment 
it's a pretty insane hack. i should probably
just use normal fchmod

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe c6ae1d5ea2 comment 
also improved the macro, making it stricter

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 6e6ab09cb0 cleanup (fix potential overflow in mkstemp) 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 47a654a870 fsync_dir: abort if path length is empty 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe d0a125c16d nvmutil: prevent theoretical overflow on time() 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 28820d169c also O_NOFOLLOW 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 1207b1bb72 util/nvmutil: dir fsync with O_DIRECTORY 
guards against replacement attacks, on systems
that support this flag

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe ddb0bc314d util/nvmutil: fix mkstemp randomness 
i made the string longer, but forgot
to adjust it. the new random function
is also better

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe b951ef2433 cast 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 251ba82ccb util/nvmutil: more reliable fallback crypto 
we assume the fallback will be rare, so now we
make the mix static and keep xoring it, on the
theory that the number of failures on urandom
will be random, and tthat the fallback may only
apply once or twice in thousands of calls.

the time jitter is adjusted; rather than judge
the difference between two points close to each
other in time, we judge tthe randomness in
difference of time elapsed. this mitigates fast
CPUs being very fast and introducing rounding
errors, and also improves performonce on much
slower CPUs

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe a575a47733 util/nvmutil: use real rename() syscall 
i was being cute earlier, but the rewrite
defeats the purpose of atomic file handling
in nvmutil, by not actually renaming! it was
more like, doing an actual copy, which meant
that corruption is likely during power loss

i've commented the code because i may
use it in a library in the future.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 8e2921f1ce nvmutil: harden against hardlink attacks 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 4871f4fda7 redundancy 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 0237c9c9c6 util/nvmutil: loop EINTR on fsync 
this improves reliability, making it more
likely that data actually gets synced,
since fsync can return -1 with EINTR,
indicating that a re-try should be
attempted.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 5ce5ac2994 pointer safety 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 7b62a1653b don't use PATH_MAX 
unreliable

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 1883325cd0 macro safety 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 2b3966feba util/nvmutil: portable S_IFMT 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 7650ab051f util/nvmutil: remove integer typedefs 
better to just use standard names

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 445e96aefc util/nvmutil: remove global statics 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 28a499e556 util/nvmutil: fix unveil usage 
arandom probably isn't available on super old obsd right??????

rather, unveil isn't. on systems that have arandom

yet we should not unveil something that may not
exist on modern systems

just don't unveil arandom, and don't check arandom
if unveil is enabled

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 96dde65d16 util/nvmutil: proper /dev/fd search in fchmod 
some systems may not even have it

works with /dev/fd (bsd/mac etc)

works with linux (/proc/self/fd)

and falls back on super old systems
that have neither

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 120241f1cf util/nvmutil: tidy up makefile options 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe c46a634288 nope. put -Werror in the makefile 
not compiling without it is a bug

don't let the default exclude it

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 71ce22a938 nvmutil makefile: define WERROR but blank it 
settting it to -Werror is wrong, should set
it not -Werror.

however, put the WERROR variable in the make
command. that way, i could test with

make WERROR=-Werror

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe af40114be7 util/nvmutil: portable fchmod 
and with that, now the code compiles on gcc
with -std=c90 -pedantic

with -Werror and -Wall -Wextra

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe a0fd201b31 Revert "util/nvmutil: don't use fsync()" 
This reverts commit bdb43afac6edef21a15f99b8c3beac01be8b86f7.
 2026-03-26 06:59:41 +00:00
Leah Rowe e6b53e8aed util/nvmutil: longer string in mkstemp 
have A-Z too, for more randomness

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe ad5a4771bf util/nvmutil: don't use mktemp 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe f365969d34 util/nvmutil: don't declare libc prototypes 
i no longer use -Werror

these can actually conflict on some weird
systems, so better just remove them

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 5927c175df util/nvmutil: portable memcpy/memcmp 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 612783bc24 util/nvmutil: more portable close() 
close may set errno to EINTR, which could
cause weird edge case behaviour in our
prw() functtion

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 26d8807b79 util/nvmutil: more secure tmpdir() 
use stat instead of access (race conditions)

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 1ce06b01e0 util/nvmutil: fix O_NONBLOCK fallback 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 15cbafe20b util/nvmutil: more secure mkstemp 
try a few more times until success

explicitly return EEXIST when needed

we try multiple times and check more
thoroughly if a file exists, thus
reducing the risk of race conditions

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 24c4e715e6 util/nvmutil: more reliable TMPDIR handling 
more portable

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 0e0fcd5a81 util/nvmutil: don't use fsync() 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 4233f76fee util/nvmutil: more portable functtions 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 64835e67fd util/nvmutil: add portable malloc extern 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 0043446f60 util/nvmutil: don't use size_t/ssize_t 
not portable. some old systems don't have it,
or handle it very poorly

unsigned long is a reasonable way to refer
to indexes inside pointters

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe a8fe2c79db util/nvmutil: don't use SSIZE_MAX (not portable) 
some old systems don't have ssize_t or size_t

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 6c37d2aa4b util/nvmutil: typeset size_t explicitly 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe ae43dc391f util/nvmutil: run-time CHAR_BIT test 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe ab806d2546 util/nvmutil: lower default PATH_LEN 
older unix needed lower

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 9bdd91131d util/nvmutil: portable struct timeval 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe ea71010f85 util/nvmutil: portable S_ISREG 
very old libc doesn't have it

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00