|
|
Sponsored Content
Top Forums
Shell Programming and Scripting
Safely parsing parameters
Post 302406601 by Corona688 on Tuesday 23rd of March 2010 11:18:01 AM
03-23-2010
Sorry, I didn't notice this reply.
They are strings being fed into the kernel commandline itself, and being processed by my initramfs system by a full-fledged BASH shell. It occurred to me that splitting at the shell level like this was both very powerful and perilous, so I wondered if there was a general solution to this whole class of problems.
The perl solution looks very nice. It wouldn't be hard to feed it backticks instead of processing them first the way I get the data from the kernel. Unfortunately perl is a bit weighty to cram into an initramfs bootstrap loader.
But on second thought -- doesn't perl have backticks too?
I don't think my original post was "unbelievably vague". The problem is the same no matter what the ultimate purpose -- splitting arguments intelligently in a shell without permitting any expansions or substitutions. Whether or not the code is executing with elevated permissions, this isn't the sort of thing you want to allow just incidentally.
To process and evaluate the commands I must first divide them so I know what it would actually be doing, otherwise I'm just doing ad-hoc "injection rejection". I could write my own char-by-char shell parser inside the shell I suppose but this seems overkill. I could also make an escape-everything regex to make the string safe before eval-ing it but it's hard to prove there's absolutely no holes or omissions in a system like that. Or I could just strip out all dollar signs and backticks, but what if someday I need to pass a literal backtick for some reason?
I was hoping there was some obvious and more elegant way I was missing I suppose. Oh well, thanks for your responses.
They are strings being fed into the kernel commandline itself, and being processed by my initramfs system by a full-fledged BASH shell. It occurred to me that splitting at the shell level like this was both very powerful and perilous, so I wondered if there was a general solution to this whole class of problems.
The perl solution looks very nice. It wouldn't be hard to feed it backticks instead of processing them first the way I get the data from the kernel. Unfortunately perl is a bit weighty to cram into an initramfs bootstrap loader.
But on second thought -- doesn't perl have backticks too?I don't think my original post was "unbelievably vague". The problem is the same no matter what the ultimate purpose -- splitting arguments intelligently in a shell without permitting any expansions or substitutions. Whether or not the code is executing with elevated permissions, this isn't the sort of thing you want to allow just incidentally.
To process and evaluate the commands I must first divide them so I know what it would actually be doing, otherwise I'm just doing ad-hoc "injection rejection". I could write my own char-by-char shell parser inside the shell I suppose but this seems overkill. I could also make an escape-everything regex to make the string safe before eval-ing it but it's hard to prove there's absolutely no holes or omissions in a system like that. Or I could just strip out all dollar signs and backticks, but what if someday I need to pass a literal backtick for some reason?
I was hoping there was some obvious and more elegant way I was missing I suppose. Oh well, thanks for your responses.
Last edited by Corona688; 03-23-2010 at 12:37 PM..
|
|
9 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
How do you pass parameters over to another script and run the receiving script? .
Here is an example of what I am talking about.
for x in `cat Allx`
do
su myaccount -c "/temp/scripts/temp_script $x" > /dev/null 2>$1 $
done
I was expecting the tem_script to be... (1 Reply)
Discussion started by: odogbolu98
1 Replies
2. Shell Programming and Scripting
Hi:- I need to parse a script 3 parameters (file, subject and email address). This is what I currently have:
allargs=$*
argcount=`echo $allargs | awk -F: '{ print NF }' ` # Total Number of arguments
pdffile=`echo $allargs | awk -F: '{ print $1 }' ` # PDF/binary file to be encoded... (4 Replies)
Discussion started by: janet
4 Replies
3. UNIX for Advanced & Expert Users
Sceduled backups with vdump have been delayed as a mounted system had crashed while I was away for 2 weeks. Now there are 5 simultaneous vdumps running very slowly. The full system backup usually takes a whole weekend.
Can I safely kill these? (I will have to live without a backup untill next... (4 Replies)
Discussion started by: nickt
4 Replies
4. Shell Programming and Scripting
I have a job script that runs with input parms from the command line.
job.sh -p parm1_parm2_parm3_parm4_file_1.dat
The parms are separated by _
The last parm is a file name and can have an _ in the name.
I currently use the following commands to extract the parms
parm1=`eval echo... (3 Replies)
Discussion started by: jclanc8
3 Replies
5. Shell Programming and Scripting
Hi all,
Am writing a script that does a rm/mv if a file exist, however, in one scenario, one of the variables which is supposed to a variable for a directory is undefined/blank so instead of the variable resolving to /tmp/logfile.dmp, it resolves instead to / so the rm translates to a rm /... (2 Replies)
Discussion started by: newbie_01
2 Replies
6. Programming
I get a strange problem here, and ask for help.
(gdb)
28 set_file_bit( file, bytePos, bitPos, argv );
(gdb) p argv
$3 = 0xbfffef5c "00"
(gdb) s
set_file_bit (file=0x804b008, bytePos=2, bitPos=2, binary=0x80490e5 "11") at util/file.c:112
... (2 Replies)
Discussion started by: 915086731
2 Replies
7. Solaris
Greetings,
I need some help performing a system admin function that I have been tasked with. The request seems simple enough, but my feeling is that it might be more complicated than it seems.
Here is what i've been tasked with:
SunOS 5.10 Generic_142900-15 sun4u sparc SUNW,SPARC-Enterprise... (3 Replies)
Discussion started by: Harleyrci
3 Replies
8. Solaris
I am using:
reboot -- cdrom
However I'm afraid of causing file system errors/corruption. I've seen many threads say that
init 6
is safer, but I need to get to CDROM.
Is there a command that is as safe as init, but can boot to cdrom, or should I not worry so much about the reboot... (5 Replies)
Discussion started by: lcoreyl
5 Replies
9. Red Hat
I wanted to know whether all files under /tmp can be safely removed. I guess that /tmp may also have temporary files for applications currently being worked on, so at the most those applications may just shut down.
I hope that my question is clear whether all files under /tmp can be safely... (5 Replies)
Discussion started by: RHCE
5 Replies
LEARN ABOUT LINUX
update-initramfs
UPDATE-INITRAMFS(8) update-initramfs manual UPDATE-INITRAMFS(8) NAME
update-initramfs - generate an initramfs image SYNOPSIS
update-initramfs -c|-d|-u [-k version] [-t] [-v] [-b] [-h] DESCRIPTION
The update-initramfs script manages your initramfs images on your local box. It keeps track of the existing initramfs archives in /boot. There are three modes of operation create, update or delete. You must at least specify one of those modes. The initramfs is a gzipped cpio archive. At boot time, the kernel unpacks that archive into RAM disk, mounts and uses it as initial root file system. All finding of the root device happens in this early userspace. OPTIONS
-k version Set the specific kernel version for whom the initramfs will be generated. For example the output of uname -r for your currently running kernel. This argument is optional for update. The default is the latest kernel version. The use of "all" for the version string specifies update-initramfs to execute the chosen action for all kernel versions, that are already known to update-initramfs. -c This mode creates a new initramfs. -u This mode updates an existing initramfs. -d This mode removes an existing initramfs. -t Allows one to take over an custom initramfs with a newer one. -v This option increases the amount of information you are given during the chosen action. -b Set an different bootdir for the image creation. -h Print a short help page describing the available options in update-initramfs. EXAMPLES
Update the initramfs of the newest kernel: update-initramfs -u Create the initramfs for a specific kernel: update-initramfs -c -k 2.6.18-1-686 FILES
/etc/initramfs-tools/update-initramfs.conf AUTHOR
The initramfs-tools are written by Maximilian Attems <maks@debian.org>, Jeff Bailey <jbailey@raspberryginger.com> and numerous others. SEE ALSO
initramfs.conf(5), initramfs-tools(8), mkinitramfs(8). Linux 2008/12/19 UPDATE-INITRAMFS(8)