4 ms·

> I assume that cpio is very rarely used these days. From Wikipedia: > The use of cpio by the RPM Package Manager, in the initramfs program of Linux kernel 2.

by avian 6y ago

> I assume that cpio is very rarely used these days. From Wikipedia: > The use of cpio by the RPM Package Manager, in the initramfs program of Linux kernel 2.6, and in Apple's Installer (pax) make cpio an important archiving tool.

marcan_42 6y ago
All of which are administrative formats that do not include user data. I can't think of a way that this "feature" could be abused in those contexts to cause a security problem.
- sp332 6y ago
  If, say, an anti-virus program extracts an RPM's contents and scans each file separately, then it might miss files smuggled in that would be readable by malware with a custom cpio extractor.
rwmj 6y ago
RPM hasn't used true cpio for a while [since 2013] because cpio didn't support > 4GB files. It now uses its own format which it evolved from cpio.
- tyingq 6y ago
  Seems they still use the same logic though: https://github.com/rpm-software-management/rpm/blob/853c48ba6468ce1a516621a2fa6d1fc51e4f7410/lib/cpio.c#L49 https://github.com/rpm-software-management/rpm/blob/853c48ba...
  - rwmj 6y ago
    That doesn't actually matter though does it, because RPM is no longer using cpio, it's now using a custom format that happens to once have been related to cpio. What matters is what RPM does, not what cpio does. In this case it's not possible to create such an archive using rpmbuild as all files added to RPMs much start with "/". I just tried it and got: RPM build errors: File must begin with "/": TRAILER!!! You cannot hack on your own rpmbuild because you wouldn't be able to make a signed RPM (as those can only be built through the Koji build system which doesn't have your hacked rpmbuild), so you couldn't distribute that RPM to Fedora or Red Hat Enterprise Linux. In other words this is essentially a non-problem for RPM.
    - tyingq 6y ago
      The comparison is just to the filename, not including the path. You may be right, but that check doesn't prove it. Edit: Thanks for the reply! Apparently they are including the path.
      - rwmj 6y ago
        I can create an RPM containing a filename "TRAILER!!!" just fine: $ rpm -qlp /home/rjones/d/fedora/virt-what/master/x86_64/virt-what-1.20-1.fc33.x86_64.rpm /TRAILER!!! /usr/lib/.build-id /usr/lib/.build-id/59 /usr/lib/.build-id/59/59c1cb95689b7babd5a6cb1b5bc58f12e20b3a /usr/libexec/virt-what-cpuid-helper /usr/sbin/virt-what /usr/share/doc/virt-what /usr/share/doc/virt-what/COPYING /usr/share/doc/virt-what/README /usr/share/man/man1/virt-what.1.gz Furthermore I installed and uninstalled it with no ill effects, and the file was created and removed in /. So whatever problem cpio may have with this file does not affect the RPM-not-quite-cpio format.
philsnow 6y ago
I saw cpio archives in a .pkg file on mac as recently as last week so yeah very much still in use.

by avian 6y ago

marcan_42 6y ago

All of which are administrative formats that do not include user data. I can't think of a way that this "feature" could be abused in those contexts to cause a security problem.

sp332 6y ago
If, say, an anti-virus program extracts an RPM's contents and scans each file separately, then it might miss files smuggled in that would be readable by malware with a custom cpio extractor.

rwmj 6y ago

RPM hasn't used true cpio for a while [since 2013] because cpio didn't support > 4GB files. It now uses its own format which it evolved from cpio.

tyingq 6y ago
Seems they still use the same logic though: https://github.com/rpm-software-management/rpm/blob/853c48ba6468ce1a516621a2fa6d1fc51e4f7410/lib/cpio.c#L49 https://github.com/rpm-software-management/rpm/blob/853c48ba...
- rwmj 6y ago
  That doesn't actually matter though does it, because RPM is no longer using cpio, it's now using a custom format that happens to once have been related to cpio. What matters is what RPM does, not what cpio does. In this case it's not possible to create such an archive using rpmbuild as all files added to RPMs much start with "/". I just tried it and got: RPM build errors: File must begin with "/": TRAILER!!! You cannot hack on your own rpmbuild because you wouldn't be able to make a signed RPM (as those can only be built through the Koji build system which doesn't have your hacked rpmbuild), so you couldn't distribute that RPM to Fedora or Red Hat Enterprise Linux. In other words this is essentially a non-problem for RPM.
  - tyingq 6y ago
    The comparison is just to the filename, not including the path. You may be right, but that check doesn't prove it. Edit: Thanks for the reply! Apparently they are including the path.
    - rwmj 6y ago
      I can create an RPM containing a filename "TRAILER!!!" just fine: $ rpm -qlp /home/rjones/d/fedora/virt-what/master/x86_64/virt-what-1.20-1.fc33.x86_64.rpm /TRAILER!!! /usr/lib/.build-id /usr/lib/.build-id/59 /usr/lib/.build-id/59/59c1cb95689b7babd5a6cb1b5bc58f12e20b3a /usr/libexec/virt-what-cpuid-helper /usr/sbin/virt-what /usr/share/doc/virt-what /usr/share/doc/virt-what/COPYING /usr/share/doc/virt-what/README /usr/share/man/man1/virt-what.1.gz Furthermore I installed and uninstalled it with no ill effects, and the file was created and removed in /. So whatever problem cpio may have with this file does not affect the RPM-not-quite-cpio format.

philsnow 6y ago

I saw cpio archives in a .pkg file on mac as recently as last week so yeah very much still in use.