Some libaplm utilities sync databases as a non-root user for use in
actvities other than system updates. The ability to download as a
non-root user was broken as part of the download sandboxing.
Applying a minimial fix by preventing the chown of the downloaded file
if the user is non-root. A larger change increasing the robustness
and error checking of this path is warranted in the future.
Signed-off-by: Allan McRae <allan@archlinux.org>
Sorting modifies the list in place, causing any existing pointers to the
list to point to a random element.
Fixes#165
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
If a package was already downloaded but its signature file was not,
pacman would download the signature then error out despite all files
being present.
Also fixes a similar error when some, but not all, package databases
were updated with -Sy.
Fixes#156
Signed-off-by: Allan McRae <allan@archlinux.org>
The calculation used the size of the package rather than the amount
remaining to download for partially downloaded packages.
Signed-off-by: Allan McRae <allan@archlinux.org>
Bailing early when there are 0 blocks remaining means that we do not call
memchr on a NULL string (although with a 0 size parameter). Fixes issues
reported using -fsanitise=address,undefined
Signed-off-by: Allan McRae <allan@archlinux.org>
The dir_is_mountpoint() function has the explicit requirement that the
trailing slash of the directory is present. We strip the trailing slash
in unlink_file() to handle directories replaced with symlinks, but that
then affects the dir_is_mountpoint() check.
Add the trailing slash when we have established we are dealing with a
directory. Note this may fail in the case of a file managed by pacmane
with name length of PATH_MAX that has been replaced by a directory on the
file system. Bail on this unlikely scenario.
In addtion, be less fancy with adjusting length of the file char array.
Signed-off-by: Allan McRae <allan@archlinux.org>
A filelist can be non-NULL but empty (particularly with a lot of
NoExtract entries). Handle this in alpm_filelist_contains()
Identified using the undefined behaviour sanitizer.
Signed-off-by: Allan McRae <allan@archlinux.org>
Filling in more of the payload fields before passing to the downloader ensures
that the these fields do not get lost during sandboxed operations.
It also fixes the use of -U with XferCommand, but testsuite still fails due to
"404" page being downloaded for the signature. Given we can not identify this
as being a non-signature download with the XferCommand, we can just turn off
signature checking in this test.
Signed-off-by: Allan McRae <allan@archlinux.org>
If the SandboxUser configure option is set, the internal downloader
will fork of a child process and drop to the specified user to download
the files.
Signed-off-by: Remi Gacogne <rgacogne@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
Add log and download callbacks to use within a sandbox. These are
designed to be passed from the sandbox to the parent through a file
descriptor and then processed into alpm callbacks to be passed to the
frontend.
Note, only callbacks used in libalpm are added. Other callbacks should
be set to NULL in the child process.
Add alpm_sandbox_child() function that will be used for switching to a
less priviledged user to run child processes.
Signed-off-by: Allan McRae <allan@archlinux.org>
The DownloadUser option will be used to drop privledges to the
specified user when downloading files.
The intention is for this to be extended in the future to a more
general sandbox configuration to cover operating on package and
database files prior to verification.
Add this option to pacman configuration and the various accessors into
the libalpm backend.
Signed-off-by: Allan McRae <allan@archlinux.org>
Previously, the for loops on lines 1035 and 1037 would advance to the
next element in the server list, even if downloading the URL succeeded.
If there are no more servers in the list, `s` would be NULL, causing
a NULL pointer dereference on line 1046. If there were servers left
in the list, the signature would be downloaded from a wrong URL.
1. Fetching of database signatures is enabled.
2. There is only one enabled remote repository URL, or fetching from
all but the last one fails and fetching from the last one succeeds.
3. An XferCommand is used.
Qubes OS Arch templates satisfy all of these conditions and trigger the bug.
atio's behaviour is undefined if the input is not valid. Also it does
all sorts of whitespace and prefix handling which we don't need for
pkgreason.
Instead of going into UB on invalid input we now return EXPLICIT as the
fallback and print an error. However we don't actually error out as the
DB parsing tries to be error tolerant.
Signed-off-by: Allan McRae <allan@archlinux.org>
alpm has certain requirements for package metadata necessary for proper
functioning, name and version in particular. These requirements are
already enforced in makepkg, but nowhere in alpm.
Exceptions are treated as errors for non-local packages because they
cannot be installed without potentially resulting in undefined behavior.
Exceptions for local packages are treated as warnings because they are
already installed, so any damage has already been done, and the user
would otherwise have no way to uninstall them.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
The error path uconditinally tries to free the archive, leading to a
double-free segmentation fault if the error path is triggered after
already freeing it.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
The free function was checking DB_STATUS_PKGCACHE, which is only set
once the package cache has been fully built.
Signed-off-by: Andrew Gregory <andrew.gregory.8@gmail.com>
