The scripts are written with certain expectations.
This expectation may not be properly met if the `IFS` value is changed.
This can potentially be used to create some sort of exploit.
Explicitly define IFS and then do so at a local variable scope to prevent affecting the callers IFS setting.
Simplify some of the Controller rules.
script:
start {
- if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
- xhost SI:localuser:some_user
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ $DISPLAY == "" ]] ; then
- export DISPLAY=:0.0
- fi
+ if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
+ xhost SI:localuser:some_user
+ fi
- export WEBKIT_DISABLE_COMPOSITING_MODE=1
+ if [[ $DISPLAY == "" ]] ; then
+ export DISPLAY=:0.0
+ fi
+
+ export WEBKIT_DISABLE_COMPOSITING_MODE=1
+ \}
+
+ main ${*}
}
command:
script:
start {
- if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
- xhost SI:localuser:some_user
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ $DISPLAY == "" ]] ; then
- export DISPLAY=:0.0
- fi
+ if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
+ xhost SI:localuser:some_user
+ fi
+
+ if [[ $DISPLAY == "" ]] ; then
+ export DISPLAY=:0.0
+ fi
+ \}
+
+ main ${*}
}
command:
script:
start {
- if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
- xhost SI:localuser:some_user
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ $DISPLAY == "" ]] ; then
- export DISPLAY=:0.0
- fi
+ if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
+ xhost SI:localuser:some_user
+ fi
+
+ if [[ $DISPLAY == "" ]] ; then
+ export DISPLAY=:0.0
+ fi
+ \}
+
+ main ${*}
}
command:
script:
start {
- if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
- xhost SI:localuser:some_user
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ $DISPLAY == "" ]] ; then
- export DISPLAY=:0.0
- fi
+ if [[ $(xhost | grep '^SI:localuser:some_user$') == "" ]] ; then
+ xhost SI:localuser:some_user
+ fi
+
+ if [[ $DISPLAY == "" ]] ; then
+ export DISPLAY=:0.0
+ fi
+ \}
+
+ main ${*}
}
command:
start {
main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
# Example PATH containing the FLL programs at a custom isolated directory.
PATH=/usr/local/fll/programs/shared/:$PATH
return 0
\}
- main
+ main ${*}
}
script:
start {
- if [[ ! -d /dev/pts ]] ; then
- mkdir /dev/pts
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ ! -d /dev/shm ]] ; then
- mkdir /dev/shm
- fi
+ if [[ ! -d /dev/pts ]] ; then
+ mkdir /dev/pts
+ fi
- exit 0
+ if [[ ! -d /dev/shm ]] ; then
+ mkdir /dev/shm
+ fi
+
+ return 0
+ \}
+
+ main ${*}
}
command:
script:
start {
- if [[ ! -d /var/run/init ]] ; then
- mkdir /var/run/init
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ if [[ ! -d /var/run/init ]] ; then
+ mkdir /var/run/init
+ fi
+ \}
+
+ main ${*}
}
script:
start {
- if [[ ! -f /proc/modules ]] ; then
- exit 0
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ -d /modules ]] ; then
- if [[ ! -e /modules/$(uname -r)/modules.dep ]] ; then
- depmod
- else
- depmod -A
+ if [[ ! -f /proc/modules ]] ; then
+ exit 0
fi
- fi
- exit 0
+ if [[ -d /modules ]] ; then
+ if [[ ! -e /modules/$(uname -r)/modules.dep ]] ; then
+ depmod
+ else
+ depmod -A
+ fi
+ fi
+
+ return 0
+ \}
+
+ main ${*}
}
script:
start {
- if [[ -d /proc/bus/usb ]] ; then
- mount /proc/bus/usb
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- exit 0
+ if [[ -d /proc/bus/usb ]] ; then
+ mount /proc/bus/usb
+ fi
+
+ return 0
+ \}
+
+ main ${*}
}
stop {
- if [[ -d /proc/bus/usb ]] ; then
- umount -l /proc/bus/usb
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ if [[ -d /proc/bus/usb ]] ; then
+ umount -l /proc/bus/usb
+ fi
+
+ return 0
+ \}
- exit 0
+ main ${*}
}
script:
start {
- if [[ ! -d /dev ]] ; then
- mkdir /dev
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+ local i=
- if [[ ! -d /dev/pts ]] ; then
- mkdir /dev/pts
- fi
+ for i in /dev /dev/pts /dev/shm /firmware /mnt /modules /proc /sys /tmp /var /var/log /var/run /var/tmp ; do
+ if [[ ! -d ${i} ]] ; then
+ mkdir ${i}
+ fi
+ done
- if [[ ! -d /dev/shm ]] ; then
- mkdir /dev/shm
- fi
+ return 0
+ \}
- if [[ ! -d /firmware ]] ; then
- mkdir /firmware
- fi
-
- if [[ ! -d /mnt ]] ; then
- mkdir /mnt
- fi
-
- if [[ ! -d /modules ]] ; then
- mkdir /modules
- fi
-
- if [[ ! -d /proc ]] ; then
- mkdir /proc
- fi
-
- if [[ ! -d /sys ]] ; then
- mkdir /sys
- fi
-
- if [[ ! -d /tmp ]] ; then
- mkdir /tmp
- fi
-
- if [[ ! -d /var ]] ; then
- mkdir /var
- fi
-
- if [[ ! -d /var/log ]] ; then
- mkdir /var/log
- fi
-
- if [[ ! -d /var/run ]] ; then
- mkdir /var/run
- fi
-
- if [[ ! -d /var/tmp ]] ; then
- mkdir /var/tmp
- fi
-
- exit 0
+ main ${*}
}
script:
start {
- ip addr add 127.0.0.1/8 label lo dev lo
- ip link set lo up
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ ip addr add 127.0.0.1/8 label lo dev lo
+ ip link set lo up
+ \}
+
+ main ${*}
}
stop {
- ip link set lo down
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ ip link set lo down
+ \}
+
+ main ${*}
}
script:
start {
- # This works if gpm service is run as root, but if not then this should be in a separate rule file with appropriate access to write to /var/run (don't forget to chown!).
- if [[ ! -d /var/run/mouse/ && -d /var/run ]] ; then
- mkdir /var/run/mouse/
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ # This works if gpm service is run as root, but if not then this should be in a separate rule file with appropriate access to write to /var/run (don't forget to chown!).
+ if [[ ! -d /var/run/mouse/ && -d /var/run ]] ; then
+ mkdir /var/run/mouse/
+ fi
+ \}
+
+ main ${*}
}
service:
script:
start {
- clock_file=/etc/clock
- clock_mode=
- clock_server=
- clock_ntpdate=
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ -f $clock_file ]] ; then
- clock_mode=$(fss_basic_read -can 0 mode $clock_file);
- clock_server=$(fss_basic_read -can 0 server $clock_file)
- clock_ntpdate=$(fss_basic_read -can 0 ntpdate $clock_file)
- fi
+ local clock_file=/etc/clock
+ local clock_mode=
+ local clock_server=
+ local clock_ntpdate=
- if [[ $clock_mode == "local" ]] ; then
- hwclock --hctosys;
- elif [[ $clock_mode == "ntp" ]] ; then
- if [[ $clock_ntpdate == "yes" ]] ; then
- ntpdate $clock_server &&
- hwclock --systohc --utc
+ if [[ -f $clock_file ]] ; then
+ clock_mode=$(fss_basic_read -can 0 mode $clock_file);
+ clock_server=$(fss_basic_read -can 0 server $clock_file)
+ clock_ntpdate=$(fss_basic_read -can 0 ntpdate $clock_file)
fi
- elif [[ $clock_mode == "ntpdate" && $clock_host != "" ]] ; then
- ntpdate $clock_server
- elif [[ $clock_mode == "utc" ]] ; then
- hwclock --hctosys --utc;
- fi
+
+ if [[ $clock_mode == "local" ]] ; then
+ hwclock --hctosys;
+ elif [[ $clock_mode == "ntp" ]] ; then
+ if [[ $clock_ntpdate == "yes" ]] ; then
+ ntpdate $clock_server &&
+ hwclock --systohc --utc
+ fi
+ elif [[ $clock_mode == "ntpdate" && $clock_host != "" ]] ; then
+ ntpdate $clock_server
+ elif [[ $clock_mode == "utc" ]] ; then
+ hwclock --hctosys --utc;
+ fi
+ \}
+
+ main ${*}
}
script:
start {
- clock_file=/etc/clock
- clock_mode=
- clock_server=
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- if [[ -f $clock_file ]] ; then
- clock_mode=$(fss_basic_read -can 0 mode $clock_file);
- clock_server=$(fss_basic_read -can 0 server $clock_file)
- fi
+ local clock_file=/etc/clock
+ local clock_mode=
+ local clock_server=
- if [[ $clock_mode == "ntpdate" && $clock_host != "" ]] ; then
- ntpdate $clock_server
- fi
+ if [[ -f $clock_file ]] ; then
+ clock_mode=$(fss_basic_read -can 0 mode $clock_file);
+ clock_server=$(fss_basic_read -can 0 server $clock_file)
+ fi
+
+ if [[ $clock_mode == "ntpdate" && $clock_host != "" ]] ; then
+ ntpdate $clock_server
+ fi
+ \}
+
+ main ${*}
}
script:
start {
- echo
- echo "Current ulimit is"
- ulimit -a
- sleep 5
-
- echo
- echo "Current cgroup for self (PPID $PPID, PID $$) is: '$(cat /proc/self/cgroup)'"
- sleep 5
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo
+ echo "Current ulimit is"
+ ulimit -a
+ sleep 5
+
+ echo
+ echo "Current cgroup for self (PPID $PPID, PID $$) is: '$(cat /proc/self/cgroup)'"
+ sleep 5
+ \}
+
+ main ${*}
}
command:
start {
- id
- sleep 5
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ id
+ sleep 5
+ \}
+
+ main ${*}
}
script:
script:
start {
- echo
- echo "==================================="
- echo "Environment using default settings."
- echo "==================================="
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- env
+ echo
+ echo "==================================="
+ echo "Environment using default settings."
+ echo "==================================="
+
+ env
+ \}
+
+ main ${*}
}
script:
start {
- echo
- echo "============================="
- echo "Environment allowing nothing."
- echo "============================="
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- env
+ echo
+ echo "============================="
+ echo "Environment allowing nothing."
+ echo "============================="
+
+ env
+ \}
+
+ main ${*}
}
script:
start {
- echo
- echo "=========================="
- echo "Environment allowing PATH."
- echo "=========================="
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- env
+ echo
+ echo "=========================="
+ echo "Environment allowing PATH."
+ echo "=========================="
+
+ env
+ \}
+
+ main ${*}
}
script:
start {
- echo
- echo "================================="
- echo "Exported Environment is isolated."
- echo "================================="
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
- export custom_variable="is not retained"
- echo "export custom_variable='$custom_variable'"
- echo
- echo "Now for 'env' command:"
+ echo
+ echo "================================="
+ echo "Exported Environment is isolated."
+ echo "================================="
+
+ export custom_variable="is not retained"
+ echo "export custom_variable='$custom_variable'"
+ echo
+ echo "Now for 'env' command:"
+ \}
+
+ main ${*}
}
command:
script:
start {
- echo "kaboooom!"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "kaboooom!"
+ \}
+
+ main ${*}
}
script:
start {
- if [[ ! -d "parameter:"socket"" ]] ; then
- mkdir parameter:"verbose" -p parameter:"socket"
- fi
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ if [[ ! -d "parameter:"socket"" ]] ; then
+ mkdir parameter:"verbose" -p parameter:"socket"
+ fi
+ \}
+
+ main ${*}
}
script:
start {
\#!/bin/bash
+
my_function() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
echo "Hello this is the last script, it should trigger failure."
+
return 1;
\}
script:
start {
\#!/bin/bash
- echo "====================================="
- env
- echo "====================================="
- echo "IKI Path is 'define:"PATH"'"
- echo "IKI define IKI_TEST 'define:"IKI_TEST"'"
- echo "ENV IKI_TEST '$IKI_TEST'"
- echo "Some Parameter is 'parameter:"some"'"
- echo "Unknown parameter is: 'parameter:"unknown"'"
- echo "Unknown environment is: 'define:"unknown"'"
- echo "Unavailable environment via IKI: 'define:"USER"'"
- echo "Unavailable environment via ENV: '$USER'"
- echo "Program parameter verbose: 'program:"verbose"'"
- echo "Program parameter verbose(option): 'program:"verbose:option"'"
- echo "Program parameter verbose(value): 'program:"verbose:value"'"
- echo "Program parameter PID: 'program:"pid"'"
- echo "Program parameter PID(option): 'program:"pid:option"'"
- echo "Program parameter PID(value): 'program:"pid:value"'"
- echo "====================================="
+
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "====================================="
+ env
+ echo "====================================="
+ echo "IKI Path is 'define:"PATH"'"
+ echo "IKI define IKI_TEST 'define:"IKI_TEST"'"
+ echo "ENV IKI_TEST '$IKI_TEST'"
+ echo "Some Parameter is 'parameter:"some"'"
+ echo "Unknown parameter is: 'parameter:"unknown"'"
+ echo "Unknown environment is: 'define:"unknown"'"
+ echo "Unavailable environment via IKI: 'define:"USER"'"
+ echo "Unavailable environment via ENV: '$USER'"
+ echo "Program parameter verbose: 'program:"verbose"'"
+ echo "Program parameter verbose(option): 'program:"verbose:option"'"
+ echo "Program parameter verbose(value): 'program:"verbose:value"'"
+ echo "Program parameter PID: 'program:"pid"'"
+ echo "Program parameter PID(option): 'program:"pid:option"'"
+ echo "Program parameter PID(value): 'program:"pid:value"'"
+ echo "====================================="
+ \}
+
+ main ${*}
}
script:
start {
- echo "Serial 1: sleeping $(date -u)"
- sleep 1
- echo "Serial 1: slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 1: sleeping $(date -u)"
+ sleep 1
+ echo "Serial 1: slept $(date -u)"
+ \}
+
+ main ${*}
}
stop {
- echo "Serial 1: stopping, sleeping $(date -u)"
- sleep 1
- echo "Serial 1: stopping, slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 1: stopping, sleeping $(date -u)"
+ sleep 1
+ echo "Serial 1: stopping, slept $(date -u)"
+ \}
+
+ main ${*}
}
script:
start {
- echo "Serial 2: sleeping $(date -u)"
- sleep 1
- echo "Serial 2: slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 2: sleeping $(date -u)"
+ sleep 1
+ echo "Serial 2: slept $(date -u)"
+ \}
+
+ main ${*}
}
stop {
- echo "Serial 2: stopping, sleeping $(date -u)"
- sleep 1
- echo "Serial 2: stopping, slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 2: stopping, sleeping $(date -u)"
+ sleep 1
+ echo "Serial 2: stopping, slept $(date -u)"
+ \}
+
+ main ${*}
}
script:
start {
- echo "Serial 3: sleeping $(date -u)"
- sleep 1
- echo "Serial 3: slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 3: sleeping $(date -u)"
+ sleep 1
+ echo "Serial 3: slept $(date -u)"
+ \}
+
+ main ${*}
}
stop {
- echo "Serial 3: stopping, sleeping $(date -u)"
- sleep 1
- echo "Serial 3: stopping, slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 3: stopping, sleeping $(date -u)"
+ sleep 1
+ echo "Serial 3: stopping, slept $(date -u)"
+ \}
+
+ main ${*}
}
script:
start {
- echo "Serial 4: sleeping $(date -u)"
- sleep 1
- echo "Serial 4: slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 4: sleeping $(date -u)"
+ sleep 1
+ echo "Serial 4: slept $(date -u)"
+ \}
+
+ main ${*}
}
stop {
- echo "Serial 4: stopping, sleeping $(date -u)"
- sleep 1
- echo "Serial 4: stopping, slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 4: stopping, sleeping $(date -u)"
+ sleep 1
+ echo "Serial 4: stopping, slept $(date -u)"
+ \}
+
+ main ${*}
}
script:
start {
- echo "Serial 5: sleeping $(date -u)"
- sleep 1
- echo "Serial 5: slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 5: sleeping $(date -u)"
+ sleep 1
+ echo "Serial 5: slept $(date -u)"
+ \}
+
+ main ${*}
}
stop {
- echo "Serial 5: stopping, sleeping $(date -u)"
- sleep 1
- echo "Serial 5: stopping, slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 5: stopping, sleeping $(date -u)"
+ sleep 1
+ echo "Serial 5: stopping, slept $(date -u)"
+ \}
+
+ main ${*}
}
script:
start {
- echo "Serial 6: sleeping $(date -u)"
- sleep 1
- echo "Serial 6: slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 6: sleeping $(date -u)"
+ sleep 1
+ echo "Serial 6: slept $(date -u)"
+ \}
+
+ main ${*}
}
stop {
- echo "Serial 6: stopping, sleeping $(date -u)"
- sleep 1
- echo "Serial 6: stopping, slept $(date -u)"
+ main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
+ echo "Serial 6: stopping, sleeping $(date -u)"
+ sleep 1
+ echo "Serial 6: stopping, slept $(date -u)"
+ \}
+
+ main ${*}
}
\#!/bin/bash
main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
if [[ -f /tmp/sleeper_1.pid ]] ; then
echo "Failure: pid file '/tmp/sleeper_1.pid' already exists."
return 1
echo "Sleeper 1, done sleeping."
rm -f /tmp/sleeper_1.pid
+
return 0
\}
\#!/bin/bash
main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
if [[ -f /tmp/sleeper_2.pid ]] ; then
echo "Failure: pid file '/tmp/sleeper_2.pid' already exists."
return 1
echo "Sleeper 2, done sleeping."
rm -f /tmp/sleeper_2.pid
+
return 0
\}
\#!/bin/bash
main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
if [[ -f /tmp/sleeper_3.1.pid ]] ; then
echo "Failure: pid file '/tmp/sleeper_3.1.pid' already exists."
return 1
echo "Sleeper 3.1, done sleeping."
rm -f /tmp/sleeper_3.1.pid
+
return 0
\}
- main &
+ main ${*} &
}
utility:
\#!/bin/bash
main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
+
if [[ -f /tmp/sleeper_3.2.pid ]] ; then
echo "Failure: pid file '/tmp/sleeper_3.2.pid' already exists."
return 1
echo "Sleeper 3.2, done sleeping."
rm -f /tmp/sleeper_3.2.pid
+
return 0
\}
- main &
+ main ${*} &
}
#
install_main() {
+ local IFS=$' \t\n' # Prevent IFS exploits by overriding with a local scope.
if [[ ${SHELL_ENGINE} == "zsh" ]] ; then
emulate ksh
unset install_cleanup
}
-install_main $*
+install_main ${*}
projects / controller / commitdiff