Re: SLFS

Spencer Collyer <[email protected]> Wed, 24 Dec 2003 23:57:55 +0000
Newsgroups gmane.linux.lfs.security
Organization Lasermount Limited
Message-ID <[email protected]>
On Wed, 24 Dec 2003 20:11:30 +0000, Spencer Collyer wrote:
> > Someone could start grepping the LFS source for the same functions
> > libsafe checks for, and report the method and results.
> 
> Sounds like something that I could do.
> ...
> 
> The manual on the libsafe homepage says it checks for the following
> functions:
> 
> strcpy, strcat, getwd, gets, [vf]scanf, realpath, [v]sprintf
> 

Right, didn't take anywhere near as long as I thought. I've uploaded the
results to the following location:

http://www.lasermount.uklinux.net/lfs-unsafe/

Filename unsafe.out holds the result of the grep. Filename searchall shows
the command I used to search the files.

Basically, what I did was as follows:

1) Untarred all packages.

2) Went through chapter 6 of the book, applying all patches. Reason I only
did chapter 6 was that I assume that the chapter 5 stuff is only going to
be used for building chapter 6, and that the /tools directory would then
be deleted (as is suggested in LFS 5.0).

3) Ran the command given at
http://www.lasermount.uklinux.net/lfs-unsafe/searchall. This is basically
a recursive 'grep', but to cut down on the amount of irrelevant info in
the output I excluded files matching the following filename patterns:

*.texi, *.texinfo, *.patch, *.bz2, *.info, *.gmo, *.po, *.pod, ChangeLog*,
changelog*, Changelog*, configure

4) I then did some minor tidy-ups on the resulting unsafe.out file, to
remove files that were obviously not source code. However, I worked on the
basis that it was better to have too much information than too little, so
this tidy-up was not comprehensive.

Hope this provides at least a start on this stuff.

S>

-- 
<<< Eagles may soar, but weasels don't get sucked into jet engines >>>
10:56pm up 13 days 5:17, 11 users, load average: 0.14, 0.49, 0.56
Registered Linux User #232457 | LFS ID 11703
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page