Re: [PATCH] libbpf: don't preserve ownership during install

Martin Kaiser <[email protected]>
Newsgroups dev.linux.lists.sashiko-reviews,org.kernel.vger.bpf
Message-ID <amhm4G33dMpLJx/[email protected]>
Thus wrote [email protected] ([email protected]):

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] The use of the GNU-specific `cp --preserve` extension breaks `make install` on platforms with BSD or BusyBox `cp` implementations (e.g., macOS, FreeBSD, Alpine).
> --

> --- Patch [1]: [PATCH] libbpf: don't preserve ownership during install ---
> commit 20b6f948388a1067581300a57d47fc33d1950c11
> Author: Martin Kaiser <[email protected]>

> libbpf: don't preserve ownership during install

> This commit modifies the libbpf install_lib target in the Makefile to
> prevent leaking the source tree owner's UID into the root filesystem. It
> replaces the cp -p flag with the --preserve=mode,timestamps flag to only
> preserve specific file attributes during installation.

> > diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
> > --- a/tools/lib/bpf/Makefile
> > +++ b/tools/lib/bpf/Makefile
> > @@ -231,7 +231,7 @@ endef
> >  install_lib: all_cmd
> >  	$(call QUIET_INSTALL, $(LIB_TARGET)) \
> >  		$(call do_install_mkdir,$(libdir_SQ)); \
> > -		cp -fpR $(LIB_FILE) $(DESTDIR)$(libdir_SQ)
> > +		cp -fR --preserve=mode,timestamps $(LIB_FILE) $(DESTDIR)$(libdir_SQ)

> [Severity: Medium]
> Will this break the installation process on platforms that do not use GNU
> coreutils?

> The --preserve argument is a GNU-specific extension. It appears this might
> cause the make install target to fail with an unrecognized option error on
> systems relying on BSD or BusyBox implementations of cp, such as macOS,
> FreeBSD, or Alpine Linux.


commit 1375152bb02a ("tools: lib: thermal: don't preserve owner in install")
makes a similar change for tools/lib/thermal/Makefile.

I'd assume that it's reasonable to require coreutils for kernel compilation.

AFAICS, kernel builds on Alpine linux require the alpine-sdk package which
contains coreutils.

Thanks,
Martin
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.