Add support for ~/.mrtrust, which can be used to list trusted mrconfig files.

If you create this file, all files not listed in it will be treated as
untrusted, and carefully limited in what they can do. This improves
security when using mrconfig files provided by others.

diff --git a/TODO b/TODO
index 511ed8bf2f6e7768e26cad94533728b3fa77e8a8..f5158cf47c9aa7a0521dbcf6976a8b7a86b1159c 100644 (file)
--- a/TODO
+++ b/TODO
@@ -1,3 +1,6 @@
+* For compatability, ~/.mrtrust has to exist before trust checks are
+  enabled. Change this in a flag day.
+

 * more revision control systems
 
 * a way to detect repos in a tree that are not registered, and warn
 * more revision control systems
 
 * a way to detect repos in a tree that are not registered, and warn

diff --git a/debian/changelog b/debian/changelog
index f37cbf11730318c7d888a4b21cb343438eb7baa7..1bedae6adc2d052efb02e13fcf85d96afbfdb3f7 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+mr (0.42) UNRELEASED; urgency=low
+
+  * Add support for ~/.mrtrust, which can be used to list trusted mrconfig
+    files. If you create this file, all files not listed in it will be treated
+    as untrusted, and carefully limited in what they can do. This improves
+    security when using mrconfig files provided by others.
+
+ -- Joey Hess <joeyh@debian.org>  Fri, 07 Aug 2009 01:10:39 -0400
+

 mr (0.41) unstable; urgency=low
 
   * Add -p switch, that makes mr search the current directory and its
 mr (0.41) unstable; urgency=low
 
   * Add -p switch, that makes mr search the current directory and its

diff --git a/mr b/mr
index fd380dbe80b2657260caae2e840f8ca9a2b42b58..0c34e46c0c62fe61135e2591a1adbed8a5b52a32 100755 (executable)
--- a/mr
+++ b/mr
@@ -45,6 +45,10 @@ working directory. Or, if you are in a subdirectory of a repository that
 contains no other registered repositories, it will stay in that directory,
 and work on only that repository,
 
 contains no other registered repositories, it will stay in that directory,
 and work on only that repository,
 

+B<mr> is configured by .mrconfig files, which list the repositories. It
+starts by reading the .mrconfig file in your home directory, and this can
+in turn chain load .mrconfig files from repositories.
+

 These predefined commands should be fairly familiar to users of any revision
 control system:
 
 These predefined commands should be fairly familiar to users of any revision
 control system:
 


@@ -105,9 +109,6 @@ These commands are also available:
 Causes mr to download the url, save it to a .mrconfig file in the
 current directory, and then check out all repositories listed in it.
 
 Causes mr to download the url, save it to a .mrconfig file in the
 current directory, and then check out all repositories listed in it.
 

-(Please only do this if you have reason to trust the url, since
-mrconfig files can contain arbitrary commands!)
-

 =item list (or ls)
 
 List the repositories that mr will act on.
 =item list (or ls)
 
 List the repositories that mr will act on.


@@ -234,11 +235,7 @@ a good speedup in updates without loading the machine too much.
 
 =back
 
 
 =back
 

-=head1 FILES
-
-B<mr> is configured by .mrconfig files. It starts by reading the .mrconfig
-file in your home directory, and this can in turn chain load .mrconfig files
-from repositories.
+=head1 "MRCONFIG FILES"

 
 Here is an example .mrconfig file:
 
 
 Here is an example .mrconfig file:
 


@@ -319,8 +316,7 @@ repository, ordering it to be processed earlier is not recommended.
 =item chain
 
 If the "chain" parameter is set and its command returns true, then B<mr>
 =item chain
 
 If the "chain" parameter is set and its command returns true, then B<mr>

-will try to load a .mrconfig file from the root of the repository. (You
-should avoid chaining from repositories with untrusted committers.)
+will try to load a .mrconfig file from the root of the repository.

 
 =item include
 
 
 =item include
 


@@ -356,6 +352,21 @@ due to being offline. You can delete or edit this file to remove commands,
 or even to add other commands for 'mr online' to run. If the file is
 present, mr assumes it is in offline mode.
 
 or even to add other commands for 'mr online' to run. If the file is
 present, mr assumes it is in offline mode.
 

+=head "UNTRUSTED MRCONFIG FILES"
+
+Since mrconfig files can contain arbitrary shell commands, they can do
+anything. This flexability is good, but it also allows a malicious mrconfig
+file to delete your whole home directory. Such a file might be contained
+inside a repository that your main ~/.mrconfig checks out. To avoid worries
+about a malicious change being committed to such a file, mr has the ability
+to read mrconfig files in untrusted mode. Such files are limited to running
+only known safe commands (like "git clone").
+
+By default, mr trusts all mrconfig files. (This default will change in a
+future release!) But if you have a ~/.mrtrust file, mr will only trust
+mrconfig files that are listed within it. (One file per line.) All other
+files will be treated as untrusted.
+

 =head1 EXTENSIONS
 
 mr can be extended to support things such as unison and git-svn. Some
 =head1 EXTENSIONS
 
 mr can be extended to support things such as unison and git-svn. Some


@@ -788,6 +799,114 @@ sub expandenv {
        return $val;
 }
 
        return $val;
 }
 

+my %trusted;
+sub is_trusted_config {
+       my $config=shift; # must be abs_pathed already
+
+       # We always trust ~/.mrconfig.
+       return 1 if $config eq abs_path("$ENV{HOME}/.mrconfig");
+
+       my $trustfile=$ENV{HOME}."/.mrtrust";
+
+       if (! -e $trustfile) {
+               print "mr: Assuming $config is trusted.\n";
+               print "mr: For better security, you are encouraged to create ~/.mrtrust\n";
+               print "mr: and list all trusted mrconfig files in it.\n";
+               return 1;
+       }
+
+       if (! %trusted) {
+               $trusted{"$ENV{HOME}/.mrconfig"}=1;
+               open (TRUST, "<", $trustfile) || die "$trustfile: $!";
+               while (<TRUST>) {
+                       chomp;
+                       s/^~\//$ENV{HOME}\//;
+                       $trusted{abs_path($_)}=1;
+               }
+               close TRUST;
+       }
+
+       return $trusted{$config};
+}
+
+
+sub is_trusted_repo {
+       my $repo=shift;
+       
+       # Tightly limit what is allowed in a repo name.
+       # No ../, no absolute paths, and no unusual filenames
+       # that might try to escape to the shell.
+       return $repo =~ /^[-_.+\/A-Za-z0-9]+$/ &&
+              $repo !~ /\.\./ && $repo !~ /^\//;
+}
+
+sub is_trusted_checkout {
+       my $command=shift;
+       
+       # To determine if the command is safe, compare it with the
+       # *_trusted_checkout config settings. Those settings are
+       # templates for allowed commands, so make sure that each word
+       # of the command matches the corresponding word of the template.
+       
+       my @words;
+       foreach my $word (split(' ', $command)) {
+               # strip quoting
+               if ($word=~/^'(.*)'$/) {
+                       $word=$1;
+               }
+               elsif ($word=~/^"(.*)"$/) {
+                       $word=$1;
+               }
+
+               push @words, $word;
+       }
+
+       foreach my $key (grep { /_trusted_checkout$/ }
+                        keys %{$config{''}{DEFAULT}}) {
+               my @twords=split(' ', $config{''}{DEFAULT}{$key});
+               next if @words > @twords;
+
+               my $match=1;
+               my $url;
+               for (my $c=0; $c < @twords && $match; $c++) {
+                       if ($twords[$c] eq '$url') {
+                               # Match all the typical characters found in
+                               # urls, plus @ which svn can use. Note
+                               # that the "url" might also be a local
+                               # directory.
+                               $match=(
+                                       defined $words[$c] &&
+                                       $words[$c] =~ /^[-_.+:@\/A-Za-z0-9]+$/
+                               );
+                               $url=$words[$c];
+                       }
+                       elsif ($twords[$c] eq '$repo') {
+                               # If a repo is not specified, assume it
+                               # will be the last path component of the
+                               # url, or something derived from it, and
+                               # check that.
+                               if (! defined $words[$c] && defined $url) {
+                                       ($words[$c])=$url=~/\/([^\/]+)\/?$/;
+                               }
+
+                               $match=(
+                                       defined $words[$c] &&
+                                       is_trusted_repo($words[$c])
+                               );
+                       }
+                       elsif (defined $words[$c] && $twords[$c] eq $words[$c]) {
+                               $match=1;
+                       }
+                       else {
+                               $match=0;
+                       }
+               }
+               return 1 if $match;
+       }
+
+       return 0;
+}
+

 my %loaded;
 sub loadconfig {
        my $f=shift;
 my %loaded;
 sub loadconfig {
        my $f=shift;


@@ -796,9 +915,11 @@ sub loadconfig {
 
        my $in;
        my $dir;
 
        my $in;
        my $dir;

+       my $trusted;

        if (ref $f eq 'GLOB') {
                $dir="";
        if (ref $f eq 'GLOB') {
                $dir="";

-               $in=$f; 
+               $in=$f;
+               $trusted=1;

        }
        else {
                if (! -e $f) {
        }
        else {
                if (! -e $f) {


@@ -811,6 +932,8 @@ sub loadconfig {
                }
                $loaded{$absf}=1;
 
                }
                $loaded{$absf}=1;
 

+               $trusted=is_trusted_config($absf);
+

                ($dir)=$f=~/^(.*\/)[^\/]+$/;
                if (! defined $dir) {
                        $dir=".";
                ($dir)=$f=~/^(.*\/)[^\/]+$/;
                if (! defined $dir) {
                        $dir=".";


@@ -848,7 +971,16 @@ sub loadconfig {
                chomp;
                next if /^\s*\#/ || /^\s*$/;
                if (/^\[([^\]]*)\]\s*$/) {
                chomp;
                next if /^\s*\#/ || /^\s*$/;
                if (/^\[([^\]]*)\]\s*$/) {

-                       $section=expandenv($1);
+                       $section=$1;
+
+                       if (! $trusted) {
+                               if (! is_trusted_repo($section) ||
+                                   $section eq 'ALIAS' ||
+                                   $section eq 'DEFAULT') {
+                                       die "mr: illegal section \"[$section]\" in untrusted $f line $line\n";
+                               }
+                       }
+                       $section=expandenv($section) if $trusted;

                }
                elsif (/^(\w+)\s*=\s*(.*)/) {
                        my $parameter=$1;
                }
                elsif (/^(\w+)\s*=\s*(.*)/) {
                        my $parameter=$1;


@@ -862,6 +994,17 @@ sub loadconfig {
                                chomp $value;
                        }
 
                                chomp $value;
                        }
 

+                       if (! $trusted) {
+                               # Untrusted files can only contain checkout
+                               # parameters.
+                               if ($parameter ne 'checkout') {
+                                       die "mr: illegal setting \"$parameter=$value\" in untrusted $f line $line\n";
+                               }
+                               if (! is_trusted_checkout($value)) {
+                                       die "mr: illegal checkout command \"$value\" in untrusted $f line $line\n";
+                               }
+                       }
+

                        if ($parameter eq "include") {
                                print "mr: including output of \"$value\"\n" if $verbose;
                                unshift @lines, `$value`;
                        if ($parameter eq "include") {
                                print "mr: including output of \"$value\"\n" if $verbose;
                                unshift @lines, `$value`;


@@ -1210,7 +1353,7 @@ sub getopts {
                "j|jobs:i" => \$jobs,
        );
        if (! $result || @ARGV < 1) {
                "j|jobs:i" => \$jobs,
        );
        if (! $result || @ARGV < 1) {

-               die("Usage: mr [-d directory] action [params ...]\n".
+               die("Usage: mr [options] action [params ...]\n".

                    "(Use mr help for man page.)\n");
        }
        
                    "(Use mr help for man page.)\n");
        }
        


@@ -1415,6 +1558,15 @@ git_bare_register =
        echo "Registering git url: $url in $MR_CONFIG"
        mr -c "$MR_CONFIG" config "`pwd`" checkout="git clone --bare '$url' '$MR_REPO'"
 
        echo "Registering git url: $url in $MR_CONFIG"
        mr -c "$MR_CONFIG" config "`pwd`" checkout="git clone --bare '$url' '$MR_REPO'"
 

+svn_trusted_checkout = svn co $url $repo
+svn_alt_trusted_checkout = svn checkout $url $repo
+git_trusted_checkout = git clone $url $repo
+bzr_trusted_checkout = bzr clone $url $repo
+# cvs: too hard
+hg_trusted_checkout = hg clone $url $repo
+darcs_trusted_checkout = darcs get $url $repo
+git_bare_trusted_checkout = git clone --bare $url $repo
+

 help =
        if [ ! -e "$MR_PATH" ]; then
                error "cannot find program path"
 help =
        if [ ! -e "$MR_PATH" ]; then
                error "cannot find program path"